I am running Aeon on a laptop with nvidia drivers. Everything worked fine until i missed the mok screen on bootup.
Since then 3d acceleration is no more.
I tried a few thinks to get the screen to import the key back. All attemps without success.
sudo transactional-update shell got me inside and i tried mokutil --import /var/lib/nvidia-pubkeys/MOK-nvidia-driver-G0<X>-<driver_version>-<kernel_flavor>.der --root-pw like in SDB closed with exit and sudo reboot now
next inside the transactional-update shell i tried mokutil --revoke-import
as the root user. It should not require a transactional-update shell because you are not writing to the root file system. But you still need to watch for the blue screen on the next boot to complete the operation.
unfortunately this one is not working, as i tried to show in my first point of the original post. This is exactly the page where i found the command i entered.
The only possible way for the path /var/lib/nvidia-pubkeys to exist within transactional-update shell but not in your your regular host shell filesystem, is if you installed the nvidia drivers, and then didn’t reboot before looking.
Assuming you’re booted into Snapshot #1 (S1, for brevity)
You run sudo transactional-update pkg in nvidia-*
Transactional-update then snapshots S1, creating S2.
When transactional-update completes it’s task successfully, you then must reboot the system, and it will boot you into S2.
The filesystem in S1 has no idea what’s going on in S2, because it can’t even see it.
You need to reboot after a transactional-update operation, in order for the changes to take effect.
And don’t use transactional-update shell
But that’s a completely seperate issue.
If you did not reboot, just simply run your sudo transactional-update pkg in packagename command again, it will re-snapshot S1 and create a new snapshot, then reboot when the install completes.
Nothing that happens during a “transaction” affects the running system, or the filesystem, until you reboot.
In my output updstairs, when entering the transactional shell it says:
Can anyone explain why this is, how to synchronise it or is it normal? Still I have the different /var/lib folders.
(besides I ran the package (re)install again without any change. The MOK Screen even appeared, but it did not work to entroll the key)
- user@computer:~> sudo transactional-update -i pkg rm nvidia-driver-G06-kmp-default nvidia-video-G06 nvidia-gl-G06 nvidia-compute-G06
[sudo] Passwort für user:
Checking for newer version.
transactional-update 4.5.0 started
Options: -i pkg rm nvidia-driver-G06-kmp-default nvidia-video-G06 nvidia-gl-G06 nvidia-compute-G06
Separate /var detected.
2024-02-09 23:43:01 tukit 4.5.0 started
2024-02-09 23:43:01 Options: -c111 open
2024-02-09 23:43:01 Using snapshot 111 as base for new snapshot 112.
2024-02-09 23:43:01 /var/lib/overlay/111/etc
2024-02-09 23:43:01 Syncing /etc of previous snapshot 110 as base into new snapshot "/.snapshots/112/snapshot"
2024-02-09 23:43:01 SELinux is enabled.
ID: 112
2024-02-09 23:43:03 Transaction completed.
Calling zypper remove
2024-02-09 23:43:04 tukit 4.5.0 started
2024-02-09 23:43:04 Options: callext 112 zypper -R {} remove nvidia-driver-G06-kmp-default nvidia-video-G06 nvidia-gl-G06 nvidia-compute-G06
2024-02-09 23:43:05 Executing `zypper -R /tmp/transactional-update-AMGjwm remove nvidia-driver-G06-kmp-default nvidia-video-G06 nvidia-gl-G06 nvidia-compute-G06`:
Reading installed packages...
Resolving package dependencies...
- The following 4 packages are going to be REMOVED:
nvidia-compute-G06 nvidia-driver-G06-kmp-default nvidia-gl-G06 nvidia-video-G06
- 4 packages to remove.
After the operation, 764.2 MiB will be freed.
Continue? [y/n/v/...? shows all options] (y): y
(1/4) Removing nvidia-gl-G06-545.29.06-18.1.x86_64 [..
Removed "/etc/systemd/system/multi-user.target.wants/prime-select.service".
prime-select: service disabled. Remember prime-select needs this service to work correctly.
Use prime-select service restore to enable service again
Failed to create stream fd: No such file or directory
.done]
(2/4) Removing nvidia-video-G06-545.29.06-18.1.x86_64 [..done]
(3/4) Removing nvidia-compute-G06-545.29.06-18.1.x86_64 [...done]
(4/4) Removing nvidia-driver-G06-kmp-default-545.29.06_k6.6.2_1-18.1.x86_64 [..
SKIP: /var/lib/nvidia-pubkeys/MOK-nvidia-driver-G06-545.29.06-18.1-default.der is not in MokList
warning: /usr/lib/modprobe.d/50-nvidia-default.conf saved as /usr/lib/modprobe.d/50-nvidia-default.conf.rpmsave
warning: /usr/lib/dracut/dracut.conf.d/60-nvidia-default.conf saved as /usr/lib/dracut/dracut.conf.d/60-nvidia-default.conf.rpmsave
update-alternatives: warning: alternative /usr/lib/nvidia/alternate-install-present-default (part of link group alternate-install-present) doesn't exist; removing from list of alternatives
update-alternatives: warning: /etc/alternatives/alternate-install-present is dangling; it will be updated with best choice
.done]
2024-02-09 23:43:22 Application returned with exit status 0.
2024-02-09 23:43:22 Transaction completed.
Trying to rebuild kdump initrd
2024-02-09 23:43:23 tukit 4.5.0 started
2024-02-09 23:43:23 Options: close 112
2024-02-09 23:43:24 New default snapshot is #112 (/.snapshots/112/snapshot).
2024-02-09 23:43:24 Transaction completed.
- Please reboot your machine to activate the changes and avoid data loss.
New default snapshot is #112 (/.snapshots/112/snapshot).
transactional-update finished
I just tried some things. I copied the key to the boot directory to try importing it via BIOS. (But this seems not as easy as intended.) At least i could see the key without being in the transactional-update shell.
user@computer:~> sudo mokutil --import /boot/MOK-nvidia-driver-G06-545.29.06-18.1-default.der
[sudo] Passwort für user:
input password:
input password again:
Failed to enroll new keys
user@computer:~> sudo mokutil --test-key /boot/MOK-nvidia-driver-G06-545.29.06-18.1-default.der
/boot/MOK-nvidia-driver-G06-545.29.06-18.1-default.der is not enrolled
This means mokutil failed to create EFI variable with enrollment request. Are you on EFI in the first place? Is /sys/firmware/efi/efivars mounted? Any errors in kernel log (dmesg output) when run this command?
Am I on EFI? I think so. I can find a few entries in efivars, when I ls the directory. Few entries of dmesg are red. Mostly about the ACPI and Bluetooth. The whole output is too long to post it here.
What am I looking for?