We weren’t asking to enter MOK Manager for about 3 months and nothing works there after receiving Kernel 5.0.10. Download it manually on third fresh install successfully (20190429 build). MOK Manager is enabled permanently here to keep Secure Boot enabled, and for dual booting 2 distros (Deepin 15.10).
zypper dist-upgrade -r kernel-repo
Retrieving repository 'kernel-repo' metadata ----------------------------------------\]
New repository or package signing key received:
Repository: kernel-repo
Key Name: Kernel OBS Project <Kernel@build.opensuse.org>
Key Fingerprint: 4529410A B52F94C4 03BAB484 ECEEF210 03579C1D
Key Created: Fri Jun 16 10:16:45 2017
Key Expires: Sun Aug 25 10:16:45 2019
Rpm Name: gpg-pubkey-03579c1d-5943e84d
Do you want to reject the key, trust temporarily, or trust always? [r/t/a/?] (r): a
Retrieving repository 'kernel-repo' metadata .....................................[done]
Building repository 'kernel-repo' cache ..........................................[done]
Loading repository data...
Reading installed packages...
Computing distribution upgrade...
**4 Problems:
Problem: problem with installed package kernel-firmware-20190409-1.1.noarch
Problem: problem with installed package kernel-macros-5.0.10-1.2.noarch
Problem: problem with installed package pesign-obs-integration-10.1-3.1.x86_64
Problem: problem with installed package ucode-amd-20190409-1.1.noarch**
Problem: problem with installed package kernel-firmware-20190409-1.1.noarch
Solution 1: install kernel-firmware-20190502-258.1.noarch (with vendor change)
openSUSE --> obs://build.opensuse.org/Kernel
Solution 2: keep obsolete kernel-firmware-20190409-1.1.noarch
Choose from above solutions by number or skip, retry or cancel [1/2/s/r/c] (c): 1
Problem: problem with installed package kernel-macros-5.0.10-1.2.noarch
Solution 1: install kernel-macros-5.1.0-1.1.ga974d8b.noarch (with vendor change)
openSUSE --> obs://build.opensuse.org/Kernel
Solution 2: keep obsolete kernel-macros-5.0.10-1.2.noarch
Choose from above solutions by number or skip, retry or cancel [1/2/s/r/c] (c): 1
Problem: problem with installed package pesign-obs-integration-10.1-3.1.x86_64
Solution 1: install pesign-obs-integration-10.1-4.1.x86_64 (with vendor change)
openSUSE --> obs://build.opensuse.org/Kernel
Solution 2: keep obsolete pesign-obs-integration-10.1-3.1.x86_64
Choose from above solutions by number or skip, retry or cancel [1/2/s/r/c] (c): 1
Problem: problem with installed package ucode-amd-20190409-1.1.noarch
Solution 1: install ucode-amd-20190502-258.1.noarch (with vendor change)
openSUSE --> obs://build.opensuse.org/Kernel
Solution 2: keep obsolete ucode-amd-20190409-1.1.noarch
Choose from above solutions by number or skip, retry or cancel [1/2/s/r/c] (c): 1
Resolving dependencies...
Computing distribution upgrade...
The following 4 packages are going to be upgraded:
kernel-firmware kernel-macros pesign-obs-integration ucode-amd
The following 4 packages are going to change vendor:
kernel-firmware openSUSE -> obs://build.opensuse.org/Kernel
kernel-macros openSUSE -> obs://build.opensuse.org/Kernel
pesign-obs-integration openSUSE -> obs://build.opensuse.org/Kernel
ucode-amd openSUSE -> obs://build.opensuse.org/Kernel
The following package requires a system reboot:
kernel-firmware
4 packages to upgrade, 4 to change vendor.
Overall download size: 80.7 MiB. Already cached: 0 B. After the operation, additional
2.3 MiB will be used.
Note: System reboot required.
Continue? [y/n/v/...? shows all options] (y): y
Not shown in the Grub menu, but shown in the terminal. Override repo patch with RPM package works.
Hi
Not sure what your asking? But if those are the kernels packages available, then your repo (or it’s mirror) has not synced… everything should be at 5.1 in Kernel:HEAD.
We’re just reporting a bug that occurred 3 times back to back. The mirror is always the default one and we rarely have an issue there. The solution was to compile the latest Kernel (stable) with the RPM package.
The bug is real and even if we do have problems with MOK since Kernel 5.0-rc4, this time, the bug is on the kernel side or with tweaking the bootline with iommu=soft.**
We get the 4 packages labeled in red in post number one without the Kernel. Sucks!**
sudo zypper up
Loading repository data...
Reading installed packages...
The following 5 package updates will NOT be installed:
kernel-default-5.1.0-1.1.ga974d8b kernel-default-devel-5.1.0-1.1.ga974d8b
kernel-devel-5.1.0-1.1.ga974d8b kernel-source-5.1.0-1.1.ga974d8b
kernel-syms-5.1.0-1.1.ga974d8b
mokutil --sb-state
Unless the bug comes from tweaking the bootline with <<iommu=soft>>, Tumbleweed does not support mainline Kernel with Secure Boot enabled in this latest one.
This is far from being stable. Would have preferred a release candidate 8 instead.
Same pattern, compiles manually only. We are waiting for a Secure Boot Patch on mainline Kernel for too long now.
4 previous ISO images were made in The Mint Installer(19.1) and this one (20190507) in Windows 10 = Rufus 3.5. Go figure, got the 5 packages correctly this time without MOK Manager. Things are back to normal.
Only one modification to the dedicated partition: Swap is enlarged to RAM size. Plus, to get WIFI to work, we click on switch to wicked and switch to NetwokManager again.
the following 5 NEW packages are going to be installed:
kernel-default-5.1.0-1.1.ga974d8b kernel-default-devel-5.1.0-1.1.ga974d8b
kernel-devel-5.1.0-1.1.ga974d8b kernel-source-5.1.0-1.1.ga974d8b
kernel-syms-5.1.0-1.1.ga974d8b
The following 5 packages are going to be REMOVED:
kernel-default-5.0.11-1.3 kernel-default-devel-5.0.11-1.3 kernel-devel-5.0.11-1.3
kernel-source-5.0.11-1.3 kernel-syms-5.0.11-1.3
The following 4 packages are going to be upgraded:
kernel-firmware kernel-macros pesign-obs-integration ucode-amd
The following 4 packages are going to change vendor:
kernel-firmware openSUSE -> obs://build.opensuse.org/Kernel
kernel-macros openSUSE -> obs://build.opensuse.org/Kernel
pesign-obs-integration openSUSE -> obs://build.opensuse.org/Kernel
ucode-amd openSUSE -> obs://build.opensuse.org/Kernel
The following 2 packages require a system reboot:
kernel-default-5.1.0-1.1.ga974d8b kernel-firmware
4 packages to upgrade, 5 new, 5 to remove, 4 to change vendor.
Overall download size: 263.5 MiB. Already cached: 0 B. After the operation, additional
14.3 MiB will be used.
Note: System reboot required.
Continue? [y/n/v/...? shows all options] (y): y
MOK Manager or our obsession to keep secure boot enabled comes with side effects. This experiment confirms that MOK corrupts all ISO makers everywhere we go introducing abnormal action-reaction. The reason is unclear, but they all do the same: MBR and/or UEFI.
No-one is offering GPT only. Our BIOS setup is made for Secure boot only, CSM is OFF, GPT is ON. Only Rufus offers GPT only and we do not have errors there. We must use MOK to discover its side effects.
We have known since about 2 months that MOK corrupts Startup Disk Creator in Ubuntu affecting all others available in Gnome Software. We did not make the relation with MOK + side effects are not all the same.
This week we have done it: MOK has an incidence on the Linux ISO makers apps. The good news is that Tumbleweed doesn’t need MOK, simply because the Kernel comes from the repo. It is not an unsigned Kernel, which is Secure Boot number one enemy:
Error Invalid Signature
Error You Need To Load The Kernel First