Description of problem: Can't boot, get following menu to screen when attempting to: error: ../../grub-core/kern/efi/sb.c:150:bad shim signature. error: ..../grub-core/loader/i386/efi/linux.c:208:you need to load the kernel first. Press any key to continue.. Version-Release number of selected component (if applicable): 5.14.0-76.el9.x86_64 and 5.14.0-75.el9.x86_64 How reproducible: Always Steps to Reproduce: 1. dnf update 2. reboot 3. Actual results: https://photos.app.goo.gl/zSYfBTwxgCiwBf9GA Expected results: A booting system Additional info: The last working kernel is kernel-5.14.0-71.el9.x86_64
@rharwood It looks like kernel -71 -72 -73 and -74 are signed properly in CentOS Stream, but after that the kernels are signed with the Test cert: • pesign -l --in=vmlinuz --------------------------------------------- certificate address is 0x7f1b2bff3808 Content was not encrypted. Content is detached; signature cannot be verified. The signer's common name is Red Hat Test Certificate No signer email address. Signing time: Wed Mar 30, 2022 There were certs or crls included. --------------------------------------------- Did this update to pesign cause any changes here? https://kojihub.stream.rdu2.redhat.com/koji/buildinfo?buildID=17784 Kernel -74 (signed properly): https://kojihub.stream.rdu2.redhat.com/koji/buildinfo?buildID=17731 Kernel -75 (signed with the test cert): https://kojihub.stream.rdu2.redhat.com/koji/buildinfo?buildID=17791
*** This bug has been marked as a duplicate of bug 2070940 ***