[solved] Cannot dual booting Ubuntu with Debian: error: bad shim signature, you need to load the kernel first

[klatls]

Hi all, is there a way to disable 'grub-install' during 'apt upgrade' ?

If I rename it, during the upgrade what apt does ?

[sunrat]

Please post more context. Why would you wish to do that?

I run a few different distros in multiboot and found some would rewrite GRUB with new kernel upgrades. The solution was to remove the package grub-efi-amd64 from those distros.
It's fairly trivial to boot the distro you wish to control GRUB if it has been overwritten and just grub-install to return it.

[klatls]

I have installed ubuntu and debian
have a bios security boot problem so when I
have the ubuntu bootloader menu I can't boot debian
and when I have the debian bootloader menu I can't
boot ubuntu.
I need Debian grub to upgrade its menu during
'apt upgrade' but it does not have to install
in the ESP, then ubuntu grub will update
Debian list

[Aki]

Hello,

I have installed ubuntu and debian
[..]
I need Debian grub to upgrade its menu during 'apt upgrade' but it does not have to install in the ESP [..]

When booting in UEFI mode, Debian and Ubuntu store their boot loaders in different directories of the ESP partition, so they should not interfere with each other. They might interfere if you put them in the same directory on the ESP partition.

[..] then ubuntu grub will update Debian list

If you're booting from Ubuntu's grub efi, you probably don't need to install Debian grub.

[klatls]

When booting in UEFI mode, Debian and Ubuntu store their boot loaders in different directories of the ESP partition, so they should not interfere with each other. They might interfere if you put them in the same directory on the ESP partition.

It is correct they are in different folders

If you're booting from Ubuntu's grub efi, you probably don't need to install Debian grub.

If I uninstall debian grub how ubuntu grub can read changes ( for example when ddebian apt upgrade the kernel ) ?

If I just rename grub-install, what happen to apt process during 'apt upgrade' ( kernel upgrade or other that imply
the call of 'grub-install') ?

[Aki]

Hello,

When booting in UEFI mode, Debian and Ubuntu store their boot loaders in different directories of the ESP partition, so they should not interfere with each other. They might interfere if you put them in the same directory on the ESP partition.

It is correct they are in different folders

So they should not interfere. But you reported the opposite. So what is really happening?

If you're booting from Ubuntu's grub efi, you probably don't need to install Debian grub.

If I uninstall debian grub how ubuntu grub can read changes ( for example when ddebian apt upgrade the kernel ) ?

If I understand your previous posts correctly, you asked how to boot Debian from the Ubuntu boot loader. This may be possible using the "Other OS" probing support in Ubuntu's grub configuration. You should update Ubuntu's grub (in Ubuntu) every time you update Debian's kernel. Of course, this isn't practical (if you use Debian as your main OS).

If I just rename grub-install, what happen to apt process during 'apt upgrade' ( kernel upgrade or other that imply
the call of 'grub-install') ?

The hooks called when upgrading packages will fail. If Debian was previously in a bootable state, it will probably boot the previously configured kernel, if it is still installed. It's a mess.

[klatls]

So they should not interfere. But you reported the opposite. So what is really happening?

The problem is the bios secure boot
in the ESP there are both debian and ubuntu, both OS's grub created theyr menu
but when I start with the ubuntu grub menu and select debian there is a shim signature error
and I can't boot debian
the same but in opposite way, happens if I start with debian grub menu

If I understand your previous posts correctly, you asked how to boot Debian from the Ubuntu boot loader. This may be possible using the "Other OS" probing support in Ubuntu's grub configuration. You should update Ubuntu's grub (in Ubuntu) every time you update Debian's kernel. Of course, this isn't practical (if you use Debian as your main OS).

I use as primary OS ubuntu
If ubuntu update-grub can probe all debian kernel versions even if debian grub is not installed, then
I could uninstall grub on Debian, but I can't because I need it to start debian due to bios security boot error

I could be wrong but, I remember to have upgraded a kernel in a live linux and for some reason grub-install failed
but the 'apt upgrade' process continued anyway

[Aki]

Hello,

What Debian version have you installed ?

So they should not interfere. But you reported the opposite. So what is really happening?

[..] when I start with the ubuntu grub menu and select debian there is a shim signature error and I can't boot debian the same but in opposite way, happens if I start with debian grub menu

What is the full message of the "shim signature error"?

Can you record a video of the grub boot sequence ?

I use as primary OS ubuntu
[..]
I could be wrong but, I remember to have upgraded a kernel in a live linux and for some reason grub-install failed
but the 'apt upgrade' process continued anyway

So, you can try by yourself ...

[klatls]

Can you record a video of the grub boot sequence ?

There is none boot sequence, when I select debian in ubuntu grub menu
or ubuntu in debian grub menu appears this error

[Aki]

Hello,

So the error message is:

error: bad grub signature.
error: you need to load the kernel first.

Press any key to continue.

What Debian version have you installed ?

Can you record a video from the when you turn on the computer up to when the previous error appears ?

[klatls]

What Debian version have you installed ?

Can you record a video from the when you turn on the computer up to when the previous error appears ?

Debian is the latest 12

As I told, there is no boot sequence
Now, I boot with ubuntu grub menu because I did installed last
If I want boot debian I have to select the bios boot menu at startup
and I have the possibility to choose between

UEFI debian
UEFI ubuntu

I did not find a way to allow debian or ubuntu recognize each other kernel
I saved debian certificate in ESP but it did nothing

[pbear]

Not certain this will work, but relatively easy to try and very easy to unwind if it doesn't solve the problem.
One simple way to get each OS booting from its own Grub menu is to use a custom.cfg file.

Boot Ubuntu. Run sudo nano /boot/grub/custom.cfg (or whatever method you generally use to edit config files). Paste in this text:

Code: Select all

menuentry "Debian 12 (Bookworm)" {
  insmod gpt
  insmod ext4
  search --no-floppy --label --set=root Debian-12
  configfile /boot/grub/grub.cfg
}

Ctrl-O to write-out, Enter to confirm overwrite file, Ctrl-X to exit.

Using Disks (or other preferred method), give Debian's file system the label Debian-12 (you can use another label; conform custom.cfg reference to match).

Next run sudo cp /etc/default/grub /etc/default/grub-backup, then sudoedit /etc/default/grub. Edit timeout style from hidden to menu. Change timeout from zero to a number of seconds (I like 6, some like 10). Add a new line after the timeout, GRUB_RECORDFAIL_TIMEOUT=$GRUB_TIMEOUT. Comment out os-prober line, restoring Ubuntu default of disabled. Save file. Run sudo update-grub.

That should do it. Grub menu will display at boot and have an option to boot Debian. If you select the latter, you will be switched to Debian and see its Grub menu (which displays by default).
The recordfail line is needed to correct a bug, which otherwise will give you 30 seconds timeouts after the first boot.

If this doesn't work, delete the custom.cfg file, restore /etc/default/grub from the backup, and run sudo update-grub again.
Then, try disabling secure boot in the firmware, for now just as a trial. Report whether that solves the problem.

[Aki]

Hello,

Debian is the latest 12

As I told, there is no boot sequence
Now, I boot with ubuntu grub menu because I did installed last

If I want boot debian I have to select the bios boot menu at startup
and I have the possibility to choose between

• UEFI debian

• UEFI ubuntu

I did not find a way to allow debian or ubuntu recognize each other kernel
I saved debian certificate in ESP but it did nothing

You can use the boot-info-script command (the Debian version is from the following package: boot-info-script) to get more detailed information about how grub was installed, what versions are involved, and what partitions are involved.

You can share the output of the boot-info-script command in a follow-up post in the body of the message (between code tags) or as an attachment.

Please change the subject of the first post, as it is not about apt or grub-install, but about reports of conflicting grub installations on dual-boot systems; i.e.:

Cannot dual booting Ubuntu with Debian: error: bad grub signature, you need to load the kernel first

Note that the same topic has ben already previously opened (for dual boot of Kubuntu 23.10 with Debian 12):

• Bad shim signature - you need to load the kernel first

Hope this helps.

[klatls]

If this doesn't work, delete the custom.cfg file, restore /etc/default/grub from the backup, and run sudo update-grub again.

It doesn't works, now there were as last line the debian 12 I put in custom.cfg but selecting,
for a few seconds, the written options disappeared has if it would boot
but then returned back to menu

Then, try disabling secure boot in the firmware, for now just as a trial. Report whether that solves the problem.

yes, if I disable secure boot I have no problems booting from both, debian or ubuntu menu

[klatls]

You can use the boot-info-script command (the Debian version is from the following package: boot-info-script) to get more detailed information about how grub was installed, what versions are involved, and what partitions are involved.

You can share the output of the boot-info-script command in a follow-up post in the body of the message (between code tags) or as an attachment.

bootinfoscript

Code: Select all

# cat RESULTS.txt 
                 Boot Info Script 0.78      [09 October 2019]


============================= Boot Info Summary: ===============================


============================ Drive/Partition Info: =============================

no valid partition table found
"blkid" output: ________________________________________________________________

Device           UUID                                   TYPE       LABEL

/dev/loop0                                              squashfs   
/dev/loop1                                              squashfs   
/dev/loop10                                             squashfs   
/dev/loop11                                             squashfs   
/dev/loop12                                             squashfs   
/dev/loop13                                             squashfs   
/dev/loop14                                             squashfs   
/dev/loop15                                             squashfs   
/dev/loop16                                             squashfs   
/dev/loop17                                             squashfs   
/dev/loop18                                             squashfs   
/dev/loop19                                             squashfs   
/dev/loop2                                              squashfs   
/dev/loop3                                              squashfs   
/dev/loop4                                              squashfs   
/dev/loop5                                              squashfs   
/dev/loop6                                              squashfs   
/dev/loop7                                              squashfs   
/dev/loop8                                              squashfs   
/dev/loop9                                              squashfs   
/dev/nvme0n1p1   2A77-3BBC                              vfat       
/dev/nvme0n1p2                                                     
/dev/nvme0n1p3   BAD07E74D07E372B                       ntfs       
/dev/nvme0n1p4   747A89F77A89B700                       ntfs       
/dev/nvme0n1p5   71f07853-c15b-427e-894b-bcc47f5ad354   swap       
/dev/nvme0n1p6   38f7d6f3-e369-41aa-9620-fae78a223ea3   ext4       
/dev/nvme0n1p7   cfcea43e-2bac-4d39-a19e-d5805ddbe62b   ext4       
/dev/nvme0n1p8   56671A9836B0C9AF                       ntfs       backup
/dev/nvme0n1p9   2dbde335-c00d-4e8b-ac09-d4033957b8a8   ext4       

========================= "ls -l /dev/disk/by-id" output: ======================

total 0
lrwxrwxrwx 1 root root 13 Dec  3 17:25 nvme-eui.002538db21a1a05b -> ../../nvme0n1
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-eui.002538db21a1a05b-part1 -> ../../nvme0n1p1
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-eui.002538db21a1a05b-part2 -> ../../nvme0n1p2
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-eui.002538db21a1a05b-part3 -> ../../nvme0n1p3
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-eui.002538db21a1a05b-part4 -> ../../nvme0n1p4
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-eui.002538db21a1a05b-part5 -> ../../nvme0n1p5
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-eui.002538db21a1a05b-part6 -> ../../nvme0n1p6
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-eui.002538db21a1a05b-part7 -> ../../nvme0n1p7
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-eui.002538db21a1a05b-part8 -> ../../nvme0n1p8
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-eui.002538db21a1a05b-part9 -> ../../nvme0n1p9
lrwxrwxrwx 1 root root 13 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y -> ../../nvme0n1
lrwxrwxrwx 1 root root 13 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y_1 -> ../../nvme0n1
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y_1-part1 -> ../../nvme0n1p1
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y_1-part2 -> ../../nvme0n1p2
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y_1-part3 -> ../../nvme0n1p3
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y_1-part4 -> ../../nvme0n1p4
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y_1-part5 -> ../../nvme0n1p5
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y_1-part6 -> ../../nvme0n1p6
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y_1-part7 -> ../../nvme0n1p7
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y_1-part8 -> ../../nvme0n1p8
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y_1-part9 -> ../../nvme0n1p9
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y-part1 -> ../../nvme0n1p1
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y-part2 -> ../../nvme0n1p2
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y-part3 -> ../../nvme0n1p3
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y-part4 -> ../../nvme0n1p4
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y-part5 -> ../../nvme0n1p5
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y-part6 -> ../../nvme0n1p6
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y-part7 -> ../../nvme0n1p7
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y-part8 -> ../../nvme0n1p8
lrwxrwxrwx 1 root root 15 Dec  3 17:25 nvme-Samsung_SSD_980_1TB_S649NL0TB66302Y-part9 -> ../../nvme0n1p9

================================ Mount points: =================================

Device           Mount_Point              Type       Options

/dev/nvme0n1p1   /boot/efi                vfat       (rw,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/nvme0n1p3   /mnt/windows             fuseblk    (rw,relatime,user_id=0,group_id=0,allow_other,blksize=4096)
/dev/nvme0n1p6   /                        ext4       (rw,relatime,stripe=32)
/dev/nvme0n1p7   /home                    ext4       (rw,relatime)
/dev/nvme0n1p8   /mnt/backup              fuseblk    (rw,relatime,user_id=0,group_id=0,allow_other,blksize=4096)

[Aki]

Hello,

What is the UUID of Ubuntu and Debian partitions among the following ext4 partitions ?

Code: Select all

/dev/nvme0n1p1   2A77-3BBC                              vfat       
/dev/nvme0n1p2                                                     
/dev/nvme0n1p3   BAD07E74D07E372B                       ntfs       
/dev/nvme0n1p4   747A89F77A89B700                       ntfs       
/dev/nvme0n1p5   71f07853-c15b-427e-894b-bcc47f5ad354   swap       
/dev/nvme0n1p6   38f7d6f3-e369-41aa-9620-fae78a223ea3   ext4       
/dev/nvme0n1p7   cfcea43e-2bac-4d39-a19e-d5805ddbe62b   ext4       
/dev/nvme0n1p8   56671A9836B0C9AF                       ntfs       backup
/dev/nvme0n1p9   2dbde335-c00d-4e8b-ac09-d4033957b8a8   ext4  

What is the content of /boot/grub/grub.cfg in Ubuntu ?

[klatls]

What is the UUID of Ubuntu and Debian partitions among the following ext4 partitions ?

Code: Select all

/dev/nvme0n1p1   2A77-3BBC                              vfat       
/dev/nvme0n1p2                                                     
/dev/nvme0n1p3   BAD07E74D07E372B                       ntfs       
/dev/nvme0n1p4   747A89F77A89B700                       ntfs       
/dev/nvme0n1p5   71f07853-c15b-427e-894b-bcc47f5ad354   swap       
/dev/nvme0n1p6   38f7d6f3-e369-41aa-9620-fae78a223ea3   ext4       Ubuntu /
/dev/nvme0n1p7   cfcea43e-2bac-4d39-a19e-d5805ddbe62b   ext4       Ubuntu /home
/dev/nvme0n1p8   56671A9836B0C9AF                       ntfs       backup
/dev/nvme0n1p9   2dbde335-c00d-4e8b-ac09-d4033957b8a8   ext4      Debian /

What is the content of /boot/grub/grub.cfg in Ubuntu ?

/boot/grub/grub.cfg

Code: Select all

# cat /boot/grub/grub.cfg 

#
# DO NOT EDIT THIS FILE
#
# It is automatically generated by grub-mkconfig using templates
# from /etc/grub.d and settings from /etc/default/grub
#

### BEGIN /etc/grub.d/00_header ###
if [ -s $prefix/grubenv ]; then
  set have_grubenv=true
  load_env
fi
if [ "${initrdfail}" = 2 ]; then
   set initrdfail=
elif [ "${initrdfail}" = 1 ]; then
   set next_entry="${prev_entry}"
   set prev_entry=
   save_env prev_entry
   if [ "${next_entry}" ]; then
      set initrdfail=2
   fi
fi
if [ "${next_entry}" ] ; then
   set default="${next_entry}"
   set next_entry=
   save_env next_entry
   set boot_once=true
else
   set default="0"
fi

if [ x"${feature_menuentry_id}" = xy ]; then
  menuentry_id_option="--id"
else
  menuentry_id_option=""
fi

export menuentry_id_option

if [ "${prev_saved_entry}" ]; then
  set saved_entry="${prev_saved_entry}"
  save_env saved_entry
  set prev_saved_entry=
  save_env prev_saved_entry
  set boot_once=true
fi

function savedefault {
  if [ -z "${boot_once}" ]; then
    saved_entry="${chosen}"
    save_env saved_entry
  fi
}
function initrdfail {
    if [ -n "${have_grubenv}" ]; then if [ -n "${partuuid}" ]; then
      if [ -z "${initrdfail}" ]; then
        set initrdfail=1
        if [ -n "${boot_once}" ]; then
          set prev_entry="${default}"
          save_env prev_entry
        fi
      fi
      save_env initrdfail
    fi; fi
}
function recordfail {
  set recordfail=1
  if [ -n "${have_grubenv}" ]; then if [ -z "${boot_once}" ]; then save_env recordfail; fi; fi
}
function load_video {
  if [ x$feature_all_video_module = xy ]; then
    insmod all_video
  else
    insmod efi_gop
    insmod efi_uga
    insmod ieee1275_fb
    insmod vbe
    insmod vga
    insmod video_bochs
    insmod video_cirrus
  fi
}

if [ x$feature_default_font_path = xy ] ; then
   font=unicode
else
insmod part_gpt
insmod ext2
search --no-floppy --fs-uuid --set=root 38f7d6f3-e369-41aa-9620-fae78a223ea3
    font="/usr/share/grub/unicode.pf2"
fi

if loadfont $font ; then
  set gfxmode=1920x1080
  load_video
  insmod gfxterm
  set locale_dir=$prefix/locale
  set lang=en_US
  insmod gettext
fi
terminal_output gfxterm
insmod part_gpt
insmod ext2
search --no-floppy --fs-uuid --set=root 38f7d6f3-e369-41aa-9620-fae78a223ea3
insmod png
background_image -m stretch /boot/grub/linux-inside-fhd.png
if [ "${recordfail}" = 1 ] ; then
  set timeout=30
else
  if [ x$feature_timeout_style = xy ] ; then
    set timeout_style=menu
    set timeout=10
  # Fallback normal timeout code in case the timeout_style feature is
  # unavailable.
  else
    set timeout=10
  fi
fi
### END /etc/grub.d/00_header ###

### BEGIN /etc/grub.d/05_debian_theme ###
insmod part_gpt
insmod ext2
search --no-floppy --fs-uuid --set=root 38f7d6f3-e369-41aa-9620-fae78a223ea3
insmod png
if background_image /boot/grub/linux-inside-fhd.png; then
  true
else
  set menu_color_normal=white/black
  set menu_color_highlight=black/light-gray
fi
### END /etc/grub.d/05_debian_theme ###

### BEGIN /etc/grub.d/10_linux ###
function gfxmode {
	set gfxpayload="${1}"
	if [ "${1}" = "keep" ]; then
		set vt_handoff=vt.handoff=7
	else
		set vt_handoff=
	fi
}
if [ "${recordfail}" != 1 ]; then
  if [ -e ${prefix}/gfxblacklist.txt ]; then
    if [ ${grub_platform} != pc ]; then
      set linux_gfx_mode=keep
    elif hwmatch ${prefix}/gfxblacklist.txt 3; then
      if [ ${match} = 0 ]; then
        set linux_gfx_mode=keep
      else
        set linux_gfx_mode=text
      fi
    else
      set linux_gfx_mode=text
    fi
  else
    set linux_gfx_mode=keep
  fi
else
  set linux_gfx_mode=text
fi
export linux_gfx_mode
menuentry 'Ubuntu' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-simple-38f7d6f3-e369-41aa-9620-fae78a223ea3' {
	recordfail
	load_video
	gfxmode $linux_gfx_mode
	insmod gzio
	if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
	insmod part_gpt
	insmod ext2
	search --no-floppy --fs-uuid --set=root 38f7d6f3-e369-41aa-9620-fae78a223ea3
	linux	/boot/vmlinuz-6.8.0-49-generic root=UUID=38f7d6f3-e369-41aa-9620-fae78a223ea3 ro  
	initrd	/boot/initrd.img-6.8.0-49-generic
}
submenu 'Advanced options for Ubuntu' $menuentry_id_option 'gnulinux-advanced-38f7d6f3-e369-41aa-9620-fae78a223ea3' {
	menuentry 'Ubuntu, with Linux 6.8.0-49-generic' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.8.0-49-generic-advanced-38f7d6f3-e369-41aa-9620-fae78a223ea3' {
		recordfail
		load_video
		gfxmode $linux_gfx_mode
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_gpt
		insmod ext2
		search --no-floppy --fs-uuid --set=root 38f7d6f3-e369-41aa-9620-fae78a223ea3
		echo	'Loading Linux 6.8.0-49-generic ...'
		linux	/boot/vmlinuz-6.8.0-49-generic root=UUID=38f7d6f3-e369-41aa-9620-fae78a223ea3 ro  
		echo	'Loading initial ramdisk ...'
		initrd	/boot/initrd.img-6.8.0-49-generic
	}
	menuentry 'Ubuntu, with Linux 6.8.0-49-generic (recovery mode)' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.8.0-49-generic-recovery-38f7d6f3-e369-41aa-9620-fae78a223ea3' {
		recordfail
		load_video
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_gpt
		insmod ext2
		search --no-floppy --fs-uuid --set=root 38f7d6f3-e369-41aa-9620-fae78a223ea3
		echo	'Loading Linux 6.8.0-49-generic ...'
		linux	/boot/vmlinuz-6.8.0-49-generic root=UUID=38f7d6f3-e369-41aa-9620-fae78a223ea3 ro recovery nomodeset dis_ucode_ldr 
		echo	'Loading initial ramdisk ...'
		initrd	/boot/initrd.img-6.8.0-49-generic
	}
	menuentry 'Ubuntu, with Linux 6.8.0-48-generic' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.8.0-48-generic-advanced-38f7d6f3-e369-41aa-9620-fae78a223ea3' {
		recordfail
		load_video
		gfxmode $linux_gfx_mode
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_gpt
		insmod ext2
		search --no-floppy --fs-uuid --set=root 38f7d6f3-e369-41aa-9620-fae78a223ea3
		echo	'Loading Linux 6.8.0-48-generic ...'
		linux	/boot/vmlinuz-6.8.0-48-generic root=UUID=38f7d6f3-e369-41aa-9620-fae78a223ea3 ro  
		echo	'Loading initial ramdisk ...'
		initrd	/boot/initrd.img-6.8.0-48-generic
	}
	menuentry 'Ubuntu, with Linux 6.8.0-48-generic (recovery mode)' --class ubuntu --class gnu-linux --class gnu --class os $menuentry_id_option 'gnulinux-6.8.0-48-generic-recovery-38f7d6f3-e369-41aa-9620-fae78a223ea3' {
		recordfail
		load_video
		insmod gzio
		if [ x$grub_platform = xxen ]; then insmod xzio; insmod lzopio; fi
		insmod part_gpt
		insmod ext2
		search --no-floppy --fs-uuid --set=root 38f7d6f3-e369-41aa-9620-fae78a223ea3
		echo	'Loading Linux 6.8.0-48-generic ...'
		linux	/boot/vmlinuz-6.8.0-48-generic root=UUID=38f7d6f3-e369-41aa-9620-fae78a223ea3 ro recovery nomodeset dis_ucode_ldr 
		echo	'Loading initial ramdisk ...'
		initrd	/boot/initrd.img-6.8.0-48-generic
	}
}

### END /etc/grub.d/10_linux ###

### BEGIN /etc/grub.d/10_linux_zfs ###
### END /etc/grub.d/10_linux_zfs ###

### BEGIN /etc/grub.d/20_linux_xen ###

### END /etc/grub.d/20_linux_xen ###

### BEGIN /etc/grub.d/20_memtest86+ ###
menuentry "Memory test (memtest86+x64.efi)" --class memtest $menuentry_id_option 'memtest86+' {
	insmod part_gpt
	insmod ext2
	search --no-floppy --fs-uuid --set=root 38f7d6f3-e369-41aa-9620-fae78a223ea3
        linux    /boot/memtest86+x64.efi
}
menuentry 'Memory test (memtest86+x64.efi, serial console)' --class memtest $menuentry_id_option 'memtest86+-serial' {
	insmod part_gpt
	insmod ext2
	search --no-floppy --fs-uuid --set=root 38f7d6f3-e369-41aa-9620-fae78a223ea3
        linux   /boot/memtest86+x64.efi console=ttyS0,115200
}
### END /etc/grub.d/20_memtest86+ ###

### BEGIN /etc/grub.d/25_bli ###
if [ "$grub_platform" = "efi" ]; then
  insmod bli
fi
### END /etc/grub.d/25_bli ###

### BEGIN /etc/grub.d/30_os-prober ###
menuentry 'Windows Boot Manager (on /dev/nvme0n1p1)' --class windows --class os $menuentry_id_option 'osprober-efi-2A77-3BBC' {
	insmod part_gpt
	insmod fat
	search --no-floppy --fs-uuid --set=root 2A77-3BBC
	chainloader /EFI/Microsoft/Boot/bootmgfw.efi
}
menuentry 'Debian GNU/Linux 12 (bookworm) (on /dev/nvme0n1p9)' --class debian --class gnu-linux --class gnu --class os $menuentry_id_option 'osprober-gnulinux-simple-2dbde335-c00d-4e8b-ac09-d4033957b8a8' {
	insmod part_gpt
	insmod ext2
	search --no-floppy --fs-uuid --set=root 2dbde335-c00d-4e8b-ac09-d4033957b8a8
	linux /boot/vmlinuz-6.1.0-28-amd64 root=UUID=2dbde335-c00d-4e8b-ac09-d4033957b8a8 ro quiet
	initrd /boot/initrd.img-6.1.0-28-amd64
}
submenu 'Advanced options for Debian GNU/Linux 12 (bookworm) (on /dev/nvme0n1p9)' $menuentry_id_option 'osprober-gnulinux-advanced-2dbde335-c00d-4e8b-ac09-d4033957b8a8' {
	menuentry 'Debian GNU/Linux (on /dev/nvme0n1p9)' --class gnu-linux --class gnu --class os $menuentry_id_option 'osprober-gnulinux-/boot/vmlinuz-6.1.0-28-amd64--2dbde335-c00d-4e8b-ac09-d4033957b8a8' {
		insmod part_gpt
		insmod ext2
		search --no-floppy --fs-uuid --set=root 2dbde335-c00d-4e8b-ac09-d4033957b8a8
		linux /boot/vmlinuz-6.1.0-28-amd64 root=UUID=2dbde335-c00d-4e8b-ac09-d4033957b8a8 ro quiet
		initrd /boot/initrd.img-6.1.0-28-amd64
	}
	menuentry 'Debian GNU/Linux, with Linux 6.1.0-28-amd64 (on /dev/nvme0n1p9)' --class gnu-linux --class gnu --class os $menuentry_id_option 'osprober-gnulinux-/boot/vmlinuz-6.1.0-28-amd64--2dbde335-c00d-4e8b-ac09-d4033957b8a8' {
		insmod part_gpt
		insmod ext2
		search --no-floppy --fs-uuid --set=root 2dbde335-c00d-4e8b-ac09-d4033957b8a8
		linux /boot/vmlinuz-6.1.0-28-amd64 root=UUID=2dbde335-c00d-4e8b-ac09-d4033957b8a8 ro quiet
		initrd /boot/initrd.img-6.1.0-28-amd64
	}
	menuentry 'Debian GNU/Linux, with Linux 6.1.0-28-amd64 (recovery mode) (on /dev/nvme0n1p9)' --class gnu-linux --class gnu --class os $menuentry_id_option 'osprober-gnulinux-/boot/vmlinuz-6.1.0-28-amd64-root=UUID=2dbde335-c00d-4e8b-ac09-d4033957b8a8 ro single-2dbde335-c00d-4e8b-ac09-d4033957b8a8' {
		insmod part_gpt
		insmod ext2
		search --no-floppy --fs-uuid --set=root 2dbde335-c00d-4e8b-ac09-d4033957b8a8
		linux /boot/vmlinuz-6.1.0-28-amd64 root=UUID=2dbde335-c00d-4e8b-ac09-d4033957b8a8 ro single
		initrd /boot/initrd.img-6.1.0-28-amd64
	}
	menuentry 'Debian GNU/Linux, with Linux 6.1.0-27-amd64 (on /dev/nvme0n1p9)' --class gnu-linux --class gnu --class os $menuentry_id_option 'osprober-gnulinux-/boot/vmlinuz-6.1.0-27-amd64--2dbde335-c00d-4e8b-ac09-d4033957b8a8' {
		insmod part_gpt
		insmod ext2
		search --no-floppy --fs-uuid --set=root 2dbde335-c00d-4e8b-ac09-d4033957b8a8
		linux /boot/vmlinuz-6.1.0-27-amd64 root=UUID=2dbde335-c00d-4e8b-ac09-d4033957b8a8 ro quiet
		initrd /boot/initrd.img-6.1.0-27-amd64
	}
	menuentry 'Debian GNU/Linux, with Linux 6.1.0-27-amd64 (recovery mode) (on /dev/nvme0n1p9)' --class gnu-linux --class gnu --class os $menuentry_id_option 'osprober-gnulinux-/boot/vmlinuz-6.1.0-27-amd64-root=UUID=2dbde335-c00d-4e8b-ac09-d4033957b8a8 ro single-2dbde335-c00d-4e8b-ac09-d4033957b8a8' {
		insmod part_gpt
		insmod ext2
		search --no-floppy --fs-uuid --set=root 2dbde335-c00d-4e8b-ac09-d4033957b8a8
		linux /boot/vmlinuz-6.1.0-27-amd64 root=UUID=2dbde335-c00d-4e8b-ac09-d4033957b8a8 ro single
		initrd /boot/initrd.img-6.1.0-27-amd64
	}
}

set timeout_style=menu
if [ "${timeout}" = 0 ]; then
  set timeout=10
fi
### END /etc/grub.d/30_os-prober ###

### BEGIN /etc/grub.d/30_uefi-firmware ###
if [ "$grub_platform" = "efi" ]; then
	fwsetup --is-supported
	if [ "$?" = 0 ]; then
		menuentry 'UEFI Firmware Settings' $menuentry_id_option 'uefi-firmware' {
			fwsetup
		}
	fi
fi
### END /etc/grub.d/30_uefi-firmware ###

### BEGIN /etc/grub.d/35_fwupd ###
### END /etc/grub.d/35_fwupd ###

### BEGIN /etc/grub.d/40_custom ###
# This file provides an easy way to add custom menu entries.  Simply type the
# menu entries you want to add after this comment.  Be careful not to change
# the 'exec tail' line above.
### END /etc/grub.d/40_custom ###

### BEGIN /etc/grub.d/41_custom ###
if [ -f  ${config_directory}/custom.cfg ]; then
  source ${config_directory}/custom.cfg
elif [ -z "${config_directory}" -a -f  $prefix/custom.cfg ]; then
  source $prefix/custom.cfg
fi
### END /etc/grub.d/41_custom ###

[klatls]

I found here Debian certificate
and here the command to import the certificate then
reboot and bioss will ask to enroll the new key
After that reboot and now debian boots from ubuntu grub menu

[Aki]

Hello,

I'm happy you sorted it out.

The Debian certificate debian-uefi-ca.der is included in the shim-unsigned Debian package:

Code: Select all

$ apt-file search debian-uefi-ca.der
shim-unsigned: /usr/share/shim/debian-uefi-ca.der

Are the packages named "grub-efi-amd64-signed", "shim-unsigned" and "shim-signed" installed in your Debian ?

[klatls]

Are the packages named "grub-efi-amd64-signed", "shim-unsigned" and "shim-signed" installed in your Debian ?

Hello Aki
yes are installed
but ubuntu does not yet boot from debian grub menu
Have to find ubuntu certificate to save in bios