ASUS Z170-A, shim 15+1533136590.3beb971-0ubuntu1: grub menu not showing with both SecureBoot and CSM enabled after update

Please run apport-collect 1799767 on the affected system, so we can gather the information that is relevant to the shim package, rather than for ubuntu-release-upgrader.

apport information

apport information

apologies, it looks like we may only have the hook for the shim-signed source package. Could you please run apport-collect 1799767 once more?

Output of apport-collect now is
...
Package shim-signed not installed and no hook available, ignoring
Gtk-Message: 21:00:40.534: GtkDialog mapped without a transient parent. This is discouraged
...

And yes, it's true, at the moment it is not installed and the behaviour is as I described first.
But I'm sure, that the behaviour was the same when shim-signed had been installed some days ago. If you want, I can install it, try reeboot with CSM enabled and with CSM disabled and tell, what I have found out then.

apport information

apport information

apport information

apport information

Ok. Crucially, this shows that you have the 1.37~18.04.2+15+1533136590.3beb971-0ubuntu1 version of shim-signed installed, which was released on October 11 to bionic-updates; superseding version 1.34.9.2 which was there previously.

Why was the shim-signed package not installed? This is the package that \EFI\UBUNTU\SHIMX64.EFI is installed from, so for it to be absent suggests something was wrong with your upgrade process. Are you sure that the \EFI\UBUNTU\SHIMX64.EFI which was installed on your EFI System Partition at the time you encountered this problem was the one from shim-signed 1.37~18.04.2+15+1533136590.3beb971-0ubuntu1 ? (E.g.: if you disable CSM again now, does the problem reappear?)

Since your dist-upgrade logs also show that you had shim-signed 1.34.9.2 installed since September 23 and the problem only occurred for you after the upgrade on October 11, I'm provisionally marking this as a regression-update due to the apparent connection to shim-signed 1.37~18.04.2+1533136590.3beb971-0ubuntu1.

Dear Steve,

thanks for your reply. When you wanted me to apport-collect 1799767 once more, shim-signed wasn't installed because I had mad some experiments to solve the problem by myself. So I installed it again to do apport-collect 1799767 once more, but the effect is still the same.

And to clearify that: When I enable CSM in BIOS there is no secure boot but when I disable it, I have secure boot. And as a news: I tried the day before yesterday to set CSM to "auto" and SecureBoot is working with that configuration as well. Only setting to "CSM=enabled" the system doesn't boot in secure mode.

You asked if I am sure, that it was "shim-signed 1.37~18", but I can not tell, because normally I do not look at the details, when an update will be installed. I just install it when Update-manager means i should. I trust Ubuntu in that point.

I normally install the updates close to the time when they are published. Maybe some days later.

Could you please test the following:

- boot with CSM disabled
- run sudo mokutil --set-verbosity true
- reboot to the firmware and enable CSM
- boot Ubuntu
- report here any messages that appear on the console at boot time (take a picture and upload, or transcribe, etc)

After this, you can run 'sudo mokutil --set-verbosity false' to restore the previous behavior.

Advice from @cyphermox is to actually record the screen rather than taking a picture, in case the messages appear/disappear quickly.

Oh my god, that is really a strange behavin. As you said, I entered that mokutil command and rebooted the system, entered BIOS. I enabled CSM, saved the config and rebooted. In the attachment you see the message from shim after BIOS splash screen. But what happened then?
Suddenly I saw the grub menu and after 10 secs ubuntu starts automagically in secure boot mode. I didn't believe that. Thought I had made a mistake. So I switched off verbosity and rebooted. But, and that's surprising, I did not saw any grub menu, just the black screen as before.
So I had to boot into BIOS, set CSM to "auto" and reboot. And I did it again, just to verify this. I switched verbosity on, rebooted, enabled CSM, rebooted again and I have seen the grub menu. Ubuntu starts automagically in secure boot mode.

Conclusion:
CSM enabled and mokutil verbosity true-> grub menu and SecureBoot
CSM enabled and mokutil verbosity false-> Black screen

Further info: Yesterday I run an update that has been listed in update manager. Here you see the apt history:
Start-Date: 2018-11-02 21:20:21
Commandline: aptdaemon role='role-commit-packages' sender=':1.73'
Upgrade: libparted2:amd64 (3.2-20, 3.2-20ubuntu0.1), libparted-fs-resize0:amd64 (3.2-20, 3.2-20ubuntu0.1), parted:amd64 (3.2-20, 3.2-20ubuntu0.1), mokutil:amd64 (0.3.0-0ubuntu5, 0.3.0+1538710437.fb6250f-0ubuntu2~18.04.1), secureboot-db:amd64 (1.1, 1.4~ubuntu0.18.04.1)
End-Date: 2018-11-02 21:20:29

So what about updates at the moment. Is it ok for you if I still run these updates or should I wait with this. You know, I always want to install security patches.