This was a known issue and has been addressed on the
#ubuntu-release IRC channel.
Source: #ubuntu-release IRC logs for 2018-10-11 [Archive Link]
Shortly after this answer was originally posted, the Ubuntu package archive (
http://archive.ubuntu.com/ubuntu/) was updated to fix the problem.
Note: Mirrors take a variable amount of time to synchronize with the main archive, so if you are using a mirror, you may have to wait longer or change your mirror to
Run the following command to update your package list:
sudo apt update
If your mirror is up-to-date, you should now be able upgrade all your packages, including
Relevant IRC conversation:
[13:14] cyphermox: hi, whomever promoted shim-signed to bionic-updates, please also promote shim
[13:14] cyphermox: (the two must go together)
[13:29] sil2100: cyphermox: apologies for that, it didn't have a bug so my brain missed it
[13:29] sil2100: Even though it's completely logical
[13:29] TJ- sil2100: thanks - that'll keep a user happy. Was seeing "shim-signed" in "apt list --upgradeable" but the package wasn't offered for upgrade by apt
To prevent this same issue from happening again, ~smoser has submitted the pair of packages,
shim-signed, to a list that is used to verify packages that need to be released together:
[13:30] rbasak: smoser had a branch to prevent such accidents. I
don't see what happened to it.
[13:30] rbasak: Merged
[13:30] cyphermox: I was
about to ask about that, should be easy to write a warning to avoid
[13:30] rbasak: Is your ubuntu-archive-tools up to
[13:31] rbasak: Ah
shim and shim-signed need adding to the list.
[13:31] sil2100: seb128: hey! I'm going to request a full translation export and then a new base upload - I
saw that you mentioned issues with the gnome translations, are you
good now in case we do an export soon?
rbasak: I thought mine was
[13:32] cyphermox: sil2100:
fwiw, not entirely your fault, shim didn't have any bugs linked to it
either -- and I'm going to avoid that from now on by requiring a bug
prior to any upload of shim to devel
(since we copy shim across releases, etc.)
sil2100, hey, I guess so, dunno who changed those settings but it
screwed thing. I think I'm going to fix as much as I plan to do before
cosmic, it's tedious work and we are not going to reupload all GNOME
now (and import seem fine in most case, it seems the setting didn't
change so long ago)
[13:40] smoser: yeah, the goal of that
branch was that it if you tried to release grub2 without grub2-signed
it would exit failure
[13:40] smoser: if you had > revision
1180, i'd like to figure out what you did do that didn't trip it. [13:42] sil2100: smoser: it was about shim and shim-signed,
apparently that's not added to the list
[13:42] smoser: ah. well lets add them.
smoser: if they do in fact have to be released together.
[13:47] cyphermox: smoser: thanks
For reference, this is what the two affected package listings looked like after the fix:
Maintainer: Ubuntu Developers <firstname.lastname@example.org>
Original-Maintainer: Steve Langasek <email@example.com>
Breaks: shim-signed (<< 1.33~)
Description: boot loader to chain-load signed boot loaders under Secure Boot
Built-Using: shim (= 15+1533136590.3beb971-0ubuntu1)
Source: shim-signed (1.37~18.04.2)
Maintainer: Steve Langasek <firstname.lastname@example.org>
Depends: debconf (>= 0.5) | debconf-2.0, shim (= 15+1533136590.3beb971-0ubuntu1), grub-efi-amd64-signed, grub2-common (>= 2.02-2ubuntu8.1), mokutil, sbsigntool
Breaks: grub-efi-amd64-signed (<< 1.93.7)
Description: Secure Boot chain-loading bootloader (Microsoft-signed binary)
Notice that the
Depends: section of
shim (= 15+1533136590.3beb971-0ubuntu1), which now has a matching
Package: shim version.