# Latest grub bricked my system (grub\_is\_shim\_lock\_enabled not found) **URL:** \ **Category:** Newbie\ **Created:** [July 5, 2023, 8:34am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879 "2023-07-05T08:34:33Z")\ **Posts on this page:** 20\ **Page:** 6
**Author:** ![Gamall](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/gamall/32/39459_2.png) [@Gamall](https://forum.endeavouros.com/u/Gamall)\ **Post date:** [July 8, 2023, 5:22am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/101 "2023-07-08T05:22:57Z")
Like others, I could not get r591 to work at all on my laptop, even after chroot from live and `sudo grub-install --efi-directory=/boot/efi`. In the end I downgraded to r566 from chroot. I’m thankful that, having seen grub in the upgrade list, I had the presence of mind to test on my (expendable) laptop rather than my main desktop system. Grub r566 is going to the IgnorePkg corner indefinitely on all systems. [edit2: not a good idea long term, see long discussion below] Next install will stick with systemd-boot. Some moderate amount of breakage is expected and tolerable when upgrading, yes. Casually bricking the system (unless you have a liveUSB on hand, and until you have the time to perform a chroot or several) does not qualify as _moderate_ in my book. Twice in 6 months is way too much for something that critical. > [@Kresimir](#): > > What are you trying to accomplish with that? I assume he, like me, is trying to get on with his life and not to have to worry about grub randomly breaking on update anymore. > [@vmakela](#): > > But I have to update grub someday, don’t I? ~~Not really, unless you need something specific in the new versions. Nothing depends on the grub package.~~ [edit: not a good idea long term, see below] ---
**Author:** ![Kresimir](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/kresimir/32/73739_2.png) [@Kresimir](https://forum.endeavouros.com/u/Kresimir)\ **Post date:** [July 8, 2023, 5:53am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/102 "2023-07-08T05:53:01Z")
> [@Gamall](#): > > I assume he, like me, is trying to get on with his life and not to have to worry about grub randomly breaking on update anymore. The update does not touch your `/boot/efi` directory, so GRUB cannot randomly break on update. It can break if you regenerate the config file with the wrong version of GRUB. > [@Gamall](#): > > > [@vmakela](#): > > > > But I have to update grub someday, don’t I? > > Not really, unless you need something specific in the new versions. Nothing depends on the grub package. Consider, what happens when you update, for example, `glibc`, but you ignore an update to `grub` package? What would happen if you tried to install a new kernel? You’re only making it more difficult for yourself down the line. ---
**Author:** ![Gamall](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/gamall/32/39459_2.png) [@Gamall](https://forum.endeavouros.com/u/Gamall)\ **Post date:** [July 8, 2023, 7:08am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/103 "2023-07-08T07:08:12Z")
> [@Kresimir](#): > > GRUB cannot randomly break on update It did last time. That it can break after an update is the entire point of the previous, long discussion: [Full transparency on the GRUB issue - Updated 2022-08-29](https://forum.endeavouros.com/t/full-transparency-on-the-grub-issue-updated-2022-08-29/30784) Personally, I upgraded as usual, did not run grub-install or -mkconfig, (I never did) and… brick. Fortunately on my disposable laptop, again. And another time in a VM. > [@Kresimir](#): > > Consider, what happens when you update, for example, `glibc`, but you ignore an update to `grub` package? What would happen if you tried to install a new kernel? > > You’re only making it more difficult for yourself down the line. Right. If glibc updates I expect it’ll break then. Fantastic. ---
**Author:** ![Gamall](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/gamall/32/39459_2.png) [@Gamall](https://forum.endeavouros.com/u/Gamall)\ **Post date:** [July 8, 2023, 7:24am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/104 "2023-07-08T07:24:33Z")
Alternative to IgnorePkg: Do not run grub-install or -mkconfig. Worked on both my laptop and my main machine. Will hold until the next time they do something like r322, where you _had to_, which is why I had a hook set up to do so after every grub update. Hopefully it will take longer for grub to break again in that special way than there is time between glibc upgrades. ---
**Author:** ![Kresimir](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/kresimir/32/73739_2.png) [@Kresimir](https://forum.endeavouros.com/u/Kresimir)\ **Post date:** [July 8, 2023, 7:25am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/105 "2023-07-08T07:25:12Z")
> [@Gamall](#): > > Personally, I upgraded as usual, did not run grub-install or -mkconfig, I think you did, you just don’t know it. You probably have an automated hook set up to run `grub-mkconfig` as default on some earlier ISOs of EndeavourOS. That was a mistake on the part of EndeavourOS, not GRUB’s fault. This lesson was learnt last August. > [@Gamall](#): > > Right. If glibc updates I expect it’ll break then. Fantastic. No, it won’t break, it will be much worse than that. It will work fine. Then, one day, you will run `grub-mkconfig` and it may break, but if you run `grub-install` to fix it, that won’t work, because you’ll have a wrong version of `glibc`. That’s why partial updates are not supported on Arch. ---
**Author:** ![Gamall](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/gamall/32/39459_2.png) [@Gamall](https://forum.endeavouros.com/u/Gamall)\ **Post date:** [July 8, 2023, 7:35am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/106 "2023-07-08T07:35:16Z")
> [@Kresimir](#): > > I think you did, you just don’t know it. You probably have an automated hook set up to run `grub-mkconfig`. That was mistake on the part of EndeavourOS, not GRUB’s fault. I have now, (or had until 10 minutes ago 😉 ) because I set it up _ **after** _ r322. And I have the git logs to prove it. And since then I read the output of the hooks carefully on each update; there was only one instance on that output, each time. If there had been a preexisting hook I’d have seen it run twice, each time. And the systems I updated without running them were bricked until I did run the commands explicitly in chroot. If the problem was that they were run automatically, then running them again would not have fixed the bricked systems… If you read the previous thread, you will see adding a hook mentioned as solution for future instances of the problem; there were other threads and posts to that effect on the boards at that time. I would really like for you to be right, for grub updates to be safe by default. But I don’t see any way that can be the case here. ---
**Author:** ![Kresimir](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/kresimir/32/73739_2.png) [@Kresimir](https://forum.endeavouros.com/u/Kresimir)\ **Post date:** [July 8, 2023, 7:38am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/107 "2023-07-08T07:38:25Z")
Again, you have three valid options with GRUB: 1. Not update `grub` package. A bad idea in the long run. 2. Don’t run `grub-mkconfig` and `grub-install` when you don’t need to. 3. Run `grub-mkconfig` and `grub-install` every time the `grub` package updates, but be careful to do it correctly and manually (do not try to use hooks to automate stuff that shouldn’t be automated). If you mess up, you’ll have to `chroot`, so be ready for it, keep an USB on hand and do it only when you have 5 or so minutes to spare. Or use `systemd`-boot. Of course, there is no guarantee that that won’t ever break. Personally, I find GRUB to be very reliable. I only got screwed once, and that was not GRUB’s fault, but because of the EndeavourOS hook. It took only 5 minutes to fix it. Unfortunately, this was on my mum’s computer. I updated it when I visited her earlier that day, shut it down, and went home, and then later that night realised that her GRUB is borked. I was travelling next day to Norway, and I would be gone for two weeks, my mum unable to use her computer. So, I had to go back to her flat to fix it, and it was already 11 in the evening, and I had to catch the plane at 7 o’clock next morning. When I got back home, it was already very late, close to 2 I think, and I didn’t even begin to pack. But that’s just bad luck. 🤣 On my vanilla Arch machine, I’ve never had any issues with GRUB. ---
**Author:** ![Gamall](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/gamall/32/39459_2.png) [@Gamall](https://forum.endeavouros.com/u/Gamall)\ **Post date:** [July 8, 2023, 8:01am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/108 "2023-07-08T08:01:49Z")
> [@Kresimir](#): > > I only got screwed once, and that was not GRUB’s fault, but because of the EndeavourOS hook. Which hook is that ? I don’t see anything with any screwing potential in the relevant package: ```auto yay -Ql eos-hooks /etc/pacman.d/Σ 9:46 vhugot@Sekhmet eos-hooks /usr/ eos-hooks /usr/bin/ eos-hooks /usr/bin/eos-hooks-runner eos-hooks /usr/bin/eos-repo-before-arch-repos eos-hooks /usr/share/ eos-hooks /usr/share/libalpm/ eos-hooks /usr/share/libalpm/hooks/ eos-hooks /usr/share/libalpm/hooks/eos-hooks.hook eos-hooks /usr/share/libalpm/hooks/eos-lsb-release.hook eos-hooks /usr/share/libalpm/hooks/eos-os-release.hook eos-hooks /usr/share/libalpm/hooks/eos-repo-before-arch-repos.hook ``` > [@Kresimir](#): > > Unfortunately, this was on my mum’s computer. I updated it when I visited her earlier that day, shut it down, and went home I _always_ reboot immediately after updating, no matter how trivial the update, precisely to avoid such nightmare scenarios 😅 > [@Kresimir](#): > > It took only 5 minutes to fix it. … not counting the hours it took you to go back to and from location, obviously. 🐸 ---
**Author:** ![chromiell](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/chromiell/32/70802_2.png) [@chromiell](https://forum.endeavouros.com/u/chromiell)\ **Post date:** [July 8, 2023, 9:13am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/109 "2023-07-08T09:13:45Z")
> Not update grub package. A bad idea in the long run. The problem is that I’d love to upgrade to r591, but everything I’ve tried so far hasn’t worked, while r566 works flawlessly. I probably can refrain from running `grub-install` and end up with a working system for the time being, but the same logic applies, the first time I need to run it to fix some issue with `grub-mkconfig` will brick the system. It seems like a bug to me on GRUB side, there’s too many reports from people to be a config problem on our end, even [this](https://bbs.archlinux.org/viewtopic.php?id=287024) thread on Arch Forum. I personally think that I’ll skip a couple revisions and will try to update GRUB in a couple of months to see if anything changed, but it looks more and more like a bug in r591. I’ll keep looking into it, but GRUB error messages are about as useful as an ashtray on a motorbike. ---
**Author:** ![pebcak](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/pebcak/32/100472_2.png) [@pebcak](https://forum.endeavouros.com/u/pebcak)\ **Post date:** [July 8, 2023, 9:16am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/110 "2023-07-08T09:16:46Z")
> [@Gamall](#): > > Which hook is that ? Look inside `/etc/pacman.d/hooks` and see if you got something in there. ---
**Author:** ![Kresimir](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/kresimir/32/73739_2.png) [@Kresimir](https://forum.endeavouros.com/u/Kresimir)\ **Post date:** [July 8, 2023, 9:29am UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/111 "2023-07-08T09:29:07Z")
> [@Gamall](#): > > Which hook is that ? It was a hook that ran `grub-mkconfig` every time a kernel was updated. I’ve deleted it since from all the computers I look after. It’s no longer part of the EndeavourOS install, but if you’re on an older install you might still have it. This was the hook that caused the legendary Grubbening of August 2022. 🤣 * * * EDIT: Found it! > ---
**Author:** ![Gamall](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/gamall/32/39459_2.png) [@Gamall](https://forum.endeavouros.com/u/Gamall)\ **Post date:** [July 8, 2023, 2:37pm UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/112 "2023-07-08T14:37:18Z")
> [@Kresimir](#): > > This was the hook that caused the legendary Grubbening of August 2022. 🤣 That was the one I was referring to; I linked the wrong stuff previously, I wanted the original breakage thread for r322 in august 2022: > [@Full transparency on the GRUB issue - Updated 2022-08-29](https://forum.endeavouros.com/t/full-transparency-on-the-grub-issue-updated-2022-08-29/30784): > > [EOS-2-4K] Since the recent grub issue has impacted a lot of people, we wanted to provide full transparency based on the information we have so far. The situation with this package is still evolving and we will update this post with more information as it becomes available. The issue After updating to grub 2.06.r322 many users reported that their machines could fail to boot or booted directly into the BIOS or another OS. What caused the issue Starting with [this commit](https://git.savannah.gnu.org/cgit/grub.git/commit/?id=26031d3b101648352e4e427f04bf69d320088e77), grub introduced a ca… > [@Kresimir](#): > > hook that ran `grub-mkconfig` **I think I finally understood something:** 1° you’re talking about a hook that runs only mkconfig, while my own ran both grub-install and mkconfig. 2° The existence and role of that hook in the Great Grubbening of 22 was not mentioned as a cause of the problem in the thread, and so I developed a warped understanding of how grub works: I thought part of the grub package files passively played a role in the later phase of the boot, somehow: > [@Full transparency on the GRUB issue - Updated 2022-08-29](https://forum.endeavouros.com/t/full-transparency-on-the-grub-issue-updated-2022-08-29/30784/130): > > When you update grub and/or call `grub-mkconfig` that updates only the userspace components. So what was implied was “When you call `grub-mkconfig`, _whether manually or because the hook we set up on kernel update does that for you_, that updates only the userspace components.” Pinging @dalto for sanity check. * * * One last thing I want to check: are we agreed that there is no reason to run grub-mkconfig on kernel _updates_, only on install/removal of entirely new kernels (eg zen or something like that)? (Or of course upon modification of /etc/default/grub, or after a grub-install) If that is the case, since I’ve all the kernels I need (vanilla, lts, zen) already, and I’m happy with my grub config and unlikely to tinker with it anymore, now that I’ve removed my -install + -mkconfig hook, I can basically ignore updates to the grub package entirely (until I want to tinker again, of course). ---
**Author:** ![Kresimir](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/kresimir/32/73739_2.png) [@Kresimir](https://forum.endeavouros.com/u/Kresimir)\ **Post date:** [July 8, 2023, 2:38pm UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/113 "2023-07-08T14:38:35Z")
> [@Gamall](#): > > If that is the case, since I’ve all the kernels I need (vanilla, lts, zen) already, and I’m happy with my grub config and unlikely to tinker with it anymore, now that I’ve removed my -install + -mkconfig hook, I can basically ignore updates to the grub package entirely (until I want to tinker again, of course). Yes. Well, you shouldn’t ignore updating the `grub` package, as in keeping it on your IgnorePkg list. Just update it normally. That’s pretty much how I do it, I almost always forget to run `grub-mkconfig` and `grub-install` when the `grub` package is updated. I mostly worry about that when I change my config or install or remove a kernel. The only downside is that you’re not getting any security updates or bug fixes to GRUB. ---
**Author:** ![Gamall](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/gamall/32/39459_2.png) [@Gamall](https://forum.endeavouros.com/u/Gamall)\ **Post date:** [July 8, 2023, 2:52pm UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/114 "2023-07-08T14:52:54Z")
> [@Kresimir](#): > > Well, you shouldn’t ignore updating the `grub` package, as in keeping it on your IgnorePkg list. Just update it normally. Oh yes of course, that’s what I meant. Thank you for this lengthy exchange, it did serve to clear up a major misconception I had about how grub works — this will considerably reduce my stress levels when dealing with it henceforth. Cheers 🐸 ---
**Author:** ![vmakela](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/v/49beb7/32.png) [@vmakela](https://forum.endeavouros.com/u/vmakela)\ **Post date:** [July 8, 2023, 6:46pm UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/115 "2023-07-08T18:46:30Z")
Thank you for this post. I consider myself a n00b what comes to Arch. 😅 I was on impression that I have to run `grub-mkconfig` and `grub-install` after every new grub install. Now I updated to new grub, rebooted and everything works fine. ---
**Author:** ![Kresimir](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/kresimir/32/73739_2.png) [@Kresimir](https://forum.endeavouros.com/u/Kresimir)\ **Post date:** [July 8, 2023, 6:49pm UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/116 "2023-07-08T18:49:27Z")
It’s a bit confusing. Updating the `grub` package does not update your installed bootloader on the EFI partition, it just updates the package. To actually install the new version of GRUB (to your EFI partition), you run `grub-install` after updating the package. If you do not run the install command, you will continue to use the version of GRUB you have installed in your EFI partition, regardless of the version of the package `grub` you have installed. ---
**Author:** ![gipo355](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/gipo355/32/78340_2.png) [@gipo355](https://forum.endeavouros.com/u/gipo355)\ **Post date:** [July 8, 2023, 7:20pm UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/117 "2023-07-08T19:20:00Z")
If you have snapshots, you need mkconfig to update the snapshots in the menu. Grub-btrfs has a hook to update grub on every snapshot taken. This post was written after I updated grub and turned off my PC without installing and mkconfigging it and realized the above so that when I next turn it on, I will have to downgrade again. Sad ---
**Author:** ![ricklinux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/ricklinux/32/110798_2.png) [@ricklinux](https://forum.endeavouros.com/u/ricklinux)\ **Post date:** [July 8, 2023, 7:40pm UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/118 "2023-07-08T19:40:06Z")
Is there any way to know if the grub package version you have installed is the one that was run to install the bootloader? ---
**Author:** ![Kresimir](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/kresimir/32/73739_2.png) [@Kresimir](https://forum.endeavouros.com/u/Kresimir)\ **Post date:** [July 8, 2023, 7:47pm UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/119 "2023-07-08T19:47:12Z")
I think it’s like this ```auto grub-probe --version ``` and ```auto grub-install --version ``` The first one, if I’m not mistaken, gives you the installed version, the second one gives you the package version. I could be wrong, because right now on my computer, both give the same number. But I did run `grub-install` yesterday, to see whether it would boot, so it would make sense they are the same. Do not run with `sudo` 😉 ---
**Author:** ![ricklinux](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/ricklinux/32/110798_2.png) [@ricklinux](https://forum.endeavouros.com/u/ricklinux)\ **Post date:** [July 8, 2023, 7:49pm UTC](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879/120 "2023-07-08T19:49:41Z")
Okay then i tried it. It would be interesting to try it on a system that has the new package installed but the grub update command not yet run? ```auto [ricklinux@eos-plasma ~]$ grub-probe --version grub-probe (GRUB) 2:2.06.r591.g6425c12cd-1 [ricklinux@eos-plasma ~]$ grub-install --version grub-install (GRUB) 2:2.06.r591.g6425c12cd-1 [ricklinux@eos-plasma ~]$ ``` [Previous page](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879.md?page=5) [Next page](https://forum.endeavouros.com/t/latest-grub-bricked-my-system-grub-is-shim-lock-enabled-not-found/42879.md?page=7)