Bug 973751

User-Agent:       Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Build Identifier: 

I had Mint installed on a machine, which also has W10, and it was all
working fine. I installed Leap and that is working fine. When I reboot I
get taken to openSUSE's boot menu, which is fine, and it reboots either
Leap or W10 fine, but if I select the line for Mint it says

  error: vmlinuz.... has invalid signature.
  error: you need to load the kernel first.

The machine has UEFI and is in secure mode and Mint was booting just
fine using its own (well, Ubuntu's) grub

There's a mailing list thread about the problem that starts at
https://lists.opensuse.org/opensuse/2016-03/msg01526.html

Part way through that thread, Andrei Borzenkov identified it as a bug and asked me to open this bug report (sorry can't find the message in the archive thread). He said:

The error message you get when you try to chainload Ubuntu shim from
openSUSE shim comes from shim itself. As far as I can tell looking at
code, it is a bug in shim which is hit when you are doing something like
this

shim(1) -> bootloader(1) -> shim(2) -> bootloader(2) -> kernel

The problem is that shim(1) hooks into EFI services but it has no
information about bootloader(2), so when bootloder(2) attempts to launch
kernel, shim(1) thinks kernel was not verified and blocks this attempt.

Now code that does it (at least, code that contains error message you
see) appeared in shim 0.9. At least my copy of Ubuntu 14.04 has shim
0.8. Could you verify what shim version you have?

He later confirmed that 

bor@bor-Latitude-E5450:~/src/shim$ dpkg-query -W shim
shim    0.8-0ubuntu2


Reproducible: Always

Steps to Reproduce:
1. Install mint 17.3
2. Install leap 42.1
3. try to boot mint via the entry in leap's grub menu
note that secure boot must be enabled
Actual Results:  
boot fails with message in details

Expected Results:  
boot mint, possibly warning me that it was insecure

the only workaround I had was to boot into opensuse, then use efibootmgr to select mint and reboot into mint.

I now have a workaround which involves using the mint grub screen as primary and chainloading to the opensuse grub screen.

The Acer firmware does not support editing its displayed boot menu