Bug 59632

Summary:	grub-efi-install: installing Secure Boot binaries to ESP mv: cannot overwrite '/boot/efi/EFI/BOOT/BOOTX64.EFI': Файл существует
Product:	Branch p11	Reporter:	Vyacheslav Bocharov <vebocharov>
Component:	grub-efi	Assignee:	Egor Ignatov <egori>
Status:	ASSIGNED ---	QA Contact:	qa-p11 <qa-p11>
Severity:	normal
Priority:	P5	CC:	egori, glinkinvd, vebocharov
Version:	unspecified
Hardware:	x86_64
OS:	Linux

Description Vyacheslav Bocharov 2026-06-24 00:11:45 MSK

После выполнения sudo apt-get dist-upgrade получил:

Found ESP at /boot/efi
Probing ALT Linux EFI binaries on ESP
  /boot/efi/EFI/altlinux/shimx64.efi: ALT shim
  /boot/efi/EFI/altlinux/grubx64.efi: ALT grub
  /boot/efi/EFI/BOOT/grubx64.efi: ALT grub
Detected: Secure Boot (non-removable)
Updating grub in /boot/efi
grub-efi-install: mode=SECURE_BOOT, bootloader_id=altlinux, efi_directory=/boot/efi
grub-efi-install: running grub-install --target=x86_64-efi --boot-directory=/boot --boot-directory-only 
Выполняется установка для платформы x86_64-efi.
grub-efi-install: installing Secure Boot binaries to ESP
mv: cannot overwrite '/boot/efi/EFI/BOOT/BOOTX64.EFI': Файл существует

========================================================
WARNING: grub-efi-autoupdate failed!
The EFI bootloader was NOT updated. Next boot may fail.

What to do:
  1. Run 'grub-efi-autoupdate' manually to see the full error
  2. If it fails again, try 'grub-efi-install && grub-efi-autoupdate'
  3. If your system lacks NVRAM, try 'grub-efi-install --removable'
  4. Make sure you have recovery bootable media available
========================================================
Генерируется файл настройки grub …
[...]
завершено
EFI boot, skipping grub-pc autoupdate (no problem)
egrep: warning: egrep is obsolescent; using grep -E
Завершено.
rebuilding database /var/lib/rpm started
rebuilding database /var/lib/rpm finished

$ sudo ls -la /boot/efi/EFI/BOOT/ 
итого 4562
drwxrwxrwx 2 root root    1024 июн 23 23:38 .
drwxrwxrwx 6 root root    1024 сен 26  2023 ..
-rw-rw-rw- 1 root root  951408 янв  2 10:01 bootx64.efi
-rw-rw-rw- 1 root root  951408 июн 23 23:38 BOOTX64.EFI.new
-rw-rw-rw- 1 root root   90768 янв  2 10:01 fbx64.efi
-rw-rw-rw- 1 root root     143 янв  2 10:01 grub.cfg
-rw-rw-rw- 1 root root 1820904 янв  2 10:01 grubx64.efi
-rw-rw-rw- 1 root root  850008 янв  2 10:01 mmx64.efi

$ sudo cmp /boot/efi/EFI/BOOT/bootx64.efi /boot/efi/EFI/BOOT/BOOTX64.EFI.new
$ sudo rm /boot/efi/EFI/BOOT/bootx64.efi
$ sudo mv /boot/efi/EFI/BOOT/BOOTX64.EFI.new /boot/efi/EFI/BOOT/BOOTX64.EFI
$ sudo grub-efi-autoupdate
Found ESP at /boot/efi
Probing ALT Linux EFI binaries on ESP
  /boot/efi/EFI/altlinux/shimx64.efi: ALT shim
  /boot/efi/EFI/altlinux/grubx64.efi: ALT grub
  /boot/efi/EFI/BOOT/BOOTX64.EFI: ALT shim
  /boot/efi/EFI/BOOT/grubx64.efi: ALT grub
Detected: Secure Boot (non-removable)
Updating grub in /boot/efi
grub-efi-install: mode=SECURE_BOOT, bootloader_id=altlinux, efi_directory=/boot/efi
grub-efi-install: running grub-install --target=x86_64-efi --boot-directory=/boot --boot-directory-only 
Выполняется установка для платформы x86_64-efi.
grub-efi-install: installing Secure Boot binaries to ESP
grub-efi-install: NVRAM entry registered: 'ALT Linux' \EFI\altlinux\shimx64.efi
grub-efi-install: installation finished successfully

grub-efi-2.14-alt7.x86_64

Comment 1 Egor Ignatov 2026-06-24 09:06:09 MSK

Добрый день. Спасибо за репорт!

Подскажите еще, пожалуйста, опции с которыми смонтирован /boot/efi:
```
sudo mount | grep /boot/efi
sudo grep '/boot/efi' /etc/fstab
```
И версию ядра на момент возникновения ошибки.

Comment 2 Vyacheslav Bocharov 2026-06-25 03:34:52 MSK

Здравствуйте.

$ sudo mount | grep /boot/efi
/dev/nvme0n1p1 on /boot/efi type vfat (rw,relatime,fmask=0000,dmask=0000,allow_utime=0022,codepage=866,iocharset=utf8,shortname=mixed,quiet,showexec,utf8,errors=remount-ro)

journalctl -b -3 -k --grep "Linux version" | head -1
июн 12 00:59:03 <hostname> kernel: Linux version 6.12.74-6.12-alt1 (builder@localhost.localdomain) (gcc-13 (GCC) 13.2.1 20240128 (ALT Sisyphus 13.2.1-alt3), GNU ld (GNU Binutils) 2.41.0.20230826) #1 SMP PREEMPT_DYNAMIC Fri Mar  6 13:49:54 UTC 2026

Comment 3 Vyacheslav Bocharov 2026-06-25 03:43:50 MSK

$ sudo grep '/boot/efi' /etc/fstab
UUID=4201-1CF6	/boot/efi	vfat	umask=0,quiet,showexec,iocharset=utf8,codepage=866	1	2

Comment 4 Vladislav Glinkin 2026-06-25 11:27:53 MSK

На MSI-B850-GAMING-PLUS-WIFI столкнулся с такой же проблемой при обновлении:
```
[root@MSI-B850-GAMING-PLUS-WIFI ~]# journalctl | grep "grub-efi"
июн 24 18:04:24 host-189 apt-get[4056]: grub-efi-2.14-alt7 p11+411845.254.13.1 1781794123 installed
июн 24 18:04:35 host-189 apt-get[4056]: grub-efi-2.12-alt14 p11+387320.100.1.1 1750090330 removed
```

Как следствие, загрузка с включенным Secure Boot невозможна.
```
[root@MSI-B850-GAMING-PLUS-WIFI ~]# pesign -i /boot/efi/EFI/altlinux/shimx64.efi -S
---------------------------------------------
certificate address is 0x7f7c4bcb8f00
Content was not encrypted.
Content is detached; signature cannot be verified.
The signer's common name is Microsoft Windows UEFI Driver Publisher
No signer email address.
No signing time included.
There were certs or crls included.
---------------------------------------------
[root@MSI-B850-GAMING-PLUS-WIFI ~]# pesign -i /boot/efi/EFI/altlinux/grubx64.efi -S
No signatures found.
```

Выполнение grub-efi-autoupdate помогло.