Comment # 69 on bug 1224773 from Imo Hester

> Sorry for my ignorance. If the package is installed you need first to accept the key, right? Is the NVIDIA package different?

The issue was the repo key not getting accepted nor was the user ask about it.

I made the mistake and installed the driver repo and immediately rebooted the
system.
Which then caused the health checker to freak out about it and reboot but not
rolling back and thus rebooted to the snapshot with the new repo but the
unaccepted key. Freak out. Reboot but not rollback. Freak out. Reboot but not
rollback and so on.

Only option was to boot an earlier snapshot from the bootmanager to get out of
the loop.

The actual fix was to run:

> sudo transactional-update pkg in openSUSE-repos-MicroOS-NVIDIA
> sudo transactional-update -c pkg in nvidia-drivers-G06

During the 2nd tu command I then got ask whether to accept the key or not. I
set it to always accept and then continued with the driver installation.
I did not try the first tu command with -i thought. But also the 2nd tu command
asked me about the key without -i.

After the repo and driver was installed the issue with the initrd file
occurred. Until now I didn't knew about "sdbootutil mkinitrd" and didn't try. I
used:

> sudo transactional-update -c initrd

The full procedure was:

> sudo transactional-update pkg in openSUSE-repos-MicroOS-NVIDIA
> sudo transactional-update -c pkg in nvidia-drivers-G06
> sudo transactional-update -c initrd
> sudo transactional-update -c run mv /boot/initrd-KERNEL-VERSION /boot/efi/opensuse-aeon/KERNEL-VERION/
> sudo vim /boot/efi/loader/entries/opensuse-aeon-KERNEL_VERION-LATEST-SNAPSHOT.conf
> Replace initrd with the new one copied earlier
> sudo reboot

About the TPM I tried the following to solve the issue:

> sudo sdbootutil update-predictions
Which didn't helped then I tried:

> sudo sdbootutil --ask-pin update-predictions
With the same result.
Then I cleared the TPM entirely from within my BIOS then rebooted, entered the
recovery key and tried to update the predictions again to no avail.

I did not tried and didn't knew about:

> sdbootutil unenroll --method=tpm2
> sdbootutil enroll --method=tpm2

Was about to re-try the procedure on my Laptop just today as my main system
currently runs Kalpa until this issue is fixed. But I have to re-install the
system for other reasons rn. Unfortunately my Laptop has no TPM chip so I can
only test the driver installation but not the TPM stuff with it.