https://bugzilla.suse.com/show_bug.cgi?id=1228863 https://bugzilla.suse.com/show_bug.cgi?id=1228863#c56 --- Comment #56 from Alberto Planas Dominguez <aplanas@suse.com> --- Arthur, thanks for the information. As I see only three entries are selected, and this should be OK to not exceed the limitations of PolicyOR. Try this: # Clean the predictions and update the predictions: rm -fr /var/lib/pcrlock.d sdbootutil -v --ask-pin update-predictions This will ask the recovery PIN / recovery key (was presented during the installation). If the recovery PIN is not working anymore, you would need to re-enroll: sdbootutil unenroll --method=tpm2 sdbootutil enroll --method=tpm2 Is this working now? If works, can you attach again the content for /var/lib/pcrlock.d? -- You are receiving this mail because: You are on the CC list for the bug.