Cannot upgrade Secure Boot enforcement policy due to unsigned kernels
Your system has UEFI Secure Boot enabled in firmware, and the following kernels present on your system are unsigned:
4.18.0-041800rc5-generic
These kernels cannot be verified under Secure Boot.  To ensure your system remains bootable, GRUB will not be upgraded on your disk until these kernels are removed or replaced with signed kernels.