amd64 images should have correct set of bootloaders installed

Bug #1901906 reported by Dimitri John Ledkov
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
livecd-rootfs (Ubuntu)
Fix Released
Undecided
Unassigned
Xenial
Fix Released
Undecided
Unassigned
Bionic
Fix Released
Undecided
Unassigned
Focal
Fix Released
Undecided
Unassigned
Groovy
Fix Released
Undecided
Unassigned
Hirsute
Fix Released
Undecided
Unassigned

Bug Description

[Impact]

 * amd64 images should have shim-signed & grub-pc installed as the bootloaders, with all other alternatives not installed; and not partially removed (rc state). This is the only way to ensure that secureboot/efi boot works correctly, but also for BIOS grub-pc to work correctly. This is how we install systems by default today.

[Test Case]

 * Build images; check that shim-signed & grub-pc are installed and configured
 * Check that no other packages are autoremovable or partially removed (rc)

[Regression Potential]

 * The above changes gurantee that upon upgrades / dist-upgrade the correct set of bootloaders are installed. There will be a change of debconf keys and bootloader packages that are installed on the system, when comparing with a previous image, which some automation may be sensitive to if they were trying to automatically correct bootloader setup before.

[Other Info]

 * Uploaded into hirsute already.

Related branches

Changed in livecd-rootfs (Ubuntu Hirsute):
status: New → Fix Committed
Changed in livecd-rootfs (Ubuntu Hirsute):
status: Fix Committed → In Progress
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package livecd-rootfs - 2.698

---------------
livecd-rootfs (2.698) hirsute; urgency=medium

  * amd64: always install grub-pc with shim-signed (LP: #1901906)
  * control: install qemu-utils & snapd on riscv64.

 -- Dimitri John Ledkov <email address hidden> Thu, 29 Oct 2020 22:22:30 +0000

Changed in livecd-rootfs (Ubuntu Hirsute):
status: In Progress → Fix Released
Revision history for this message
Łukasz Zemczak (sil2100) wrote :

Note to other SRU members: part of this change is also the addition of a few autoremove calls, but that's fine.

Changed in livecd-rootfs (Ubuntu Groovy):
status: New → Fix Committed
tags: added: verification-needed verification-needed-groovy
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Please test proposed package

Hello Dimitri, or anyone else affected,

Accepted livecd-rootfs into groovy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.694.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-groovy to verification-done-groovy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-groovy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message
Dimitri John Ledkov (xnox) wrote :

https://launchpad.net/~xnox/+livefs/ubuntu/groovy/any/+build/247095

Triggered cpc build and took the qcow2 image out of there.

root@ottawa:/# dpkg -l | grep -v '^ii'
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============================-===================================-============-===============================================================================
root@ottawa:/# dpkg -l | grep grub
ii grub-common 2.04-1ubuntu35.1 amd64 GRand Unified Bootloader (common files)
ii grub-efi-amd64-bin 2.04-1ubuntu35.1 amd64 GRand Unified Bootloader, version 2 (EFI-AMD64 modules)
ii grub-efi-amd64-signed 1.155.1+2.04-1ubuntu35.1 amd64 GRand Unified Bootloader, version 2 (EFI-AMD64 version, signed)
ii grub-gfxpayload-lists 0.7 amd64 GRUB gfxpayload blacklist
ii grub-pc 2.04-1ubuntu35.1 amd64 GRand Unified Bootloader, version 2 (PC/BIOS version)
ii grub-pc-bin 2.04-1ubuntu35.1 amd64 GRand Unified Bootloader, version 2 (PC/BIOS modules)
ii grub2-common 2.04-1ubuntu35.1 amd64 GRand Unified Bootloader (common files for version 2)
root@ottawa:/# dpkg -l | grep shim
ii shim 15+1552672080.a4a1fbe-0ubuntu2 amd64 boot loader to chain-load signed boot loaders under Secure Boot
ii shim-signed 1.45+15+1552672080.a4a1fbe-0ubuntu2 amd64 Secure Boot chain-loading bootloader (Microsoft-signed binary)

correct bootloaders installed and there are no partially installed packages; or conflicting or unconfigured ones. All is good.

tags: added: verification-done verification-done-groovy
removed: verification-needed verification-needed-groovy
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package livecd-rootfs - 2.694.1

---------------
livecd-rootfs (2.694.1) groovy; urgency=medium

  * livecd-rootfs SRU of change up to 2.699 from hirsute to groovy.

  = hyperv gallery image =
  [ Jinming Wu, Patrick ]
  * hyper-v hook: Fix writing of pkla file out to correct scratch
    directory for image build. LP: #1901846
  [ Dimitri John Ledkov ]
  * auto/config: seed ubuntu-desktop when building hyperv image LP: #1901846
  * auto/config: scope ubuntu:desktop-preinstalled:raspi image options LP: #1901846

  = CPC cloud images =
  [ Dimitri John Ledkov & Joshua Powers ]
  * amd64: always install grub-pc with shim-signed (LP: #1901906), and
    ensure to autoremove packages
  [ John Chittum ]
  * Ensure vmtools version entered into vmdk header (LP: #1893898)

  = RISC-V port =
  * control: install qemu-utils & snapd on riscv64. (LP: #1903034)

 -- Dimitri John Ledkov <email address hidden> Thu, 05 Nov 2020 11:54:14 +0000

Changed in livecd-rootfs (Ubuntu Groovy):
status: Fix Committed → Fix Released
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Update Released

The verification of the Stable Release Update for livecd-rootfs has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Steve Langasek (vorlon) wrote : Please test proposed package

Hello Dimitri, or anyone else affected,

Accepted livecd-rootfs into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.525.48 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in livecd-rootfs (Ubuntu Bionic):
status: New → Fix Committed
tags: added: verification-needed verification-needed-bionic
removed: verification-done
Revision history for this message
Steve Langasek (vorlon) wrote : Proposed package upload rejected

An upload of livecd-rootfs to xenial-proposed has been rejected from the upload queue for the following reason: "uploaded with wrong -v option; will reupload".

Revision history for this message
Steve Langasek (vorlon) wrote : Please test proposed package

Hello Dimitri, or anyone else affected,

Accepted livecd-rootfs into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.408.64 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in livecd-rootfs (Ubuntu Xenial):
status: New → Fix Committed
tags: added: verification-needed-xenial
Revision history for this message
Steve Langasek (vorlon) wrote :

Hello Dimitri, or anyone else affected,

Accepted livecd-rootfs into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.664.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in livecd-rootfs (Ubuntu Focal):
status: New → Fix Committed
tags: added: verification-needed-focal
Revision history for this message
Ubuntu SRU Bot (ubuntu-sru-bot) wrote : Autopkgtest regression report (livecd-rootfs/2.408.64)

All autopkgtests for the newly accepted livecd-rootfs (2.408.64) for xenial have finished running.
The following regressions have been reported in tests triggered by the package:

livecd-rootfs/2.408.64 (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/xenial/update_excuses.html#livecd-rootfs

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

Revision history for this message
Joshua Powers (powersj) wrote :

The xenial verification has failed as once again the package names are not correct. I have an MP up [1] which reverts back to the original behavior. Xenial's behavior around shim is not the same as later releases. This work is not something scheduled till next year.

Bionic [2] and Focal [3] are sru verification passed as images are building, no longer including extra packages, and are launching successfully. The build logs linked you can search for "chroot mountpoint apt-get install -qqy grub-pc shim-signed" to verify the new version is getting shipped.

[1] https://code.launchpad.net/~powersj/livecd-rootfs/+git/livecd-rootfs-1/+merge/394910
[2] https://i510533839.restricted.launchpadlibrarian.net/510533839/buildlog_ubuntu_bionic_amd64_amd64-disk-image_qcow2_squashfs_tarball_vagrant_vmdk_azure_azure-pro_azure-pro-fips_dimension-data_hyperv-gcs_wsl_maas_softlayer_cpc_BUILDING.txt.gz?token=HPgBwmkbztJpx1ZSZbwW0Ln2XvmF0Clh
[3] https://i510437212.restricted.launchpadlibrarian.net/510437212/buildlog_ubuntu_focal_amd64_amd64-disk-image_kvm_qcow2_squashfs_tarball_vagrant_vmdk_azure_azure-pro_hyperv-gcs_wsl_maas_softlayer_cpc_BUILDING.txt.gz?token=pxHwRfRH0CVNcL6Rj6fhcltmq1SQDtDH

tags: added: verification-done-bionic verification-done-focal verification-failed-xenial
removed: verification-needed verification-needed-bionic verification-needed-focal verification-needed-xenial
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package livecd-rootfs - 2.664.10

---------------
livecd-rootfs (2.664.10) focal; urgency=medium

  * Do not hard-code the UC20 amd64 image size to 8GB as now ubuntu-image
    should be able to properly calculate the needed size itself.
  * But per discussion, we might want to keep the UC20 images a bit bigger than
    what's defined via the gadget/rootfs contents, to make sure writable is
    comfortably big enough. Use the same hard-coded value as for UC16 and UC18.
    (LP: #1905990)

livecd-rootfs (2.664.9) focal; urgency=medium

   [ John Chittum]
   * Backport Ensure toolsVersion set in vmdk header (LP: #1893898)

   [ Dimitri John Ledkov & Joshua Powers ]
   * amd64: always install grub-pc with shim-signed (LP: #1901906), and
     ensure to autoremove packages

 -- Łukasz 'sil2100' Zemczak <email address hidden> Fri, 27 Nov 2020 17:58:38 +0100

Changed in livecd-rootfs (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package livecd-rootfs - 2.525.48

---------------
livecd-rootfs (2.525.48) bionic; urgency=medium

   [ John Chittum ]
   * Ensure vmtools version entered into vmdk header (LP: #1893898)

   [ Dimitri John Ledkov & Joshua Powers ]
   * amd64: always install grub-pc with shim-signed (LP: #1901906), and
     ensure to autoremove packages

   [ Patrick Viafore ]
   * Increase Vagrant disk size from 10G to 40G (LP: #1580596)

 -- Robert C Jennings <email address hidden> Fri, 20 Nov 2020 15:08:54 -0600

Changed in livecd-rootfs (Ubuntu Bionic):
status: Fix Committed → Fix Released
Revision history for this message
Brian Murray (brian-murray) wrote : Please test proposed package

Hello Dimitri, or anyone else affected,

Accepted livecd-rootfs into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.408.65 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

tags: added: verification-needed verification-needed-xenial
removed: verification-failed-xenial
Revision history for this message
Ubuntu SRU Bot (ubuntu-sru-bot) wrote : Autopkgtest regression report (livecd-rootfs/2.408.65)

All autopkgtests for the newly accepted livecd-rootfs (2.408.65) for xenial have finished running.
The following regressions have been reported in tests triggered by the package:

ubuntu-image/1.10+16.04ubuntu1 (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/xenial/update_excuses.html#livecd-rootfs

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

Revision history for this message
Joshua Powers (powersj) wrote :

The regression that was previously seen with the SRU is now fixed [1] and therefore I am marking this as verification-done-xenial.

[1] https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-xenial/xenial/amd64/l/livecd-rootfs/20210112_234252_88c0d@/log.gz

tags: added: verification-done verification-done-xenial
removed: verification-needed verification-needed-xenial
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package livecd-rootfs - 2.408.65

---------------
livecd-rootfs (2.408.65) xenial; urgency=medium

  [ Joshua Powers ]
  * amd64: revert install grub changes on Xenial (LP: #1901906)

livecd-rootfs (2.408.64) xenial; urgency=medium

  [ Joshua Powers ]
  * amd64: always install grub-efi-amd64-signed (LP: #1901906)

livecd-rootfs (2.408.63) xenial; urgency=medium

  [ John Chittum ]
  * Backport Ensure toolsVersion set in vmdk header (LP: #1893898)

livecd-rootfs (2.408.62) xenial; urgency=medium

  [ Dimitri John Ledkov & Joshua Powers ]
  * amd64: always install grub-pc with shim-signed (LP: #1901906), and
    ensure to autoremove packages

  [ Patrick Viafore ]
  * Increase Vagrant disk size from 10G to 40G (LP: #1580596)

  [ Cody Shepherd ]
  * buildd: ext4: change tar transform target to match changes in bionic+
  * buildd: Skip jasper for buildd subproject
  * buildd: Create manifests for buildd tarballs

livecd-rootfs (2.408.61) xenial; urgency=medium

  * SRU: Enable bootable-buildd hooks for Xenial (LP: #1863024)

 -- Robert C Jennings <email address hidden> Tue, 15 Dec 2020 11:11:14 -0600

Changed in livecd-rootfs (Ubuntu Xenial):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.