Ubuntu
livecd-rootfs package

ARM64 images don't boot when secureboot is enabled

Bug #1980358 reported by Ivan Kapelyukhin
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
livecd-rootfs (Ubuntu)
Fix Released
Undecided
Unassigned
Bionic
Fix Released
Undecided
Unassigned
Focal
Fix Released
Undecided
Unassigned
Impish
Fix Released
Undecided
Unassigned
Jammy
Fix Released
Undecided
Unassigned

Bug Description

[Impact]

 * This is a backport to focal and bionic of arm64 secureboot enablement work that has already been released in jammy.
 * Users wishing to use secureboot to boot ARM64 bionic and focal cloud images will fail. This is due to the bionic and focal images including incorrect grub EFI binaries. The correct grub EFI binaries, that are included in jammy arm64 cloud images are `shim-signed` and `grub-efi-arm64-signed`.

[Test Plan]

 * Create bionic and focal arm64 images using the updated livecd-rootfs
 * Test that both bionic and focal arm64 images boot successfully on a cloud platform that requires secureboot
 * Test that non-secureboot functionality has not regressed by testing that both bionic and focal images successfully boot on a cloud platform where secureboot is not required

[Where problems could occur]

 * A lot of different derivative images inherit from `disk-image-uefi.binary`, this change
   has the potential to tamper with the arcane matters related to boot

[Other Info]

 * This is a backport, images of Jammy and newer have had those changes since release
 * There is an SRU exception for livecd-rootfs described here: https://wiki.ubuntu.com/StableReleaseUpdates#livecd-rootfs

See original description
Ivan Kapelyukhin (ikapelyukhin)
description: updated
Revision history for this message
Utkarsh Gupta (utkarsh) wrote :

Marked the bug to reflect the status of each series. What about Impish?

Changed in livecd-rootfs (Ubuntu):
status: New → Fix Released
Changed in livecd-rootfs (Ubuntu Jammy):
status: New → Fix Released
Utkarsh Gupta (utkarsh)
Changed in livecd-rootfs (Ubuntu Impish):
status: New → Fix Released
Andrew Cloke (andrew-cloke)
description: updated
Andrew Cloke (andrew-cloke)
description: updated
Andrew Cloke (andrew-cloke)
description: updated
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Please test proposed package

Hello Ivan, or anyone else affected,

Accepted livecd-rootfs into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.664.43 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in livecd-rootfs (Ubuntu Focal):
status: New → Fix Committed
tags: added: verification-needed verification-needed-focal
Changed in livecd-rootfs (Ubuntu Bionic):
status: New → Fix Committed
tags: added: verification-needed-bionic
Revision history for this message
Łukasz Zemczak (sil2100) wrote :

Hello Ivan, or anyone else affected,

Accepted livecd-rootfs into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/livecd-rootfs/2.525.59 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message
Łukasz Zemczak (sil2100) wrote :

I wonder if we can somehow get some information about who else uses the `disk-image-uefi.binary` hook and then verifying with them that it's all still working as expected (for focal and bionic). For focal, from our POV, we do have riscv images that I think might be using the hook? So just-in-case I'd check up on those.

Any ideas?

Revision history for this message
Andrew Cloke (andrew-cloke) wrote :

Thanks Łukasz! I'll try to identify who is building the riscv focal images, and check with them.

Revision history for this message
Ivan Kapelyukhin (ikapelyukhin) wrote (last edit ):

Hello, Łukasz.

Only ARM64 images are affected by this update. If you look at the diff, the changes are inside the `case $ARCH in arm64)` statement.

Thanks, Ivan.

Revision history for this message
Ivan Kapelyukhin (ikapelyukhin) wrote :

TEST CASE:
1. Built a Focal image using the updated `livecd-rootfs`
2. Ran `cloud-test-framework` tests on the image.

VERIFICATION DONE
All tests are green on Focal, including secureboot tests.

tags: added: verification-done-focal
removed: verification-needed-focal
Revision history for this message
Ivan Kapelyukhin (ikapelyukhin) wrote :

TEST CASE:
1. Built a Bionic image using the updated `livecd-rootfs`
2. Verified that image boots successfully via the serial console

VERIFICATION DONE
Verified that image boots when secureboot is enabled.

tags: added: verification-done verification-done-bionic
removed: verification-needed verification-needed-bionic
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package livecd-rootfs - 2.664.43

---------------
livecd-rootfs (2.664.43) focal; urgency=medium

  * ubuntu-cpc: Install `shim-signed` and `grub-efi-arm64-signed` to
    enable secureboot on ARM64 images (LP: #1980358)

livecd-rootfs (2.664.42) focal; urgency=medium

  * Switch intel-iot to use intel-iotg-edge, the 5.15 based IOTG kernel
    (LP: #1980065)
    - While at it, build using the main kernel meta, not just with
      linux-image-*
  * Add support for building live-server images for intel-iot (LP: #1980067)

 -- Ivan Kapelyukhin <email address hidden> Thu, 30 Jun 2022 14:06:30 +0200

Changed in livecd-rootfs (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Update Released

The verification of the Stable Release Update for livecd-rootfs has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package livecd-rootfs - 2.525.59

---------------
livecd-rootfs (2.525.59) bionic; urgency=medium

  * ubuntu-cpc: Install `shim-signed` and `grub-efi-arm64-signed` to enable
    secureboot on ARM64 images (LP: #1980358)

 -- Ivan Kapelyukhin <email address hidden> Thu, 30 Jun 2022 14:10:50 +0200

Changed in livecd-rootfs (Ubuntu Bionic):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.