Merge lp:~cyphermox/ubiquity/disable-verification into lp:ubiquity

[Mathieu Trudel-Lapierre]

WIP: allow disabling kernel signature verification via mokutil (which will need to be promoted to main, and seeded)

[Dimitri John Ledkov (xnox)]

The code looks sane.

I need to boot it, and take screenshots, as these changes seem to not have been run past mpt.

Updating the d-i components, results in FTBFS -

cp debian/ubiquity.install-any debian/ubiquity.install
cat debian/ubiquity.install-amd64 >> debian/ubiquity.install
dh_install
cp: cannot stat 'debian/tmp/d-i/source/apt-setup/generators/93partner': No such file or directory
dh_install: cp --reflink=auto -a debian/tmp/d-i/source/apt-setup/generators/93partner debian/ubiquity/usr/lib/ubiquity/apt-setup/generator

[lp:~cyphermox/ubiquity/disable-verification]

6354. By Mathieu Trudel-Lapierre on 2015-11-27

Fix typo in parameter name for mokutil

6355. By Mathieu Trudel-Lapierre on 2015-12-07

Do more updates of d-i components, including dropping 93partner for apt-setup.

[Dimitri John Ledkov (xnox)]

secureboot signatures seem to be wrong on the xenial proposed images, or my new laptop has broken firmware.

posted the dialogs and text for mpt to look at, in the bug report https://bugs.launchpad.net/ubuntu/+source/ubiquity/+bug/1524833
maybe he can improve design or text.

Text in the learn more button, probably lacks the styles and/or attributed to actually parse the html-y tags -> cause it says literarly <span forground.... instead of making Warning red.

The info loop seems to be wrong.

It starts with both password fields empty, the second one has green tick box already (should be blank) and continue button is active.

The strength indicators work correctly.

Passwords do not match indicator is wrong:
both empty -> green mark & continue button active;
both filled and matching -> "passwords do not match" and continue button inactive

mokutil in in universe, should be installed on x86-64 desktop live image and thus should have a MIR filed and be in main.

so i can't run this all the way with disabling the secureboot with current xenial images. I'm happy for this to be merged once the password prompts / continue state machine logic is fixed. And then will retest again once the mokutil is promoted to main and is on the images.

review: Needs Fixing

[lp:~cyphermox/ubiquity/disable-verification]

6356. By Mathieu Trudel-Lapierre on 2015-12-16

Properly apply markup to Secure Boot info dialog.

=== modified file 'd-i/manifest'
--- d-i/manifest	2015-11-02 03:21:25 +0000
+++ d-i/manifest	2015-12-16 15:44:02 +0000
@@ -1,15 +1,15 @@
-apt-setup 1:0.80ubuntu8
+apt-setup 1:0.104ubuntu1
 base-installer 1.144ubuntu2
 bterm-unifont 1.3
 choose-mirror 2.65ubuntu1
 clock-setup 0.121ubuntu1
 console-setup 1.108ubuntu9
 debian-installer-utils 1.109ubuntu1
-flash-kernel 3.0~rc.4ubuntu55
+flash-kernel 3.0~rc.4ubuntu57
 grub-installer 1.78ubuntu30
-hw-detect 1.95ubuntu7
+hw-detect 1.114ubuntu1
 localechooser 2.65ubuntu3
-netcfg 1.127ubuntu1
+netcfg 1.135ubuntu1
 partconf 1.48
 partman-auto 125ubuntu2
 partman-auto-crypto 22ubuntu1
@@ -18,18 +18,18 @@
 partman-base 187ubuntu1
 partman-basicfilesystems 109ubuntu1
 partman-basicmethods 60
-partman-btrfs 14ubuntu2
+partman-btrfs 18ubuntu1
 partman-crypto 78ubuntu1
-partman-efi 62ubuntu2
-partman-ext3 84ubuntu1
+partman-efi 62ubuntu3
+partman-ext3 84ubuntu2
 partman-jfs 46
 partman-lvm 111
 partman-newworld 33
 partman-partitioning 106ubuntu1
 partman-target 92ubuntu1
 partman-uboot 5
-partman-xfs 56
-preseed 1.64ubuntu3
+partman-xfs 57
+preseed 1.68ubuntu1
 tzsetup 1:0.66ubuntu2
-user-setup 1.48ubuntu7
+user-setup 1.63ubuntu1
 yaboot-installer 1.1.33ubuntu1

=== modified file 'debian/changelog'
--- debian/changelog	2015-11-02 03:21:38 +0000
+++ debian/changelog	2015-12-16 15:44:02 +0000
@@ -1,3 +1,14 @@
+ubiquity (2.21.39) UNRELEASED; urgency=medium
+
+  * Automatic update of included source packages: partman-efi 62ubuntu3,
+    partman-ext3 84ubuntu2, partman-xfs 57, preseed 1.64ubuntu4, apt-setup
+    1:0.104ubuntu1, flash-kernel 3.0~rc.4ubuntu57, hw-detect 1.114ubuntu1,
+    netcfg 1.135ubuntu1, partman-btrfs 18ubuntu1, preseed 1.68ubuntu1,
+    user-setup 1.63ubuntu1.
+  * Add support for disabling Secure Boot in prepare screen.
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Tue, 24 Nov 2015 15:43:16 -0500
+
 ubiquity (2.21.38) xenial; urgency=medium
 
   * d-i/sources.list: switch to xenial.

=== modified file 'debian/control'
--- debian/control	2015-01-29 17:46:16 +0000
+++ debian/control	2015-12-16 15:44:02 +0000
@@ -3,7 +3,7 @@
 Priority: optional
 Maintainer: Ubuntu Installer Team <[e-mail]>
 Uploaders: Colin Watson <[e-mail]>, Evan Dandrea <[e-mail]>
-Build-Depends: adwaita-icon-theme, apt, autopoint, bf-utf-source, check, dctrl-tools, debconf (>= 1.5.43), debconf-utils, debhelper (>= 9), devio, dh-autoreconf, dh-di (>= 3), dh-systemd, dpkg-dev (>= 1.15.7), gir1.2-soup-2.4, gir1.2-timezonemap-1.0, gir1.2-webkit-3.0, gir1.2-xkl-1.0, gobject-introspection, imagemagick, intltool (>= 0.40.0), intltool-debian (>= 0.30+20040212), iso-codes, isoquery, keymapper (>= 0.5.3-7), libbogl-dev, libcairo2-dev, libdebconfclient0-dev (>= 0.68), libdebian-installer4-dev (>= 0.76), libgirepository1.0-dev, libglib2.0-dev, libgtk-3-dev, libido3-0.1-dev, libindicator3-dev, libiw-dev (>= 27+28pre9), liblocale-gettext-perl, libparted-dev (>= 2.2), librsvg2-bin, locales, pep8, pkg-config, po-debconf (>= 1.0), pyflakes (>= 0.7.2), python-gi-dev, python-scour, python3-all (>= 3.1), python3-apt (>= 0.7.100.3~), python3-cairo, python3-dbus, python3-gi, python3-gi-cairo, python3-icu (>= 1.0), python3-mock (>= 0.7.0), python3-pam, tzdata, ubuntu-artwork, udev, wget, xkb-data (>= 0.9), xkb-data-i18n, xvfb
+Build-Depends: adwaita-icon-theme, apt, autopoint, bf-utf-source, check, dctrl-tools, debconf (>= 1.5.43), debconf-utils, debhelper (>= 9), devio, dh-autoreconf, dh-di (>= 3), dh-systemd, dpkg-dev (>= 1.15.7), gir1.2-soup-2.4, gir1.2-timezonemap-1.0, gir1.2-webkit-3.0, gir1.2-xkl-1.0, gobject-introspection, imagemagick, intltool (>= 0.40.0), intltool-debian (>= 0.30+20040212), iso-codes, isoquery, keymapper (>= 0.5.3-7), libbogl-dev, libcairo2-dev, libdebconfclient0-dev (>= 0.68), libdebian-installer4-dev (>= 0.76), libgirepository1.0-dev, libglib2.0-dev, libgtk-3-dev, libido3-0.1-dev, libindicator3-dev, libiw-dev (>= 27+28pre9), liblocale-gettext-perl, libparted-dev (>= 2.2), librsvg2-bin, libsubunit-dev, locales, pep8, pkg-config, po-debconf (>= 1.0), pyflakes (>= 0.7.2), python-gi-dev, python-scour, python3-all (>= 3.1), python3-apt (>= 0.7.100.3~), python3-cairo, python3-dbus, python3-gi, python3-gi-cairo, python3-icu (>= 1.0), python3-mock (>= 0.7.0), python3-pam, tzdata, ubuntu-artwork, udev, wget, xkb-data (>= 0.9), xkb-data-i18n, xvfb
 Standards-Version: 3.9.4
 X-Python3-Version: >= 3.1
 XS-Testsuite: autopkgtest

=== modified file 'debian/ubiquity.install-any'
--- debian/ubiquity.install-any	2015-02-18 01:55:50 +0000
+++ debian/ubiquity.install-any	2015-12-16 15:44:02 +0000
@@ -28,7 +28,6 @@
 d-i/source/apt-setup/generators/60local usr/lib/ubiquity/apt-setup/generators
 d-i/source/apt-setup/generators/90services-select usr/lib/ubiquity/apt-setup/generators
 d-i/source/apt-setup/generators/91security usr/lib/ubiquity/apt-setup/generators
-d-i/source/apt-setup/generators/93partner usr/lib/ubiquity/apt-setup/generators
 d-i/source/apt-setup/release-files/archive.ubuntu.com usr/share/apt-setup/release-files
 d-i/source/apt-setup/release-files/security.ubuntu.com usr/share/apt-setup/release-files
 d-i/source/apt-setup/release-files/archive.canonical.com usr/share/apt-setup/release-files

=== modified file 'debian/ubiquity.templates'
--- debian/ubiquity.templates	2015-04-14 19:32:33 +0000
+++ debian/ubiquity.templates	2015-12-16 15:44:02 +0000
@@ -1467,3 +1467,30 @@
 Type: text
 _Description:
  Encryption options...
+
+Template: ubiquity/text/efi_secureboot
+Type: text
+_Description:
+ UEFI Secure Boot
+
+Template: ubiquity/text/efi_secureboot_info
+Type: text
+_Description:
+ You have chosen to enable third-party software as part of your install,
+ which for this system includes hardware drivers for graphics and/or wi-fi
+ hardware. Your system also has UEFI Secure Boot enabled. UEFI Secure Boot
+ is not compatible with the use of these third-party drivers.
+ .
+ After installation completes, Ubuntu will assist you in disabling UEFI
+ Secure Boot. To ensure that this change is being made by you as an authorized
+ user, and not by an attacker, you must choose a password now and then use
+ the same password after reboot to confirm the change.
+ .
+ <span foreground="darkred">Warning</span>: If you choose not to install
+ these drivers, or if you proceed but do not confirm the password upon reboot,
+ Ubuntu will still be able to boot on your system but these third-party
+ drivers will not be available for your hardware.
+
+Template: ubiquity/secureboot_key
+Type: password
+_Description: SecureBoot key for MokPW

=== modified file 'gui/gtk/stepPrepare.ui'
--- gui/gtk/stepPrepare.ui	2013-12-18 14:01:53 +0000
+++ gui/gtk/stepPrepare.ui	2015-12-16 15:44:02 +0000
@@ -1,8 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
+<!-- Generated with glade 3.18.3 -->
 <interface>
-  <requires lib="gtk+" version="2.16"/>
-  <!-- interface-requires gtkwidgets 0.0 -->
-  <!-- interface-naming-policy toplevel-contextual -->
+  <requires lib="gtk+" version="3.0"/>
   <object class="GtkAlignment" id="stepPrepare">
     <property name="visible">True</property>
     <property name="can_focus">False</property>
@@ -23,8 +22,8 @@
               <object class="GtkLabel" id="prepare_best_results">
                 <property name="visible">True</property>
                 <property name="can_focus">False</property>
+                <property name="label" translatable="yes">For best results, please ensure:</property>
                 <property name="xalign">0</property>
-                <property name="label" translatable="yes">For best results, please ensure:</property>
                 <attributes>
                   <attribute name="weight" value="bold"/>
                 </attributes>
@@ -55,6 +54,7 @@
                   </object>
                   <packing>
                     <property name="expand">True</property>
+                    <property name="fill">True</property>
                     <property name="position">0</property>
                   </packing>
                 </child>
@@ -65,6 +65,7 @@
                   </object>
                   <packing>
                     <property name="expand">True</property>
+                    <property name="fill">True</property>
                     <property name="position">1</property>
                   </packing>
                 </child>
@@ -75,6 +76,7 @@
                   </object>
                   <packing>
                     <property name="expand">True</property>
+                    <property name="fill">True</property>
                     <property name="position">2</property>
                   </packing>
                 </child>
@@ -96,10 +98,11 @@
             <child>
               <object class="GtkCheckButton" id="prepare_download_updates">
                 <property name="label" translatable="yes">Download updates while installing</property>
+                <property name="use_action_appearance">False</property>
                 <property name="visible">True</property>
                 <property name="can_focus">True</property>
                 <property name="receives_default">False</property>
-                <property name="use_action_appearance">False</property>
+                <property name="xalign">0.5</property>
                 <property name="draw_indicator">True</property>
               </object>
               <packing>
@@ -118,10 +121,10 @@
                   <object class="GtkLabel" id="prepare_foss_disclaimer">
                     <property name="visible">True</property>
                     <property name="can_focus">False</property>
-                    <property name="xalign">0</property>
                     <property name="label" translatable="yes">${RELEASE} uses third-party software to play Flash, MP3 and other media, and to work with some graphics and wi-fi hardware. Some of this software is proprietary. The software is subject to license terms included with its documentation.</property>
                     <property name="wrap">True</property>
-                    <property name="max-width-chars">50</property>
+                    <property name="max_width_chars">50</property>
+                    <property name="xalign">0</property>
                   </object>
                   <packing>
                     <property name="expand">True</property>
@@ -134,21 +137,7 @@
                     <property name="visible">True</property>
                     <property name="can_focus">False</property>
                     <property name="orientation">vertical</property>
-                    <child>
-                      <object class="GtkCheckButton" id="prepare_nonfree_software">
-                        <property name="label" translatable="yes">Install this third-party software</property>
-                        <property name="visible">True</property>
-                        <property name="can_focus">True</property>
-                        <property name="receives_default">False</property>
-                        <property name="use_action_appearance">False</property>
-                        <property name="draw_indicator">True</property>
-                      </object>
-                      <packing>
-                        <property name="expand">True</property>
-                        <property name="fill">True</property>
-                        <property name="position">0</property>
-                      </packing>
-                    </child>
+                    <property name="spacing">6</property>
                     <child>
                       <object class="GtkAlignment" id="alignment2">
                         <property name="visible">True</property>
@@ -158,12 +147,12 @@
                           <object class="GtkLabel" id="prepare_foss_disclaimer_extra_label">
                             <property name="visible">True</property>
                             <property name="can_focus">False</property>
+                            <property name="label" translatable="yes">Fluendo MP3 plugin includes MPEG Layer-3 audio decoding technology licensed from Fraunhofer IIS and Technicolor SA.</property>
+                            <property name="wrap">True</property>
                             <property name="xalign">0</property>
                             <property name="yalign">0</property>
-                            <property name="label" translatable="yes">Fluendo MP3 plugin includes MPEG Layer-3 audio decoding technology licensed from Fraunhofer IIS and Technicolor SA.</property>
-                            <property name="wrap">True</property>
                             <attributes>
-                              <attribute name="scale" value="0.83333333333333333"/>
+                              <attribute name="scale" value="0.83333333333333337"/>
                             </attributes>
                           </object>
                         </child>
@@ -171,6 +160,23 @@
                       <packing>
                         <property name="expand">True</property>
                         <property name="fill">True</property>
+                        <property name="position">0</property>
+                      </packing>
+                    </child>
+                    <child>
+                      <object class="GtkCheckButton" id="prepare_nonfree_software">
+                        <property name="label" translatable="yes">Install this third-party software</property>
+                        <property name="use_action_appearance">False</property>
+                        <property name="visible">True</property>
+                        <property name="can_focus">True</property>
+                        <property name="receives_default">False</property>
+                        <property name="xalign">0.5</property>
+                        <property name="draw_indicator">True</property>
+                        <signal name="toggled" handler="on_nonfree_toggled" swapped="no"/>
+                      </object>
+                      <packing>
+                        <property name="expand">True</property>
+                        <property name="fill">True</property>
                         <property name="position">1</property>
                       </packing>
                     </child>
@@ -181,6 +187,314 @@
                     <property name="position">1</property>
                   </packing>
                 </child>
+                <child>
+                  <object class="GtkBox" id="secureboot_box">
+                    <property name="visible">False</property>
+                    <property name="can_focus">False</property>
+                    <property name="orientation">vertical</property>
+                    <property name="spacing">6</property>
+                    <child>
+                      <object class="GtkBox" id="box5">
+                        <property name="visible">True</property>
+                        <property name="can_focus">False</property>
+                        <property name="halign">start</property>
+                        <property name="spacing">6</property>
+                        <child>
+                          <object class="GtkLabel" id="secureboot_label">
+                            <property name="visible">True</property>
+                            <property name="can_focus">False</property>
+                            <property name="halign">start</property>
+                            <property name="label" translatable="yes">To install these drivers, you must disable secure boot on this device.</property>
+                            <property name="use_markup">True</property>
+                            <property name="wrap">True</property>
+                          </object>
+                          <packing>
+                            <property name="expand">False</property>
+                            <property name="fill">True</property>
+                            <property name="position">0</property>
+                          </packing>
+                        </child>
+                        <child>
+                          <object class="GtkButton" id="secureboot_more_button">
+                            <property name="visible">True</property>
+                            <property name="can_focus">True</property>
+                            <property name="receives_default">True</property>
+                            <property name="relief">none</property>
+                            <signal name="clicked" handler="show_learn_more" swapped="no"/>
+                            <child>
+                              <object class="GtkLabel" id="label1">
+                                <property name="visible">True</property>
+                                <property name="can_focus">False</property>
+                                <property name="label" translatable="yes">&lt;u&gt;Learn more...&lt;/u&gt;</property>
+                                <property name="use_markup">True</property>
+                              </object>
+                            </child>
+                          </object>
+                          <packing>
+                            <property name="expand">False</property>
+                            <property name="fill">True</property>
+                            <property name="position">1</property>
+                          </packing>
+                        </child>
+                      </object>
+                      <packing>
+                        <property name="expand">False</property>
+                        <property name="fill">True</property>
+                        <property name="position">0</property>
+                      </packing>
+                    </child>
+                    <child>
+                      <object class="GtkLabel" id="warning_password_label">
+                        <property name="visible">True</property>
+                        <property name="can_focus">False</property>
+                        <property name="halign">start</property>
+                        <property name="label" translatable="yes">&lt;span foreground="darkred"&gt;Warning&lt;/span&gt;: This password will be required after reboot to confirm the disabling of Secure Boot</property>
+                        <property name="use_markup">True</property>
+                      </object>
+                      <packing>
+                        <property name="expand">False</property>
+                        <property name="fill">True</property>
+                        <property name="position">1</property>
+                      </packing>
+                    </child>
+                    <child>
+                      <object class="GtkGrid" id="password_grid">
+                        <property name="visible">True</property>
+                        <property name="can_focus">False</property>
+                        <property name="row_spacing">6</property>
+                        <property name="column_spacing">6</property>
+                        <property name="column_homogeneous">True</property>
+                        <child>
+                          <object class="GtkEntry" id="password">
+                            <property name="visible">True</property>
+                            <property name="can_focus">True</property>
+                            <property name="hexpand">True</property>
+                            <property name="visibility">False</property>
+                            <property name="invisible_char">●</property>
+                            <property name="activates_default">True</property>
+                            <property name="width_chars">20</property>
+                            <signal name="changed" handler="info_loop" swapped="no"/>
+                          </object>
+                          <packing>
+                            <property name="left_attach">1</property>
+                            <property name="top_attach">0</property>
+                          </packing>
+                        </child>
+                        <child>
+                          <object class="GtkEntry" id="verified_password">
+                            <property name="visible">True</property>
+                            <property name="can_focus">True</property>
+                            <property name="hexpand">True</property>
+                            <property name="visibility">False</property>
+                            <property name="invisible_char">●</property>
+                            <property name="activates_default">True</property>
+                            <property name="width_chars">20</property>
+                            <signal name="changed" handler="info_loop" swapped="no"/>
+                          </object>
+                          <packing>
+                            <property name="left_attach">1</property>
+                            <property name="top_attach">1</property>
+                          </packing>
+                        </child>
+                        <child>
+                          <object class="GtkNotebook" id="password_strength">
+                            <property name="visible">True</property>
+                            <property name="can_focus">False</property>
+                            <property name="show_tabs">False</property>
+                            <property name="show_border">False</property>
+                            <child>
+                              <object class="GtkFixed" id="empty">
+                                <property name="visible">True</property>
+                                <property name="can_focus">False</property>
+                              </object>
+                            </child>
+                            <child type="tab">
+                              <placeholder/>
+                            </child>
+                            <child>
+                              <object class="GtkLabel" id="password/too_short">
+                                <property name="visible">True</property>
+                                <property name="can_focus">False</property>
+                                <property name="label" translatable="yes">Short password</property>
+                                <property name="xalign">0</property>
+                                <attributes>
+                                  <attribute name="scale" value="0.83333333333329995"/>
+                                  <attribute name="foreground" value="#8b8b00000000"/>
+                                </attributes>
+                              </object>
+                              <packing>
+                                <property name="position">1</property>
+                              </packing>
+                            </child>
+                            <child type="tab">
+                              <placeholder/>
+                            </child>
+                            <child>
+                              <object class="GtkLabel" id="password/weak">
+                                <property name="visible">True</property>
+                                <property name="can_focus">False</property>
+                                <property name="label" translatable="yes">Weak password</property>
+                                <property name="xalign">0</property>
+                                <attributes>
+                                  <attribute name="scale" value="0.83333333333329995"/>
+                                  <attribute name="foreground" value="#8b8b00000000"/>
+                                </attributes>
+                              </object>
+                              <packing>
+                                <property name="position">2</property>
+                              </packing>
+                            </child>
+                            <child type="tab">
+                              <placeholder/>
+                            </child>
+                            <child>
+                              <object class="GtkLabel" id="password/fair">
+                                <property name="visible">True</property>
+                                <property name="can_focus">False</property>
+                                <property name="label" translatable="yes">Fair password</property>
+                                <property name="xalign">0</property>
+                                <attributes>
+                                  <attribute name="scale" value="0.83333333333329995"/>
+                                  <attribute name="foreground" value="#ffff8c8c0000"/>
+                                </attributes>
+                              </object>
+                              <packing>
+                                <property name="position">3</property>
+                              </packing>
+                            </child>
+                            <child type="tab">
+                              <placeholder/>
+                            </child>
+                            <child>
+                              <object class="GtkLabel" id="password/good">
+                                <property name="visible">True</property>
+                                <property name="can_focus">False</property>
+                                <property name="label" translatable="yes">Good password</property>
+                                <property name="xalign">0</property>
+                                <attributes>
+                                  <attribute name="scale" value="0.83333333333329995"/>
+                                  <attribute name="foreground" value="#000064640000"/>
+                                </attributes>
+                              </object>
+                              <packing>
+                                <property name="position">4</property>
+                              </packing>
+                            </child>
+                            <child type="tab">
+                              <placeholder/>
+                            </child>
+                            <child>
+                              <object class="GtkLabel" id="password/strong">
+                                <property name="visible">True</property>
+                                <property name="can_focus">False</property>
+                                <property name="label" translatable="yes">Strong password</property>
+                                <property name="xalign">0</property>
+                                <attributes>
+                                  <attribute name="scale" value="0.83333333333329995"/>
+                                  <attribute name="foreground" value="#000064640000"/>
+                                </attributes>
+                              </object>
+                              <packing>
+                                <property name="position">5</property>
+                              </packing>
+                            </child>
+                            <child type="tab">
+                              <placeholder/>
+                            </child>
+                          </object>
+                          <packing>
+                            <property name="left_attach">2</property>
+                            <property name="top_attach">0</property>
+                          </packing>
+                        </child>
+                        <child>
+                          <object class="GtkNotebook" id="password_match">
+                            <property name="visible">True</property>
+                            <property name="can_focus">False</property>
+                            <property name="show_tabs">False</property>
+                            <property name="show_border">False</property>
+                            <child>
+                              <object class="GtkFixed" id="empty2">
+                                <property name="visible">True</property>
+                                <property name="can_focus">False</property>
+                              </object>
+                            </child>
+                            <child type="tab">
+                              <placeholder/>
+                            </child>
+                            <child>
+                              <object class="GtkLabel" id="password_mismatch">
+                                <property name="visible">True</property>
+                                <property name="can_focus">False</property>
+                                <property name="label" translatable="yes">Mismatch</property>
+                                <property name="xalign">0</property>
+                                <attributes>
+                                  <attribute name="scale" value="0.83333333333329995"/>
+                                  <attribute name="foreground" value="#8b8b00000000"/>
+                                </attributes>
+                              </object>
+                              <packing>
+                                <property name="position">1</property>
+                              </packing>
+                            </child>
+                            <child>
+                              <object class="GtkImage" id="password_ok">
+                                <property name="visible">True</property>
+                                <property name="can_focus">False</property>
+                                <property name="xalign">0</property>
+                                <property name="stock">gtk-apply</property>
+                              </object>
+                              <packing>
+                                <property name="position">2</property>
+                              </packing>
+                            </child>
+                            <child type="tab">
+                              <placeholder/>
+                            </child>
+                          </object>
+                          <packing>
+                            <property name="left_attach">2</property>
+                            <property name="top_attach">1</property>
+                          </packing>
+                        </child>
+                        <child>
+                          <object class="GtkLabel" id="password_label">
+                            <property name="visible">True</property>
+                            <property name="can_focus">False</property>
+                            <property name="halign">end</property>
+                            <property name="label" translatable="yes">Choose a Secure Boot security key:</property>
+                          </object>
+                          <packing>
+                            <property name="left_attach">0</property>
+                            <property name="top_attach">0</property>
+                          </packing>
+                        </child>
+                        <child>
+                          <object class="GtkLabel" id="verified_password_label">
+                            <property name="visible">True</property>
+                            <property name="can_focus">False</property>
+                            <property name="halign">end</property>
+                            <property name="label" translatable="yes">Confirm Secure Boot security key:</property>
+                          </object>
+                          <packing>
+                            <property name="left_attach">0</property>
+                            <property name="top_attach">1</property>
+                          </packing>
+                        </child>
+                      </object>
+                      <packing>
+                        <property name="expand">False</property>
+                        <property name="fill">True</property>
+                        <property name="position">2</property>
+                      </packing>
+                    </child>
+                  </object>
+                  <packing>
+                    <property name="expand">False</property>
+                    <property name="fill">True</property>
+                    <property name="position">2</property>
+                  </packing>
+                </child>
               </object>
               <packing>
                 <property name="expand">False</property>

=== modified file 'scripts/simple-plugins'
--- scripts/simple-plugins	2013-04-28 13:46:10 +0000
+++ scripts/simple-plugins	2015-12-16 15:44:02 +0000
@@ -11,6 +11,13 @@
             ubuntu-drivers autoinstall --package-list /run/ubuntu-drivers.autoinstall || \
 		logger -t ubiquity "ubuntu-drivers autoinstall failed with code: $?"
     fi
+    db_input high ubiquity/secureboot_key || true
+    db_get ubiquity/secureboot_key
+    if [ -n "$RET" ]; then
+        echo "${RET}\n${RET}" | sudo mokutil --disable-validation
+    fi
+    # Always clear secureboot key.
+    db_set ubiquity/secureboot_key ''
 elif [ "$1" = "wireless" ]; then
     db_get ubiquity/online
     if [ "$RET" != true ]; then

=== modified file 'tests/test_gtkui.py'
--- tests/test_gtkui.py	2014-06-30 13:09:16 +0000
+++ tests/test_gtkui.py	2015-12-16 15:44:02 +0000
@@ -130,6 +130,7 @@
                 'ubi_question_dialog', 'question_label',
                 # Calculated error string
                 'label_global_error',
+                'warning_password_label', 'label1', 'secureboot_label',
             ]
             deb_host_arch = subprocess.Popen(
                 ['dpkg-architecture', '-qDEB_HOST_ARCH'],

=== modified file 'ubiquity/install_misc.py'
--- ubiquity/install_misc.py	2014-04-02 13:44:04 +0000
+++ ubiquity/install_misc.py	2015-12-16 15:44:02 +0000
@@ -475,6 +475,17 @@
         return answer, ''
 
 
+def is_secure_boot():
+    secureboot_efivar = subprocess.Popen(
+        ['od', '-An', '-t', 'u1',
+         os.path.join('/sys/firmware/efi/efivars',
+                      'SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c')],
+        stdout=subprocess.PIPE, universal_newlines=True)
+    answer = secureboot_efivar.communicate()[0].strip()
+    secureboot = answer.split(' ')[-1]
+    return (int(secureboot) == 1)
+
+
 # TODO this can probably go away now.
 def get_cache_pkg(cache, pkg):
     # work around broken has_key in python-apt 0.6.16

=== modified file 'ubiquity/plugins/ubi-prepare.py'
--- ubiquity/plugins/ubi-prepare.py	2013-10-18 21:38:44 +0000
+++ ubiquity/plugins/ubi-prepare.py	2015-12-16 15:44:02 +0000
@@ -23,8 +23,8 @@
 import subprocess
 import sys
 
-from ubiquity import i18n, misc, osextras, plugin, upower
-
+from ubiquity import i18n, misc, osextras, plugin, upower, validation
+from ubiquity.install_misc import archdetect, is_secure_boot
 
 NAME = 'prepare'
 AFTER = 'wireless'
@@ -40,6 +40,9 @@
 class PreparePageBase(plugin.PluginUI):
     plugin_title = 'ubiquity/text/prepare_heading_label'
 
+    def __init__(self, *args, **kwargs):
+        plugin.PluginUI.__init__(self)
+
     def plugin_set_online_state(self, state):
         self.prepare_network_connection.set_state(state)
         self.enable_download_updates(state)
@@ -71,24 +74,34 @@
             self.page = None
             return
         self.controller = controller
-        from gi.repository import Gtk
-        builder = Gtk.Builder()
+        from ubiquity.gtkwidgets import Builder
+        builder = Builder()
         self.controller.add_builder(builder)
         builder.add_from_file(os.path.join(
             os.environ['UBIQUITY_GLADE'], 'stepPrepare.ui'))
         builder.connect_signals(self)
+
         self.page = builder.get_object('stepPrepare')
-        self.prepare_download_updates = builder.get_object(
-            'prepare_download_updates')
-        self.prepare_nonfree_software = builder.get_object(
-            'prepare_nonfree_software')
-        self.prepare_sufficient_space = builder.get_object(
-            'prepare_sufficient_space')
-        self.prepare_foss_disclaimer = builder.get_object(
-            'prepare_foss_disclaimer')
-        self.prepare_foss_disclaimer_extra = builder.get_object(
-            'prepare_foss_disclaimer_extra_label')
-        self.prepare_power_source = builder.get_object('prepare_power_source')
+
+        # Get all objects + add internal child(s)
+        all_widgets = builder.get_object_ids()
+        for wdg in all_widgets:
+            setattr(self, wdg, builder.get_object(wdg))
+
+        self.password_strength_pages = {
+            'empty': 0,
+            'too_short': 1,
+            'weak': 2,
+            'fair': 3,
+            'good': 4,
+            'strong': 5,
+        }
+        self.password_match_pages = {
+            'empty': 0,
+            'mismatch': 1,
+            'ok': 2,
+        }
+
         if upower.has_battery():
             upower.setup_power_watch(self.prepare_power_source)
         else:
@@ -97,6 +110,14 @@
             'prepare_network_connection')
         self.plugin_widgets = self.page
 
+        self.using_secureboot = False
+        self.secureboot_title = 'UEFI Secure Boot'
+        self.secureboot_msg = 'Secure Boot'
+
+    def set_using_secureboot(self, secureboot):
+        self.using_secureboot = secureboot
+        self.on_nonfree_toggled(None)
+
     def enable_download_updates(self, val):
         self.prepare_download_updates.set_sensitive(val)
 
@@ -132,6 +153,61 @@
             text = text.replace('${RELEASE}', release.name)
             widget.set_label(text)
 
+        sb_title_template = 'ubiquity/text/efi_secureboot'
+        sb_info_template = 'ubiquity/text/efi_secureboot_info'
+        self.secureboot_title = self.controller.get_string(sb_title_template)
+        self.secureboot_msg = self.controller.get_string(sb_info_template)
+
+    def on_nonfree_toggled(self, widget):
+        if self.using_secureboot:
+            enabled = self.get_use_nonfree()
+            if enabled:
+                self.secureboot_box.show()
+            else:
+                self.secureboot_box.hide()
+            self.info_loop(None)
+
+    def info_loop(self, unused_widget):
+        complete = True
+        passw = self.password.get_text()
+        vpassw = self.verified_password.get_text()
+
+        if passw != vpassw or (passw and len(passw) < 8):
+            complete = False
+            self.password_match.set_current_page(
+                self.password_match_pages['empty'])
+            if passw and (not passw.startswith(vpassw) or
+                          len(vpassw) / len(passw) > 0.8):
+                self.password_match.set_current_page(
+                    self.password_match_pages['mismatch'])
+        else:
+            self.password_match.set_current_page(
+                self.password_match_pages['ok'])
+
+        if passw:
+            txt = validation.human_password_strength(passw)[0]
+            self.password_strength.set_current_page(
+                self.password_strength_pages[txt])
+        else:
+            self.password_strength.set_current_page(
+                self.password_strength_pages['empty'])
+
+        self.controller.allow_go_forward(complete)
+        return complete
+
+    def get_secureboot_key(self):
+        return self.password.get_text()
+
+    def show_learn_more(self, unused):
+        from gi.repository import Gtk
+        dialog = Gtk.MessageDialog(
+            self.page.get_toplevel(), Gtk.DialogFlags.MODAL,
+            Gtk.MessageType.INFO, Gtk.ButtonsType.CLOSE, None)
+        dialog.set_title(self.secureboot_title)
+        dialog.set_markup(self.secureboot_msg)
+        dialog.run()
+        dialog.destroy()
+
 
 class PageKde(PreparePageBase):
     plugin_breadcrumb = 'ubiquity/text/breadcrumb_prepare'
@@ -227,6 +303,11 @@
             use_nonfree = self.db.get('ubiquity/use_nonfree') == 'true'
             self.ui.set_use_nonfree(use_nonfree)
 
+        arch, subarch = archdetect()
+        if 'efi' in subarch:
+            if is_secure_boot():
+                self.ui.set_using_secureboot(True)
+
         download_updates = self.db.get('ubiquity/download_updates') == 'true'
         self.ui.set_download_updates(download_updates)
         self.setup_sufficient_space()
@@ -260,8 +341,11 @@
     def ok_handler(self):
         download_updates = self.ui.get_download_updates()
         use_nonfree = self.ui.get_use_nonfree()
+        secureboot_key = self.ui.get_secureboot_key()
         self.preseed_bool('ubiquity/use_nonfree', use_nonfree)
         self.preseed_bool('ubiquity/download_updates', download_updates)
+        if self.ui.using_secureboot and secureboot_key:
+            self.preseed('ubiquity/secureboot_key', secureboot_key, seen=True)
         if use_nonfree:
             with misc.raised_privileges():
                 # Install ubuntu-restricted-addons.