Merge ~juliank/grub/+git/bionic:master into ~ubuntu-core-dev/grub/+git/bionic:master

[Julian Andres Klode]

[Julian Andres Klode (juliank)]

Also uploaded to the SRU queue. Things to note:

1. most systems should have UEFI boot and BIOS boot in parallel so need this anyhow
2. focal and later have the Depends in grub-common too, just it uses the library instead of the tool.
3. we want to have one signed binary of grub across all stable series to reduce number of assets signed, and prevent regressions from toolchain differences. Especially older toolchains may just produce wrong code for EFI.

[Julian Andres Klode (juliank)]

Yes, the grub-check-signatures would be nicer with traps, but this is the exact code that's in all other stable series, not introducing regression potential now.

Unmerged commits

a6a8a56... by Julian Andres Klode on 2023-02-01

releasing package grub2 version 2.02-2ubuntu8.26

diff --git a/debian/changelog b/debian/changelog
index dd62890..b8b1a3d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+grub2 (2.02-2ubuntu8.26) bionic; urgency=medium
+
+  * Have grub-common depend on efibootmgr on amd64, arm64, i386 (LP: #1936857)
+  * grub-check-signatures: Support gzip compressed kernels (LP: #1954683)
+
+ -- Julian Andres Klode <[e-mail]>  Wed, 01 Feb 2023 18:49:01 +0100
+
 grub2 (2.02-2ubuntu8.25) bionic; urgency=medium
 
   [ Colin Watson ]
diff --git a/debian/control b/debian/control
index 708ba7b..92ae551 100644
--- a/debian/control
+++ b/debian/control
@@ -72,7 +72,7 @@ Description: GRand Unified Bootloader, version 2 (dummy package)
 Package: grub-common
 Priority: optional
 Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, gettext-base, ${lsb-base-depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}, gettext-base, ${lsb-base-depends}, efibootmgr [amd64 arm64 i386]
 Replaces: grub-pc (<< 2.00-4), grub-ieee1275 (<< 2.00-4), grub-efi (<< 1.99-1), grub-coreboot (<< 2.00-4), grub-linuxbios (<< 1.96+20080831-1), grub-efi-ia32 (<< 2.00-4), grub-efi-amd64 (<< 2.00-4), grub-efi-ia64 (<< 2.00-4), grub-yeeloong (<< 2.00-4)
 Recommends: os-prober (>= 1.33)
 Suggests: multiboot-doc, grub-emu [any-i386 any-amd64 any-powerpc], xorriso (>= 0.5.6.pl00), desktop-base (>= 4.0.6), console-setup
diff --git a/debian/grub-check-signatures b/debian/grub-check-signatures
index 3d41c3c..edc171e 100755
--- a/debian/grub-check-signatures
+++ b/debian/grub-check-signatures
@@ -54,8 +54,13 @@ extract_known_keys() {
 
 # Check if a given kernel image is signed
 is_signed() {
+	kernel=$1
 	tmp=$(mktemp)
-	sbattach --detach $tmp $1 >/dev/null 2>/dev/null 	# that's ugly...
+	kernel_tmp=$(mktemp)
+	if zcat $kernel > $kernel_tmp 2>/dev/null; then
+		kernel=$kernel_tmp
+	fi
+	sbattach --detach $tmp $kernel >/dev/null 2>/dev/null 	# that's ugly...
 	test "$(wc -c < $tmp)" -ge 16	# Just _some_ minimum size
 	result=$?
 	if [ $result -eq 0 ]; then
@@ -64,9 +69,10 @@ is_signed() {
 	rm $tmp
 	if [ $result -eq 0 ]; then
 		for crtfile in $tmpdir/*.crt; do
-			sbverify --cert $crtfile $1 >/dev/null 2>/dev/null
+			sbverify --cert $crtfile $kernel >/dev/null 2>/dev/null
 			result=$?
 			if [ $result -eq 0 ]; then
+				rm "$kernel_tmp"
 				return $result;
 			fi
 		done
@@ -75,6 +81,7 @@ is_signed() {
 	else
 		echo "$1 is unsigned." >&2
 	fi
+	rm "$kernel_tmp"
 	return $result
 }