Merge ~mkukri/grub:ubuntu into ~ubuntu-core-dev/grub/+git/ubuntu:ubuntu

[Mate Kukri]

Addresses LP: #2043995 hopefully in full by:
- Making grub-install more robust by only touch /boot/grub after the install device was validated
- Removing the workaround and letting grub-pc postinst run grub-install

[Steve Langasek (vorlon)]

review: Approve

[Julian Andres Klode (juliank)]

So the changelog entry could be nicer, usually you'd want some text before the (LP: #...) saying what is fixed, it looks weird to just have the bug link there.

+ * (LP: #2043995)
+ - Remove workaround introduced by LP: 1889556
+ - Theoretically wasn't needed since /boot rollback was introduced upstream
+ - Also increase grub-install robustness by delaying the update of /boot after
+ install device validation

review: Needs Fixing

diff --git a/debian/changelog b/debian/changelog
index f5ea66e..26aa431 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+grub2 (2.12~rc1-12ubuntu3) noble; urgency=medium
+
+  * d/p/delay-copying-to-grubdir.patch: Improve grub-install robustness by
+    delaying the update of /boot after install device validation
+  * Remove workaround for LP: 1889556 (LP: #2043995)
+    - Was not needed since /boot rollback was introduced upstream
+    - Patch above ensures that this will not reoccur even if rollback fails
+
+ -- Mate Kukri <[e-mail]>  Tue, 21 Nov 2023 15:35:55 +0000
+
 grub2 (2.12~rc1-12ubuntu2) noble; urgency=medium
 
   * Merge from Debian unstable; remaining changes:
diff --git a/debian/patches/delay-copying-to-grubdir.patch b/debian/patches/delay-copying-to-grubdir.patch
new file mode 100644
index 0000000..7a6380f
--- /dev/null
+++ b/debian/patches/delay-copying-to-grubdir.patch
@@ -0,0 +1,84 @@
+From: Mate Kukri <[e-mail]>
+Date: Tue, 21 Nov 2023 14:58:28 +0000
+Subject: grub-install: Delay copying files to {grubdir,platdir} after
+ install_device was validated.
+
+Previously grub-install copied modules to grubdir before doing any validation on
+the install_device.
+
+When grub-install was called with an invalid install_device, modules
+were already copied to /boot before it found out and was forced to rely
+on atexit rollback.
+
+This patch delays copying the modules after at least some install_device
+validation was done, and thus reduces reliance on successful rollback.
+
+Signed-off-by: Mate Kukri <[e-mail]>
+---
+ util/grub-install.c | 38 ++++++++++++++++++++------------------
+ 1 file changed, 20 insertions(+), 18 deletions(-)
+
+diff --git a/util/grub-install.c b/util/grub-install.c
+index 565505f..db110fc 100644
+--- a/util/grub-install.c
++++ b/util/grub-install.c
+@@ -1429,13 +1429,6 @@ main (int argc, char *argv[])
+ 	}
+     }
+ 
+-  grub_install_copy_files (grub_install_source_directory,
+-			   grubdir, platform);
+-
+-  char *envfile = grub_util_path_concat (2, grubdir, "grubenv");
+-  if (!grub_util_is_regular (envfile))
+-    grub_util_create_envblk_file (envfile);
+-
+   size_t ndev = 0;
+ 
+   /* Write device to a variable so we don't have to traverse /dev every time.  */
+@@ -1522,18 +1515,7 @@ main (int argc, char *argv[])
+ 		       t);
+     free (t);
+   }
+-  load_cfg = grub_util_path_concat (2, platdir,
+-				  "load.cfg");
+-
+-  grub_util_unlink (load_cfg);
+ 
+-  if (debug_image && debug_image[0])
+-    {
+-      load_cfg_f = grub_util_fopen (load_cfg, "wb");
+-      have_load_cfg = 1;
+-      fprintf (load_cfg_f, "set debug='%s'\n",
+-	      debug_image);
+-    }
+   char *prefix_drive = NULL;
+   char *install_drive = NULL;
+ 
+@@ -1557,6 +1539,26 @@ main (int argc, char *argv[])
+ 	}
+     }
+ 
++  grub_install_copy_files (grub_install_source_directory,
++                           grubdir, platform);
++
++  char *envfile = grub_util_path_concat (2, grubdir, "grubenv");
++  if (!grub_util_is_regular (envfile))
++    grub_util_create_envblk_file (envfile);
++
++  load_cfg = grub_util_path_concat (2, platdir,
++                                  "load.cfg");
++
++  grub_util_unlink (load_cfg);
++
++  if (debug_image && debug_image[0])
++    {
++      load_cfg_f = grub_util_fopen (load_cfg, "wb");
++      have_load_cfg = 1;
++      fprintf (load_cfg_f, "set debug='%s'\n",
++              debug_image);
++    }
++
+   char *efi_signed = NULL;
+   switch (platform)
+     {
diff --git a/debian/patches/series b/debian/patches/series
index 49e7a03..9746327 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -108,3 +108,4 @@ suse-grub.texi-add-net_bootp6-document.patch
 ubuntu-verifiers-last.patch
 ubuntu-os-prober-auto.patch
 grub-sort-version.patch
+delay-copying-to-grubdir.patch
diff --git a/debian/postinst.in b/debian/postinst.in
index 8113ac2..8fced84 100644
--- a/debian/postinst.in
+++ b/debian/postinst.in
@@ -584,10 +584,6 @@ case "$1" in
         elif running_in_container; then
           # Skip grub-install in containers.
           :
-        elif dpkg --compare-versions "$2" ge 2.04-1ubuntu26 && [ -z "$DEBCONF_RECONFIGURE" ]; then
-          # Avoid the possibility of breaking grub on SRU update
-          # due to ABI change
-          :
         elif test -e /boot/grub/core.img || \
              test -e /boot/grub/@FIRST_CPU_PLATFORM@/core.img || \
              test "$UPGRADE_FROM_GRUB_LEGACY" || test "$wubi_device"; then