Merge ~ubuntu-core-dev/grub/+git/ubuntu:lp.1795291 into ~ubuntu-core-dev/grub/+git/ubuntu:ubuntu

[Steve Langasek]

[Julian Andres Klode (juliank)]

Just skipping vmlinuz binaries where .efi.signed exist seems like a better approach IMO, we can just do that by adding a

  if [ -e "$kernel.efi.signed" ]; then
   continue
  fi

before or after the dpkg check.

review: Needs Information

[Mathieu Trudel-Lapierre (cyphermox)]

With juliank's proposed changes.

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 56b66c9..ea769d5 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+grub2 (2.02+dfsg1-5ubuntu6) UNRELEASED; urgency=medium
+
+  * debian/grub-check-signatures: Handle the case where we have unsigned
+    vmlinuz and signed vmlinuz.efi.signed.  LP: #1795291.
+
+ -- Steve Langasek <[e-mail]>  Mon, 01 Oct 2018 00:58:46 -0700
+
 grub2 (2.02+dfsg1-5ubuntu5) cosmic; urgency=medium
 
   [ Mathieu Trudel-Lapierre ]
diff --git a/debian/grub-check-signatures b/debian/grub-check-signatures
index 3a466ec..647c405 100755
--- a/debian/grub-check-signatures
+++ b/debian/grub-check-signatures
@@ -60,8 +60,10 @@ find_unsigned() {
 		if dpkg --compare-versions "$this_uname_r" lt "$uname_r"; then
 			continue
 		fi
-		if ! is_signed $kernel; then
+		if ! is_signed $kernel && ! echo "$signed" | grep -q "\b$this_uname_r"; then
 			echo "$this_uname_r"
+		else
+			signed="$signed $this_uname_r"
 		fi
 	done
 }