Merge ~xnox/grub:one-grub into ~ubuntu-core-dev/grub/+git/ubuntu:ubuntu

[Dimitri John Ledkov]

One grub

52f0f11... by Dimitri John Ledkov on 2021-02-20

correct next grub2-signed version.

[Dimitri John Ledkov (xnox)]

rejected.

review: Needs Resubmitting

Unmerged commits

52f0f11... by Dimitri John Ledkov on 2021-02-20

correct next grub2-signed version.

3f5da3b... by Dimitri John Ledkov on 2021-02-20

One grub

LP: #1915536

diff --git a/debian/changelog b/debian/changelog
index fca9ce3..29c39a2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+grub2 (2.04-1ubuntu41) hirsute; urgency=medium
+
+  * In grub-efi-*-{bin,dbg} packages ship modules & kernel.img in the
+    -unsigned platform directory, and instead depend on
+    grub-efi-*-signed-{bin,dbg} packages that will provide modules
+    matching the signed images. LP: #1915536
+  * Use raw-signing tarball which includes modules and images. Previously
+    raw-uefi was used that provides only unpacked images. LP: #1915536
+
+ -- Dimitri John Ledkov <[e-mail]>  Thu, 18 Feb 2021 00:50:30 +0000
+
 grub2 (2.04-1ubuntu40) hirsute; urgency=medium
 
   * Revert: rhboot-f34-tcp-add-window-scaling-support.patch,
diff --git a/debian/control b/debian/control
index 9aafb52..a691460 100644
--- a/debian/control
+++ b/debian/control
@@ -313,7 +313,7 @@ Description: GRand Unified Bootloader, version 2 (EFI-IA32 signing template)
 
 Package: grub-efi-amd64-bin
 Architecture: i386 kopensolaris-i386 any-amd64
-Depends: ${shlibs:Depends}, ${misc:Depends}, grub-common (= ${binary:Version})
+Depends: ${shlibs:Depends}, ${misc:Depends}, grub-common (= ${binary:Version}), grub-efi-amd64-signed-bin (>> ${grub2-signed-nextversion})
 Recommends: grub-efi-amd64-signed, efibootmgr [linux-any]
 Replaces: grub2 (<< ${source:Version}), grub-common (<= 1.97~beta2-1), grub-efi-amd64 (<< 1.99-1)
 Multi-Arch: foreign
@@ -338,7 +338,7 @@ Description: GRand Unified Bootloader, version 2 (EFI-AMD64 modules)
 Package: grub-efi-amd64-dbg
 Section: debug
 Architecture: i386 kopensolaris-i386 any-amd64
-Depends: ${misc:Depends}, grub-efi-amd64-bin (= ${binary:Version}), grub-common (= ${binary:Version})
+Depends: ${misc:Depends}, grub-efi-amd64-bin (= ${binary:Version}), grub-common (= ${binary:Version}), grub-efi-amd64-signed-dbg (>> ${grub2-signed-nextversion})
 Multi-Arch: foreign
 Description: GRand Unified Bootloader, version 2 (EFI-AMD64 debug files)
  This package contains debugging files for grub-efi-amd64-bin.  You only
@@ -474,7 +474,7 @@ Description: GRand Unified Bootloader, version 2 (ARM UEFI version)
 
 Package: grub-efi-arm64-bin
 Architecture: any-arm64
-Depends: ${shlibs:Depends}, ${misc:Depends}, grub-common (= ${binary:Version})
+Depends: ${shlibs:Depends}, ${misc:Depends}, grub-common (= ${binary:Version}), grub-efi-arm64-signed-bin (>> ${grub2-signed-nextversion})
 Recommends: grub-efi-arm64-signed, efibootmgr [linux-any]
 Multi-Arch: foreign
 XB-Efi-Vendor: ${efi:Vendor}
@@ -497,7 +497,7 @@ Description: GRand Unified Bootloader, version 2 (ARM64 UEFI modules)
 Package: grub-efi-arm64-dbg
 Section: debug
 Architecture: any-arm64
-Depends: ${misc:Depends}, grub-efi-arm64-bin (= ${binary:Version}), grub-common (= ${binary:Version})
+Depends: ${misc:Depends}, grub-efi-arm64-bin (= ${binary:Version}), grub-common (= ${binary:Version}), grub-efi-arm64-signed-dbg (>> ${grub2-signed-nextversion})
 Multi-Arch: foreign
 Description: GRand Unified Bootloader, version 2 (ARM64 UEFI debug files)
  This package contains debugging files for grub-efi-arm64-bin.  You only
diff --git a/debian/rules b/debian/rules
index 6ccb2dc..202c125 100755
--- a/debian/rules
+++ b/debian/rules
@@ -121,14 +121,22 @@ debian/stamps/build-grub-efi-arm64 install/grub-efi-arm64: export SB_PLATFORM :=
 debian/stamps/build-grub-efi-arm64 install/grub-efi-arm64: export SB_EFI_NAME := aa64
 SB_PACKAGE :=
 ifeq (yes,$(shell dpkg-vendor --derives-from Ubuntu && echo yes))
+# Submit this build of grub for raw-uefi signing?
+SB_SUBMIT := yes
+# What version of next grub2-signed package to depend on, to trigger upgrades?
+substvars += \
+	-Vgrub2-signed-nextversion="1.163"
 ifeq ($(DEB_HOST_ARCH),amd64)
 SB_PACKAGE := grub-efi-amd64
+override_dh_install override_dh_builddeb: SB_PLATFORM := x86_64-efi
 endif
 ifeq ($(DEB_HOST_ARCH),arm64)
 SB_PACKAGE := grub-efi-arm64
+override_dh_install override_dh_builddeb: SB_PLATFORM := arm64-efi
 endif
 endif
 
+
 # Downstream distributions that want to support SB and build images, but do not
 # rebuild grub, need a programmatic way to get the vendor, as it's used by build-efi-images
 # to create the monolithic Grub image and thus is needed to create the partitions on the EFI
@@ -546,6 +554,11 @@ ifneq (,$(filter grub-pc,$(BUILD_PACKAGES)))
 	patch debian/grub-pc/usr/lib/grub-legacy/update-grub \
 		< debian/legacy/update-grub.ubuntu.patch
 endif
+ifneq (,$(SB_PACKAGE))
+	mv debian/$(SB_PACKAGE)-bin/usr/lib/grub/$(SB_PLATFORM) debian/$(SB_PACKAGE)-bin/usr/lib/grub/$(SB_PLATFORM)-unsigned
+	mv debian/$(SB_PACKAGE)-dbg/usr/lib/grub/$(SB_PLATFORM) debian/$(SB_PACKAGE)-dbg/usr/lib/grub/$(SB_PLATFORM)-unsigned
+	sed -i 's/$(SB_PLATFORM)/$(SB_PLATFORM)-unsigned/g' debian/$(SB_PACKAGE)-bin/usr/share/lintian/overrides/$(SB_PACKAGE)-bin
+endif
 endif
 
 override_dh_installdocs:
@@ -589,11 +602,23 @@ ifeq (yes,$(shell dpkg-vendor --derives-from Ubuntu && echo yes))
 	if [ -d obj/monolithic/$(SB_PACKAGE)/$(deb_version) ]; then \
 		rm -rf obj/monolithic/$(SB_PACKAGE)/$(deb_version); \
 	fi
-	mkdir -v obj/monolithic/$(SB_PACKAGE)/$(deb_version)
-	ln -v obj/monolithic/$(SB_PACKAGE)/* obj/monolithic/$(SB_PACKAGE)/$(deb_version) || :
+	mkdir -vp obj/monolithic/$(SB_PACKAGE)/$(deb_version)/control
+	echo 'tarball' > obj/monolithic/$(SB_PACKAGE)/$(deb_version)/control/options
+	mkdir -p obj/monolithic/$(SB_PACKAGE)/$(deb_version)/$(SB_PLATFORM)/ obj/monolithic/$(SB_PACKAGE)/$(deb_version)/$(SB_PLATFORM)-signed
+	# move version
+	cp obj/monolithic/$(SB_PACKAGE)/version obj/monolithic/$(SB_PACKAGE)/$(deb_version)/$(SB_PLATFORM)-signed
+	# copy in modules
+	cp -r debian/$(SB_PACKAGE)-bin/usr/lib/grub/$(SB_PLATFORM)-unsigned/* obj/monolithic/$(SB_PACKAGE)/$(deb_version)/$(SB_PLATFORM)/
+	# copy in dbg modules
+	cp -r debian/$(SB_PACKAGE)-dbg/usr/lib/grub/$(SB_PLATFORM)-unsigned/* obj/monolithic/$(SB_PACKAGE)/$(deb_version)/$(SB_PLATFORM)/
+	# move .efi apps where they are expected as signed
+	mv obj/monolithic/$(SB_PACKAGE)/$(deb_version)/$(SB_PLATFORM)/monolithic/* obj/monolithic/$(SB_PACKAGE)/$(deb_version)/$(SB_PLATFORM)-signed
+	# this way signed tarball more-or-less will look like how everything needs to be in /usr/lib/grub/
 endif
 	tar -c -f ../$(TARNAME) -a -C obj/monolithic/$(SB_PACKAGE) -v $(deb_version)
-	dpkg-distaddfile $(TARNAME) raw-uefi -
+ifneq (,$(SB_SUBMIT))
+	dpkg-distaddfile $(TARNAME) raw-signing -
+endif
 endif
 
 override_dh_auto_clean: