Merge ~xnox/ubiquity:drop-shim-signed-vendorize into ubiquity:master

[Dimitri John Ledkov]

Do not vendorize shim-signed scripts

Simply use shim-signed scripts that are installed in live session already anyway.

I actually have no idea why shim-signed got vendorized inside ubiquity, given that the scripts we call have always been available in the live session, as shim-signed has always been preinstalled on amd64, since its inception.

[Dimitri John Ledkov (xnox)]

TODO: test this

[Dimitri John Ledkov (xnox)]

Actually bootloaders are not preinstalled in the filesystem squashfs. Instead shim-signed is only in the pool, and is only installed in target.

Which imho is a waste of time, but oh well.

Unmerged commits

571cb72... by Dimitri John Ledkov on 2020-05-28

Do not vendorize shim-signed scripts, simply use shim-signed scripts that are installed in live session already anyway.

diff --git a/d-i/Makefile b/d-i/Makefile
index fe85c58..7b3b478 100644
--- a/d-i/Makefile
+++ b/d-i/Makefile
@@ -14,7 +14,6 @@ PACKAGES += $(shell cat $(LISTDIR)/$(DEB_HOST_ARCH))
 endif
 # We don't need to build console-setup.
 PACKAGES := $(filter-out console-setup,$(PACKAGES))
-PACKAGES := $(filter-out shim-signed,$(PACKAGES))
 
 update:
 	@perl -MDpkg::Deps -e1 >/dev/null 2>&1 || { \
diff --git a/d-i/get-sources b/d-i/get-sources
index 500a824..48c7fcb 100755
--- a/d-i/get-sources
+++ b/d-i/get-sources
@@ -107,11 +107,6 @@ for subdir in .svn Fonts Keyboard/acm Keyboard/ckb Keyboard/locale; do
 	rm -rf "$SOURCEDIR/console-setup/$subdir"
 done
 
-# We don't need binary blobs from shim-signed.
-for subdir in MicCorUEFCA2011_2011-06-27.crt shimx64.efi.signed; do
-	rm -rf "$SOURCEDIR/shim-signed/$subdir"
-done
-
 # Add a warning to budding hackers.
 cat > "$SOURCEDIR/README" <<EOF
 The files in this directory are updated automatically from the distribution
diff --git a/d-i/lists/amd64 b/d-i/lists/amd64
index ef9de81..8bc806e 100644
--- a/d-i/lists/amd64
+++ b/d-i/lists/amd64
@@ -1,3 +1,2 @@
 grub-installer
 partman-efi
-shim-signed
diff --git a/d-i/manifest b/d-i/manifest
index ce11a8d..432d4a7 100644
--- a/d-i/manifest
+++ b/d-i/manifest
@@ -28,6 +28,5 @@ partman-swapfile 1
 partman-target 98ubuntu1
 partman-xfs 66
 preseed 1.71ubuntu11
-shim-signed 1.40.3
 tzsetup 1:0.94ubuntu2
 user-setup 1.63ubuntu6
diff --git a/d-i/update-control b/d-i/update-control
index 0f75835..98f0716 100755
--- a/d-i/update-control
+++ b/d-i/update-control
@@ -88,7 +88,6 @@ for my $bd ($parsed->get_deps()) {
 for my $source (<source/*/debian/control>) {
 	# We don't build console-setup, so skip its build-dependencies.
 	next if $source eq 'source/console-setup/debian/control';
-	next if $source eq 'source/shim-signed/debian/control';
 	open SOURCE, '<', $source or die "can't open $source: $!";
 	while (<SOURCE>) {
 		if (/^Build-Depends(?:-Indep)?:\s*(.*)/i) {
diff --git a/debian/changelog b/debian/changelog
index ee46088..90baaf8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,9 +1,14 @@
 ubiquity (20.10.2) UNRELEASED; urgency=medium
 
+  [ Jean-Baptiste Lallement ]
   * zsys-setup: Use persistent device name for vdevs (LP: #1880869)
   * Only export pools created during installation and containing dataset
     mounted under /target (LP: #1875045)
 
+  [ Dimitri John Ledkov ]
+  * Do not vendorize shim-signed scripts, simply use shim-signed scripts
+    that are installed in live session already anyway.
+
  -- Jean-Baptiste Lallement <[e-mail]>  Wed, 27 May 2020 13:49:15 +0200
 
 ubiquity (20.10.1) groovy; urgency=medium
diff --git a/debian/control b/debian/control
index c946244..86c658f 100644
--- a/debian/control
+++ b/debian/control
@@ -97,6 +97,7 @@ Depends: adduser,
          python3-pam,
          rdate,
          sbsigntool [amd64],
+         shim-signed [amd64],
          ubiquity-artwork-${mangled-version},
          ubiquity-casper,
          ubiquity-frontend-${mangled-version},
diff --git a/debian/rules b/debian/rules
index 105aab1..bf2ac50 100755
--- a/debian/rules
+++ b/debian/rules
@@ -212,15 +212,6 @@ endif
 		d-i/source/debian-installer-utils/post-base-installer.d/10register-module \
 		> debian/oem-config/usr/lib/ubiquity/debian-installer-utils/register-module.post-base-installer-oem
 	chmod +x debian/oem-config/usr/lib/ubiquity/debian-installer-utils/register-module.post-base-installer-oem
-ifeq ($(DEB_HOST_ARCH),amd64)
-	install d-i/source/shim-signed/openssl.cnf \
-		debian/ubiquity/usr/lib/ubiquity/shim-signed/openssl.cnf
-	sed 's,/usr/lib/shim/mok/openssl.cnf,/usr/lib/ubiquity/shim-signed/openssl.cnf,g' \
-		d-i/source/shim-signed/update-secureboot-policy \
-		> debian/ubiquity/usr/lib/ubiquity/shim-signed/update-secureboot-policy
-	chmod +x debian/ubiquity/usr/lib/ubiquity/shim-signed/update-secureboot-policy
-endif
-
 	touch install-stamp
 
 tests: install-stamp
diff --git a/debian/ubiquity.dirs-amd64 b/debian/ubiquity.dirs-amd64
 deleted file mode 100644
index 9c24380..0000000
--- a/debian/ubiquity.dirs-amd64
+++ /dev/null
@@ -1 +0,0 @@
-usr/lib/ubiquity/shim-signed
diff --git a/scripts/simple-plugins b/scripts/simple-plugins
index 2558385..77fc89b 100755
--- a/scripts/simple-plugins
+++ b/scripts/simple-plugins
@@ -24,9 +24,11 @@ if [ "$1" = "prepare" ]; then
     db_get ubiquity/secureboot_key
     if [ -n "$RET" ]; then
         mkdir -p /var/lib/shim-signed/mok
-        /usr/lib/ubiquity/shim-signed/update-secureboot-policy --new-key
-        printf '%s\n%s\n' "$RET" "$RET" | mokutil --import /var/lib/shim-signed/mok/MOK.der >/dev/null || true
-        mokutil --timeout -1 >/dev/null || true
+        /usr/sbin/update-secureboot-policy --new-key
+        if [ -e /var/lib/shim-signed/mok/MOK.der ]; then
+            printf '%s\n%s\n' "$RET" "$RET" | mokutil --import /var/lib/shim-signed/mok/MOK.der >/dev/null || true
+            mokutil --timeout -1 >/dev/null || true
+        fi
     fi
     # Always clear secureboot key.
     db_set ubiquity/secureboot_key ''