[Bug 1639546] [NEW] Problem with sigature verification

[Steve Langasek]

On Sun, Nov 06, 2016 at 08:22:25AM -0000, QkiZ wrote:
> Additionally when this update is performed shim-signed is uninstalled
> (dependency not met). After manual changing package version requirements
> in shim-signed package to met shim package dependency and install
> modified shim-signed package system still not boot in secureboot. That
> means the problem is in one of new version of these packages:

No, all of those packages are correct.  But you should not have been
installing any of them; to install these, you must have had yakkety-proposed
enabled, which is not a safe target for dist-upgrading to.

On Sun, Nov 06, 2016 at 10:32:02AM -0000, QkiZ wrote:
> new version of shim-signed was released 3h ago. It would be better to
> release all changes related to same topic (secureboot for this example)
> in same time.

They *are* released at the same time.  And none of these packages have been
released yet: they are all still staged in yakkety-proposed.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to grub2-signed in Ubuntu.
https://bugs.launchpad.net/bugs/1639546

Title:
  Problem with sigature verification

Status in grub2-signed package in Ubuntu:
  Fix Released
Status in shim package in Ubuntu:
  Fix Released
Status in shim-signed package in Ubuntu:
  Fix Released

Bug description:
  After updating following packages system can't boot with secureboot
  enabled:

  shim from 0.9+1465500757.14a5905.is.0.8-0ubuntu3 to 0.9+1474479173.6c180c6-0ubuntu1
  grub-efi-amd64 from 2.02~beta2-36ubuntu11 to 2.02~beta2-36ubuntu11.1
  grub-efi-amd64-signed from 1.74+2.02~beta2-36ubuntu11 to 1.74.1+2.02~beta2-36ubuntu11.1
  grub2-common from 2.02~beta2-36ubuntu11 to 2.02~beta2-36ubuntu11.1
  grub-efi-amd64-bin from 2.02~beta2-36ubuntu11 to 2.02~beta2-36ubuntu11.1
  grub-common from 2.02~beta2-36ubuntu11 to 2.02~beta2-36ubuntu11.1

  Additionally when this update is performed shim-signed is uninstalled
  (dependency not met). After manual changing package version
  requirements in shim-signed package to met shim package dependency and
  install modified shim-signed package system still not boot in
  secureboot. That means the problem is in one of new version of these
  packages:

  shim
  grub-efi-amd64
  grub-efi-amd64-signed
  grub2-common
  grub-efi-amd64-bin
  grub-common

  When I reverted changes to:

  shim 0.9+1465500757.14a5905.is.0.8-0ubuntu3 
  grub-efi-amd64 2.02~beta2-36ubuntu11 
  grub-efi-amd64-signed 1.74+2.02~beta2-36ubuntu11 
  grub2-common 2.02~beta2-36ubuntu11 
  grub-efi-amd64-bin 2.02~beta2-36ubuntu11 
  grub-common 2.02~beta2-36ubuntu11 
  shim-signed 1.21.3+0.9+1465500757.14a5905.is.0.8-0ubuntu3

  everything back to normal, system boot with secureboot enabled.

  ProblemType: Bug
  DistroRelease: Ubuntu 16.10
  Package: shim 0.9+1465500757.14a5905.is.0.8-0ubuntu3
  ProcVersionSignature: Ubuntu 4.8.0-27.29-lowlatency 4.8.1
  Uname: Linux 4.8.0-27-lowlatency x86_64
  ApportVersion: 2.20.3-0ubuntu8
  Architecture: amd64
  BootEFIContents:
   grub.cfg
   grubx64.efi
   MokManager.efi
   shim.efi
   shimx64.efi
  CurrentDesktop: Unity
  Date: Sun Nov  6 08:52:30 2016
  Dependencies:
   
  InstallationDate: Installed on 2015-02-13 (631 days ago)
  InstallationMedia: Ubuntu 14.10 "Utopic Unicorn" - Release amd64 (20141022.1)
  SourcePackage: shim
  UpgradeStatus: Upgraded to yakkety on 2016-10-14 (22 days ago)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2-signed/+bug/1639546/+subscriptions