[Bug 1793166] Re: Missing grub-common dependency on sbsigntool

[Mathieu Trudel-Lapierre]

It's not wrong, because it really should have that dependency since it's
using sbsigntool, but you shouldn't be hitting this bug in the first
place: shim-signed should always be installed on UEFI systems, and does
pull in sbsigntool.

** Changed in: grub2 (Ubuntu)
       Status: New => Triaged

** Changed in: grub2 (Ubuntu)
   Importance: Undecided => High

** Changed in: grub2 (Ubuntu)
     Assignee: (unassigned) => Mathieu Trudel-Lapierre (cyphermox)

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to grub2 in Ubuntu.
https://bugs.launchpad.net/bugs/1793166

Title:
  Missing grub-common dependency on sbsigntool

Status in grub2 package in Ubuntu:
  Triaged

Bug description:
  The grub-common package, starting (so far as I can tell) with bionic-
  updates, introduced a script named /usr/share/grub/grub-check-
  signatures.

  This script is run, for example, during the post-installation for the
  grub-efi-amd64 (or maybe, grub-efi-amd64-signed) package in order to
  verify the signature of an installed kernel. Unfortunately, grub-
  check-signatures utilizes a tool called "sbattach", which is available
  in the "sbsigntool" package. If "sbsigntool" is not installed, then
  this script fails, resulting in "grub-efi-amd64" failing to believe
  that signed kernels are signed correctly. This then leads to further
  problems if UEFI secure boot in enabled in the user's BIOS. (In my
  experience, the kernel will still load, but "apt" reports errors with
  kernel package installations, believing them to be unsigned.)

  In short, it appears that there is a missing dependency on
  "sbsigntool" from within the "grub-common" package (or one of its
  dependencies).

  I discovered this problem on Linux Mint 19. Please also refer to this
  forum thread for further details of the bug symptoms:

  https://forums.linuxmint.com/viewtopic.php?f=46&t=277863&p=1528140#p1528140

  Relevant other information:

  Linux Mint 19, Tara

  # apt-cache policy grub-common
  grub-common:
    Installed: 2.02-2ubuntu8.4
    Candidate: 2.02-2ubuntu8.4
    Version table:
   *** 2.02-2ubuntu8.4 500
          500 http://archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
          100 /var/lib/dpkg/status
       2.02-2ubuntu8 500
          500 http://archive.ubuntu.com/ubuntu bionic/main amd64 Packages

  If you need any further information, please let me know...

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1793166/+subscriptions