[Bug 1911440] Please test proposed package

[Łukasz Zemczak]

Hello Dimitri, or anyone else affected,

Accepted grub2 into focal-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/grub2/2.04-1ubuntu26.8
in a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
focal to verification-done-focal. If it does not fix the bug for you,
please add a comment stating that, and change the tag to verification-
failed-focal. In either case, without details of your testing we will
not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: grub2-signed (Ubuntu Focal)
       Status: New => Fix Committed

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to grub2-signed in Ubuntu.
https://bugs.launchpad.net/bugs/1911440

Title:
  Build using distro minilzo

Status in grub2 package in Ubuntu:
  Fix Released
Status in grub2-signed package in Ubuntu:
  Fix Released
Status in grub2 source package in Focal:
  Fix Committed
Status in grub2-signed source package in Focal:
  Fix Committed
Status in grub2 source package in Groovy:
  Fix Committed
Status in grub2-signed source package in Groovy:
  Fix Committed
Status in grub2 source package in Hirsute:
  Fix Released
Status in grub2-signed source package in Hirsute:
  Fix Released

Bug description:
  [Impact]

   * grub2 builds freestanding libc-less minilzo library to be used by the bootloader code.
   * It has a vendorized copy of it, whilst the distribution has newer copies of it.
   * Specifically distribution build has FTBFS fixes for new compiler and CVE fixes, specifically https://ubuntu.com/security/cve-2014-4607

  CVE-2014-4607

   * Building grub with minilzo from the archive seems to be the best
  way to keep minilzo up to date and secure

  [Test Case]

   * Check that grub can open lzo compressed files in the command line
  prompt, for example by having /boot on btrfs filesystem with
  compress=lzo option.

  [Where problems could occur]

   * Changes limited to lzo compression, so for example grub may fail to
  mount / read data off btrfs filesystem with compress=lzo

  [Other Info]

  Fixed in:

  hirsute grub2 2.04-1ubuntu37
  hirsute grub2-signed 1.157

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/grub2/+bug/1911440/+subscriptions