[Bug 2137746] [NEW] sbattach --detach failures with 6.18

[Dan Bungert]

Public bug reported:

Ubuntu Resolute install ISOs are starting to fail a promotion step, due
to test failures related to sbattach / sbverify.  Promotion here means
that we take a built ISO, see if it passes some integration tests, and
if so, allow it to be considered the "current" ISO on cdimage.

The test failure is related to kernel signatures, and has regressed with
the 6.18 upload.

That failing test can be found here -
https://git.launchpad.net/utah/tree/utah/isotest/iso_static_validation.py#n562

I have extracted the logic from that test into a standalone script that
can be used against vmlinuz files directly, without the additional
challenge of needing a full UTAH setup.  See attached.  It needs a
little configuration - see the things marked FIXME.

The last passing ISO logfile can be found here - https://ubuntu-archive-
team.ubuntu.com/cd-build-logs/ubuntu-server/resolute/daily-
live-20251219.log - as built on December 19th, 2025.

The first failing ISO logfile can be found here - https://ubuntu-
archive-team.ubuntu.com/cd-build-logs/ubuntu-server/resolute/daily-
live-20251220.log - as built on December 20th, 2025.

This dec-20th logfile is the first one to pick up kernel 6.18.

The failure in question looks like:

08:46:53 ERROR: test_efi_secure_boot_signatures (__main__.TestValidateISO)
08:46:53 ERROR: Traceback (most recent call last):
08:46:53   File "/usr/lib/python3.10/unittest/case.py", line 59, in testPartExecutor
08:46:53     yield
08:46:53   File "/usr/lib/python3.10/unittest/case.py", line 591, in run
08:46:53     self._callTestMethod(testMethod)
08:46:53   File "/usr/lib/python3.10/unittest/case.py", line 549, in _callTestMethod
08:46:53     method()
08:46:53   File "/usr/share/utah/isotest/iso_static_validation.py", line 629, in test_efi_secure_boot_signatures
08:46:53     self.assertEqual(stderr, '')
08:46:53 AssertionError: 'warning: data remaining[16721800 vs 17160[34 chars]s?\n' != ''
08:46:53 - warning: data remaining[16721800 vs 17160264]: gaps between PE/COFF sections?

If you use my attached script and point it at kernels 6.17 and 6.18, you
will see the `sbattach --detach` pass for 6.17 and fail for 6.18.

** Affects: linux-meta (Ubuntu)
     Importance: Undecided
         Status: New

** Affects: sbsigntool (Ubuntu)
     Importance: Undecided
         Status: New

** Attachment added: "signatures"
   https://bugs.launchpad.net/bugs/2137746/+attachment/5938211/+files/signatures

** Also affects: sbsigntool (Ubuntu)
   Importance: Undecided
       Status: New

** Summary changed:

- sbattach / sbverify failures with 6.18
+ sbattach --detach failures with 6.18

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to sbsigntool in Ubuntu.
https://bugs.launchpad.net/bugs/2137746

Title:
  sbattach --detach failures with 6.18

Status in linux-meta package in Ubuntu:
  New
Status in sbsigntool package in Ubuntu:
  New

Bug description:
  Ubuntu Resolute install ISOs are starting to fail a promotion step,
  due to test failures related to sbattach / sbverify.  Promotion here
  means that we take a built ISO, see if it passes some integration
  tests, and if so, allow it to be considered the "current" ISO on
  cdimage.

  The test failure is related to kernel signatures, and has regressed
  with the 6.18 upload.

  That failing test can be found here -
  https://git.launchpad.net/utah/tree/utah/isotest/iso_static_validation.py#n562

  I have extracted the logic from that test into a standalone script
  that can be used against vmlinuz files directly, without the
  additional challenge of needing a full UTAH setup.  See attached.  It
  needs a little configuration - see the things marked FIXME.

  The last passing ISO logfile can be found here - https://ubuntu-
  archive-team.ubuntu.com/cd-build-logs/ubuntu-server/resolute/daily-
  live-20251219.log - as built on December 19th, 2025.

  The first failing ISO logfile can be found here - https://ubuntu-
  archive-team.ubuntu.com/cd-build-logs/ubuntu-server/resolute/daily-
  live-20251220.log - as built on December 20th, 2025.

  This dec-20th logfile is the first one to pick up kernel 6.18.

  The failure in question looks like:

  08:46:53 ERROR: test_efi_secure_boot_signatures (__main__.TestValidateISO)
  08:46:53 ERROR: Traceback (most recent call last):
  08:46:53   File "/usr/lib/python3.10/unittest/case.py", line 59, in testPartExecutor
  08:46:53     yield
  08:46:53   File "/usr/lib/python3.10/unittest/case.py", line 591, in run
  08:46:53     self._callTestMethod(testMethod)
  08:46:53   File "/usr/lib/python3.10/unittest/case.py", line 549, in _callTestMethod
  08:46:53     method()
  08:46:53   File "/usr/share/utah/isotest/iso_static_validation.py", line 629, in test_efi_secure_boot_signatures
  08:46:53     self.assertEqual(stderr, '')
  08:46:53 AssertionError: 'warning: data remaining[16721800 vs 17160[34 chars]s?\n' != ''
  08:46:53 - warning: data remaining[16721800 vs 17160264]: gaps between PE/COFF sections?

  If you use my attached script and point it at kernels 6.17 and 6.18,
  you will see the `sbattach --detach` pass for 6.17 and fail for 6.18.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-meta/+bug/2137746/+subscriptions