Hi,
I have just discovered a breakage in secure boot amd64. I haven’t dug into the details on the breakage exact reason yet, but it is related to package versions and/or dependencies.
We build a gadget snap, which follows the reference snap here: https://github.com/snapcore/pc-amd64-gadget/blob/20/snapcraft.yaml
In fact it’s slightly different, but we have a similar grub-prepare stage which installs packages required to get secure boot working. The difference is in our package sources, as the reference pc gadget snap uses some PPAs for sources. So our section looks like this:
grub-prepare:
plugin: nil
# Not required - we do this in the docker build image #
#build-snaps: [snapd/latest/edge]
build-packages:
- wget
stage-packages:
- grub-efi-amd64-signed
- grub-pc-bin
- shim-signed
- sbsigntool
override-stage: |
SHIM_PKG="shim-signed_1.45+15+1552672080.a4a1fbe-0ubuntu2_amd64.deb"
wget http://archive.ubuntu.com/ubuntu/pool/main/s/shim-signed/${SHIM_PKG} -O ${SHIM_PKG}
ar x ${SHIM_PKG}
tar xvf data.tar.xz ./usr/lib/shim/shimx64.efi.dualsigned
snapcraftctl stage
prime: [ -* ]
It’s been working fine for us.
Our build pipeline uses ubuntu 20.04, which includes the focal-updates suite, the same as snapcraft build does with the multipass images.
We found that shim-signed was recently bumped in focal-updates, and the new version no longer Depends on the shim package.
It’s gone from:
shim-signed=1.40.4+15+1552672080.a4a1fbe-0ubuntu2
to
shim-signed=1.40.6+15.4-0ubuntu7
The gadget build now produces the situation I described here, where after intial image install the keys for the encrypted volumes aren’t unsealed: Debugging installation issue with secured image
The system installs without error [as far as I can tell ], but fails to extract the key from the TMP.
Adding the shim package manually to the gadget snap part did not seem to solve the issue.
After looking at the change log, I noticed that the shim-signed package now includes the parts of shim directly, and also includes the dualsigned efi shim. So I removed our hack that adds the dualsigned shim, still didn’t work, same error. Then I tried with only the new shim-signed package [ not including shim too ] , same error.
Currently the grub-prepare part looks like this:
grub-prepare:
plugin: nil
# Not required - we do this in the docker build image #
#build-snaps: [snapd/latest/edge]
build-packages:
- wget
stage-packages:
- grub-efi-amd64-signed
- grub-pc-bin
- shim
- shim-signed
- sbsigntool
prime: [ -* ]
Can anyone help here ? @ijohnson
The reference pc gadget on github hasn’t changed recently, so presumably that’s still using a version of shim-signed from the ppa.
@xnox I know you have worked on the pc gadget. Any ideas ?
Currently I’m out of ideas, but will try and go back to our hacked inclusion of the dualsigned shim, and the older shim-signed package from focal not in updates, 1.40.3+15+1533136590.3beb971-0ubuntu1
Cheers,
Just
