Installing UC20 in Virtuabox triggers invalid signature after ubuntu-boot not found

[ogra]

i think with UC20 some special setup is required to build the pc gadget:

Creating custom image based on UC20

the security of FDE relies on inability to boot things that are not measured, which can fake a TPM prefix attack. Meaning if one trusts keys, that one cannot fully control there is risk that the owner of the key has signed something that may be abused to bypass FDE. Thus to achieve full FDE security, UC20 gadget uses shim signed by an Online UC20 key chained to Canonical controlled UC20 CA. Thus a device manufacturer can ship UC20 key in KEK & DB, and be sure of uncompromisable security of the…