Backport shim 15+1533136590.3beb971-0ubuntu1 to all supported releases

shim and shim-signed 15 / 1.37 are already in Cosmic.

Hello Mathieu, or anyone else affected,

Accepted shim-signed into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim-signed/1.37~18.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Verification-done for shim, shim-signed on bionic:

shim 15+1533136590.3beb971-0ubuntu1
shim-signed 1.37~18.04.1+15+1533136590.3beb971-0ubuntu1

System is booting as expected with the new shim, and mokutil allows for importing a certificate and enabling validation at the same time (or any multiple actions in MokManager).

Hello Mathieu, or anyone else affected,

Accepted shim-signed into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim-signed/1.33.1~16.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

The verification of the Stable Release Update for shim-signed has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package shim-signed - 1.37~18.04.1

---------------
shim-signed (1.37~18.04.1) bionic; urgency=medium

  * Backport shim-signed 1.37 to Ubuntu 18.04. (LP: #1790724)

 -- Mathieu Trudel-Lapierre <email address hidden> Tue, 04 Sep 2018 17:02:59 -0400

This SRU has been rolled back due to functional regressions that have been reported when chainloading from shim 15 to shim 13 in MAAS. Investigation is ongoing.

Regression reported: https://bugs.launchpad.net/maas/+bug/1711203

also reported: https://bugs.launchpad.net/bugs/1792564

sorry, https://bugs.launchpad.net/maas/+bug/1711203 is not the right bug for this regression.

Not a regression in shim -- shim is doing what it should, but exposes an actual latent bug in the grub2 EFI patchset. This is still in progress.

Re-release of this SRU is currently blocked on resolution of LP: #1792575 in grub2.

Hello Mathieu, or anyone else affected,

Accepted shim-signed into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim-signed/1.37~18.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Verification-done with shim 15+1533136590.3beb971-0ubuntu1 / shim-signed 1.37~18.04.2:

I have verified that the system boots correctly, can chainload to Windows 10, and that common tasks for mokutil (setting timeout, enrolling a key, toggling validation) are working as expected.

Marking verification-done.

This bug was fixed in the package shim-signed - 1.37~18.04.2

---------------
shim-signed (1.37~18.04.2) bionic; urgency=medium

  * debian/control: add Breaks: grub-efi-amd64-signed (<< 1.93.7), as the new
    version of shim exercises a bug in relocation code for chainload that was
    fixed in that upload of grub, affecting Windows 7, Windows 10, and some
    netboot scenarios where chainloading is required. (LP: #1792575)

shim-signed (1.37~18.04.1) bionic; urgency=medium

  * Backport shim-signed 1.37 to Ubuntu 18.04. (LP: #1790724)

shim-signed (1.37) cosmic; urgency=medium

  * Update to the signed 15+1533136590.3beb971-0ubuntu1 binary from Microsoft.
  * debian/real-po: replace debian/po to make sure things are translatable
    via Launchpad.

 -- Mathieu Trudel-Lapierre <email address hidden> Fri, 28 Sep 2018 11:02:56 -0400

Verification done on xenial:

ii shim 15+1533136590.3beb971-0ubuntu1
ii shim-signed 1.33.1~16.04.2+15+1533136590.3beb971-0ubuntu1

Verified that shim + shim-signed boot normally on a Xenial system. Timeout can be set (using a newer mokutil than is available on xenial), and certificates can be imported successfully.

This bug was fixed in the package shim-signed - 1.33.1~16.04.2

---------------
shim-signed (1.33.1~16.04.2) xenial; urgency=medium

  * Update to the signed 15+1533136590.3beb971-0ubuntu1 binary from Microsoft.
    (LP: #1790724)

 -- Mathieu Trudel-Lapierre <email address hidden> Wed, 05 Sep 2018 11:23:24 -0400

this has been temporarily rolled back from xenial because of the need for a matching grub update first.

The blocking bug is LP: #1792575.

Hello Mathieu, or anyone else affected,

Accepted shim-signed into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shim-signed/1.33.1~16.04.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Verification done on xenial:

ii shim 15+1533136590.3beb971-0ubuntu1
ii shim-signed 1.33.1~16.04.2+15+1533136590.3beb971-0ubuntu1

Verified that shim + shim-signed boot normally on a Xenial system. Timeout can be set (using a newer mokutil than is available on xenial), and certificates can be imported successfully.

Hey! Is this a typo that the version number of shim-signed is 1.33.1~16.04.2+15+1533136590.3beb971-0ubuntu1 ? I'd expect it to be 16.04.3 instead of 16.04.2. Could you just please confirm that the right version was tested?

It is indeed a typo, I copy-pasted the previous comment about verification (since it was the exact same thing, but indeed verified with 1.33.1~16.04.3+15+1533136590.3beb971-0ubuntu1 which includes the added depends for grub2.

This bug was fixed in the package shim-signed - 1.33.1~16.04.3

---------------
shim-signed (1.33.1~16.04.3) xenial; urgency=medium

  * debian/control: Depends: on grub2 2.02~beta2-36ubuntu3.20 to ensure shim
    cannot be installed without the new grub2 version that fixes chainloading
    issues. (LP: #1792575)

shim-signed (1.33.1~16.04.2) xenial; urgency=medium

  * Update to the signed 15+1533136590.3beb971-0ubuntu1 binary from Microsoft.
    (LP: #1790724)

 -- Mathieu Trudel-Lapierre <email address hidden> Tue, 11 Dec 2018 15:37:58 -0500