Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1250896 > unrolled thread

Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10 Luca Boccassi <bluca@debian.org> - 2025-06-23 19:40 +0200
    Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10 Luca Boccassi <bluca@debian.org> - 2025-06-25 12:50 +0200
    Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10 Cyril Brulebois <kibi@debian.org> - 2025-06-25 13:10 +0200
    Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10 Paul Gevers <elbrus@debian.org> - 2025-06-26 20:40 +0200
    Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10 Paul Gevers <elbrus@debian.org> - 2025-06-26 20:50 +0200
      Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10 Luca Boccassi <bluca@debian.org> - 2025-06-26 20:50 +0200
        Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10 Luca Boccassi <bluca@debian.org> - 2025-06-30 14:30 +0200
          Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10 Luca Boccassi <bluca@debian.org> - 2025-07-03 02:00 +0200
    Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10 Luca Boccassi <bluca@debian.org> - 2025-07-03 19:00 +0200
    Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10 Julian Andres Klode <jak@debian.org> - 2025-07-03 19:10 +0200

#1250896 — Bug#1108231: unblock: shim-signed/1.46 systemd-boot-installer/0.10

[Multipart message — attachments visible in raw view] — view raw

Package: release.debian.org
Severity: normal
Control: affects -1 + src:shim-signed src:systemd-boot-installer
Debbugs-Cc: debian-efi@lists.debian.org debian-boot@lists.debian.org
User: release.debian.org@packages.debian.org
Usertags: unblock

Dear RT,

The latest upload of shim-signed allows alternative dependencies on
the systemd-boot signed packages. The latest upload of
systemd-boot-installer makes use of this to pull in shim-signed when
systemd-boot is chosen as the bootloader in the expert option of d-i.
These are the last bits needed to provide sdboot as a fully fledged
alternative choice, so we'd like to have these in Trixie, please,
hence filing a single unblock bug.

The changes in shim-signed are minimal - just alternative secondary
dependencies for each grub package that it depends upon. There is also
a translation update.

The changes in systemd-boot-installer (d-i component) are also
minimal, pulling in shim-signed on amd64/arm64. It also adds support
for loong64 and a few translation updates.

Debdiffs attached. Thanks!

[toc] | [next] | [standalone]

#1251029

On Mon, 23 Jun 2025 18:29:22 +0100 Luca Boccassi <bluca@debian.org>
wrote:
> Package: release.debian.org
> Severity: normal
> Control: affects -1 + src:shim-signed src:systemd-boot-installer
> Debbugs-Cc: debian-efi@lists.debian.org debian-boot@lists.debian.org
> User: release.debian.org@packages.debian.org
> Usertags: unblock
> 
> Dear RT,
> 
> The latest upload of shim-signed allows alternative dependencies on
> the systemd-boot signed packages. The latest upload of
> systemd-boot-installer makes use of this to pull in shim-signed when
> systemd-boot is chosen as the bootloader in the expert option of d-i.
> These are the last bits needed to provide sdboot as a fully fledged
> alternative choice, so we'd like to have these in Trixie, please,
> hence filing a single unblock bug.
> 
> The changes in shim-signed are minimal - just alternative secondary
> dependencies for each grub package that it depends upon. There is
also
> a translation update.
> 
> The changes in systemd-boot-installer (d-i component) are also
> minimal, pulling in shim-signed on amd64/arm64. It also adds support
> for loong64 and a few translation updates.
> 
> Debdiffs attached. Thanks!

Not sure this made it to the cced lists, paging Cyril just in case it
didn't

[toc] | [prev] | [next] | [standalone]

#1251031

[Multipart message — attachments visible in raw view] — view raw

Hi,

Luca Boccassi <bluca@debian.org> (2025-06-23):
> Package: release.debian.org
> Severity: normal
> Control: affects -1 + src:shim-signed src:systemd-boot-installer
> Debbugs-Cc: debian-efi@lists.debian.org debian-boot@lists.debian.org
                                         ↑ missing comma
> User: release.debian.org@packages.debian.org
> Usertags: unblock

(Answering your follow-up: I haven't seen this reach debian-boot@)

> The latest upload of shim-signed allows alternative dependencies on
> the systemd-boot signed packages. The latest upload of
> systemd-boot-installer makes use of this to pull in shim-signed when
> systemd-boot is chosen as the bootloader in the expert option of d-i.
> These are the last bits needed to provide sdboot as a fully fledged
> alternative choice, so we'd like to have these in Trixie, please,
> hence filing a single unblock bug.
> 
> The changes in shim-signed are minimal - just alternative secondary
> dependencies for each grub package that it depends upon. There is also
> a translation update.

I'll let others comment on/review this.

> The changes in systemd-boot-installer (d-i component) are also
> minimal, pulling in shim-signed on amd64/arm64. It also adds support
> for loong64 and a few translation updates.

I only glanced at it when I saw your heads-up mail about the upload
(thanks for that) come in, and that seemed reasonable. It's on my
radar[1] and I'll review/unblock it before finalizing Trixie RC 2.

 1. https://d-i.debian.org/testing-summary.html


Cheers,
-- 
Cyril Brulebois (kibi@debian.org)            <https://debamax.com/>
D-I release manager -- Release team member -- Freelance Consultant

[toc] | [prev] | [next] | [standalone]

#1251161

[Multipart message — attachments visible in raw view] — view raw

Control: tags -1 moreinfo

Hi,

On 23-06-2025 19:29, Luca Boccassi wrote:
> The latest upload of shim-signed allows alternative dependencies on
> the systemd-boot signed packages.


Reading the MR related to this change [1] I got the impression that the 
bookworm branch of src:grub2 needs to land in bookworm first to prevent 
the risks of apt removing the bootloader. AFAICT this didn't happen yet. 
What's the plan here?

Paul

[1] https://salsa.debian.org/efi-team/shim-signed/-/merge_requests/3

[toc] | [prev] | [next] | [standalone]

#1251162

[Multipart message — attachments visible in raw view] — view raw

[re-sending because I got the grub2 mail address wrong]

Control: tags -1 moreinfo

Hi,

On 23-06-2025 19:29, Luca Boccassi wrote:
> The latest upload of shim-signed allows alternative dependencies on
> the systemd-boot signed packages.


Reading the MR related to this change [1] I got the impression that the 
bookworm branch of src:grub2 needs to land in bookworm first to prevent 
the risks of apt removing the bootloader. AFAICT this didn't happen yet. 
What's the plan here?

Paul

[1] https://salsa.debian.org/efi-team/shim-signed/-/merge_requests/3

[toc] | [prev] | [next] | [standalone]

#1251164

On Thu, 26 Jun 2025 at 19:41, Paul Gevers <elbrus@debian.org> wrote:
>
> [re-sending because I got the grub2 mail address wrong]
>
> Control: tags -1 moreinfo
>
> Hi,
>
> On 23-06-2025 19:29, Luca Boccassi wrote:
> > The latest upload of shim-signed allows alternative dependencies on
> > the systemd-boot signed packages.
>
>
> Reading the MR related to this change [1] I got the impression that the
> bookworm branch of src:grub2 needs to land in bookworm first to prevent
> the risks of apt removing the bootloader. AFAICT this didn't happen yet.
> What's the plan here?

IIRC that was waiting for this:

https://salsa.debian.org/grub-team/grub/-/merge_requests/77

Julian and Mate still waiting on that one before uploading to bookworm-p-u?

[toc] | [prev] | [next] | [standalone]

#1251460

Control: tags -1 -moreinfo

On Thu, 26 Jun 2025 at 19:42, Luca Boccassi <bluca@debian.org> wrote:
>
> On Thu, 26 Jun 2025 at 19:41, Paul Gevers <elbrus@debian.org> wrote:
> >
> > [re-sending because I got the grub2 mail address wrong]
> >
> > Control: tags -1 moreinfo
> >
> > Hi,
> >
> > On 23-06-2025 19:29, Luca Boccassi wrote:
> > > The latest upload of shim-signed allows alternative dependencies on
> > > the systemd-boot signed packages.
> >
> >
> > Reading the MR related to this change [1] I got the impression that the
> > bookworm branch of src:grub2 needs to land in bookworm first to prevent
> > the risks of apt removing the bootloader. AFAICT this didn't happen yet.
> > What's the plan here?
>
> IIRC that was waiting for this:
>
> https://salsa.debian.org/grub-team/grub/-/merge_requests/77
>
> Julian and Mate still waiting on that one before uploading to bookworm-p-u?

Julian says on Matrix:

> we don't technically need the backport in stable for testing, apt applies the Protected: yes at a package level, and will accordingly refuse to move grub from stable because the flag is set in the testing one

So I believe we don't need to wait for a grub upload in order to have
shim-signed unblocked. Thanks.

[toc] | [prev] | [next] | [standalone]

#1251703

On Mon, 30 Jun 2025 13:20:13 +0100 Luca Boccassi <bluca@debian.org>
wrote:
> Control: tags -1 -moreinfo
> 
> On Thu, 26 Jun 2025 at 19:42, Luca Boccassi <bluca@debian.org> wrote:
> >
> > On Thu, 26 Jun 2025 at 19:41, Paul Gevers <elbrus@debian.org>
wrote:
> > >
> > > [re-sending because I got the grub2 mail address wrong]
> > >
> > > Control: tags -1 moreinfo
> > >
> > > Hi,
> > >
> > > On 23-06-2025 19:29, Luca Boccassi wrote:
> > > > The latest upload of shim-signed allows alternative
dependencies on
> > > > the systemd-boot signed packages.
> > >
> > >
> > > Reading the MR related to this change [1] I got the impression
that the
> > > bookworm branch of src:grub2 needs to land in bookworm first to
prevent
> > > the risks of apt removing the bootloader. AFAICT this didn't
happen yet.
> > > What's the plan here?
> >
> > IIRC that was waiting for this:
> >
> > https://salsa.debian.org/grub-team/grub/-/merge_requests/77
> >
> > Julian and Mate still waiting on that one before uploading to
bookworm-p-u?
> 
> Julian says on Matrix:
> 
> > we don't technically need the backport in stable for testing, apt
applies the Protected: yes at a package level, and will accordingly
refuse to move grub from stable because the flag is set in the testing
one
> 
> So I believe we don't need to wait for a grub upload in order to have
> shim-signed unblocked. Thanks.

systemd-boot-installer has been pulled into testing (and into D-I RC2),
but shim-signed wasn't, despite the single unblock ticket grouping
them. So now the functionality is broken in D-I RC2. If possible, it
would be great if this was processed soon, to unbreak it, please.

Thanks!

[toc] | [prev] | [next] | [standalone]

#1251761

On Thu, 3 Jul 2025 at 17:52, Paul Gevers <elbrus@debian.org> wrote:
>
> Hi,
>
> On 03-07-2025 01:55, Luca Boccassi wrote:
> > systemd-boot-installer has been pulled into testing (and into D-I RC2),
> > but shim-signed wasn't, despite the single unblock ticket grouping
> > them. So now the functionality is broken in D-I RC2.
>
>
> Does this mean there's a versioned dependency missing?

It's a udeb, it can't and shouldn't have a dependency on a non-udeb
package that gets installed in the target, no? It's an installer
script that installs the package in the installed target

[toc] | [prev] | [next] | [standalone]

#1251762

[Multipart message — attachments visible in raw view] — view raw

On Thu, Jul 03, 2025 at 06:46:05PM +0200, Paul Gevers wrote:
> Hi Julian,
> 
> On 30-06-2025 14:20, Luca Boccassi wrote:
> > On Thu, 26 Jun 2025 at 19:42, Luca Boccassi <bluca@debian.org> wrote:
> > > On Thu, 26 Jun 2025 at 19:41, Paul Gevers <elbrus@debian.org> wrote:
> > > > Reading the MR related to this change [1] I got the impression that the
> > > > bookworm branch of src:grub2 needs to land in bookworm first to prevent
> > > > the risks of apt removing the bootloader. AFAICT this didn't happen yet.
> > > > What's the plan here?
> 
> > Julian says on Matrix:
> > 
> > > we don't technically need the backport in stable for testing, apt applies the Protected: yes at a package level, and will accordingly refuse to move grub from stable because the flag is set in the testing one
> 
> 
> You sounded quite concerned in [2] but the information in the quote above
> doesn't sound like it's new information to you. What made you change you
> mind?

I did not consider that Essential and Protected are evaluated by apt at
the package level rather than the version level :D

It just occured to me again when Luca pinged me :D

-- 
debian developer - deb.li/jak | jak-linux.org - free software dev
ubuntu core developer                              i speak de, en

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web