(trusty, debconf passthrough) package shim-signed 1.17~14.04.1+0.8-0ubuntu2 failed to install/upgrade: subprocess installed post-installation script returned error exit status 128

[Alexander Kukhta]

Just after upgrade.

ProblemType: Package
DistroRelease: Ubuntu 14.04
Package: shim-signed 1.17~14.04.1+0.8-0ubuntu2
ProcVersionSignature: Ubuntu 3.19.0-65.73~14.04.1-generic 3.19.8-ckt22
Uname: Linux 3.19.0-65-generic x86_64
ApportVersion: 2.14.1-0ubuntu3.21
Architecture: amd64
BootEFIContents:
 grub.cfg
 grubx64.efi
 MokManager.efi
 shimx64.efi
Date: Thu Jul 14 16:28:46 2016
DuplicateSignature: package:shim-signed:1.17~14.04.1+0.8-0ubuntu2:subprocess installed post-installation script returned error exit status 128
ErrorMessage: subprocess installed post-installation script returned error exit status 128
InstallationDate: Installed on 2015-10-02 (288 days ago)
InstallationMedia: Ubuntu 14.04.3 LTS "Trusty Tahr" - Beta amd64 (20150805)
RelatedPackageVersions:
 dpkg 1.17.5ubuntu5.7
 apt 1.0.1ubuntu2.14
SourcePackage: shim-signed
Title: package shim-signed 1.17~14.04.1+0.8-0ubuntu2 failed to install/upgrade: subprocess installed post-installation script returned error exit status 128
UpgradeStatus: No upgrade log present (probably fresh install)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Russell Jones (russell-jones-oxphys)]

The default is to disable secureboot. However, this requires a password to be set. These defaults seem contradictory when used with DEBIAN_FRONTEND=noninteractive. We use noninteractive mode (along with some other options-- I'll be investigating further tomorrow) to install systems, and the package gets stuck in an infinite loop. From the output of apt-extracttemplates:

Template: shim/disable_secureboot
Type: boolean
Default: true
Description: Disable UEFI Secure Boot?
 If Secure Boot remains enabled on your system, your system may still boot but
 any hardware that requires third-party drivers to work correctly may not be
 usable.

Template: shim/enable_secureboot
Type: boolean
Default: false
Description: Enable UEFI Secure Boot?
 If Secure Boot is enabled on your system, your system may still boot but
 any hardware that requires third-party drivers to work correctly may not be
 usable.

Template: shim/secureboot_key
Type: string
Description: Enter a password for Secure Boot. It will be asked again after a reboot.

Template: shim/secureboot_key_again
Type: string
Description: Enter the same password again to verify you have typed it correctly.

[Russell Jones (russell-jones-oxphys)]

In case it's relevant, the other options to force non-interactive install were in /etc/apt/apt.conf
APT::Get::Show-Upgraded "true";
DPkg::Options {"--force-confmiss";"--force-confold"};

We appear to have worked around it by adding

shim-signed shim/disable_secureboot boolean false
shim-signed shim/enable_secureboot boolean true

in the preseed file.