efi encrypted /boot grub installation does not include crypto support

[Jon Hood]

Installing with full disk encryption, including /boot, resulted in the following error after grub loaded: "error: Can't find command 'cryptomount'"

This is identical to the OpenSUSE bug identified at https://forums.opensuse.org/showthread.php/511111

Including an efi, secureboot grub image that is capable of encrypted /boot filesystem mounting is essential for securing the desktop. I see this issue as a prerequisite for bug #1773457.

OpenSUSE resolved this issue by including crypto support in their .efi grub images. I believe that this should be the default for Ubuntu as well, or an additional crypto-enabled grub efi package should be made available.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Brian Murray (brian-murray)]

This may be a duplicate of bug 1565950. What version of Ubuntu were you trying to install where you encountered this?

[fantasticfears (fantasticfears)]

ubuntu 18.04.3 LTS has this issue. I'm not interested in secure boot but encrypted /boot. The grub package points to grub2-common (2.02-2ubuntu8.13). Even with the update detailed in the other post, the problem still exists. I can't load cryptomount and ubuntu starts with only grub shell.

[Jon Hood (squinky86)]

(replying to #2)
Sorry, I didn't see your reply earlier. This could be argued either way as a separate issue or not, but most importantly, the fix for bug 1565950 will also resolve this issue.

For example, if I install vmware and their unsigned kernel modules, I wouldn't be able to use secure boot but may still want an encrypted /boot partition. I had separated out the secure boot aspect from the encrypted /boot aspect.

I'm ok if you want to consolidate these issues by resolving this as a duplicate with the acknowledgement that this is a specific issue (specifically the cryptomount portion) of one aspect of bug 1565950.