ubiquity prompts for a MOK password that it then does not use

[Steve Langasek]

When opting to install non-free drivers on my new laptop, ubiquity tells me that:

  Installing third-party drivers requires configuring Secure Boot. To do this,
  you need to choose a security key now, and enter it when the system restarts.

And it forces me to choose a password.

However, the only hardware on my system that has non-free drivers is nvidia; and thanks to linux-restricted-modules, it should not be necessary to use locally-built dkms modules for nvidia (but see also https://bugs.launchpad.net/ubuntu/+source/linux-restricted-modules/+bug/1856407).

I should not be prompted to create another password for a thing before we know it's actually going to be needed / used. This means ubiquity should know to only prompt for a password and invoke mokutil if proprietary drivers other than linux-modules-nvidia will actually be installed.

Also, note that the unlike ubiquity, dkms/shim-signed debconf handling of the secureboot does not use a 'password' field type. This is not a sensitive password that must be kept secret, it is only used to prove to MokManager when running from UEFI that the key enrollment request came from the person who has physical control of the hardware and is used one time, then discarded. So there's really no need to hide the text being entered in this field.

[Didier Roche-Tolomelli (didrocks)]

Confirming

[Dimitri John Ledkov (xnox)]

1) ubiquity already does list-oem which can query from ubuntu-drivers-common if any oem stuff needs to happen

2) ubuntu-drivers-common should provide '--package-list' option on the regular list command too

3) this way ubiquity can run 'list' with '--package-list' ahead of the prepare stage to peak, if any dkms modules would get installed.

4) then ubiquity would be able to show the right ui when people tick third-party drivers, i.e. determine if mok is needed or not.

5) under secureboot however, I don't think ubiquity should be trying to install any dkms drivers as they will all fail to load. Thus it can even skip calling `install` on them altogether.