[SRU] [HWE] gnu-efi 3.0.15

[Julian Andres Klode]

[Impact]
gnu-efi 3.0.15 is required for fwupd-efi 1.4 to work correctly on firmware requiring NX memory in boot stack.

Updating gnu-efi also ensures that all our fwupd-efi 1.4 binaries ship the same code which makes it easier to reason about security vulnerabilities.

[Workflow]
gnu-efi is built in ppa:ubuntu-uefi-team/ubuntu/ppa against the security pocket only following the in-progress signed boot asset workflow.

[Target releases]
We are only building boot assets on the latest stable release, so will SRU that only to kinetic. Rebuilding the boot assets in older stable releases should still work though, they do not technically require gnu-efi 3.0.15 for building (fwupd-efi actually doesn't build due to debhelper 13 dependency).

The tasks have been set to Won't Fix on older releases to make this clear, but this is not a hard decision, if we fix fwupd-efi to build on those releases and it turns out we need gnu-efi 3.0.15 anyhow, we can still upload it, but of course this increases regression potential for those releases.

[Test plan]
We can't test the NX support yet as we do not have a shim with NX support. Test that fwupd-efi 1.4 builds. Also test and fix any reverse build depends regressions in the archive.

We will test NX support when we work on the NX supported shim.

[Where problems could occur]
To my knowledge, fwupd-efi is the only supported component in the archive that uses gnu-efi. Some more binaries are built with gnu-efi and might regress, e.g. systemd.

[Julian Andres Klode (juliank)]

All rebuilds have succeeded.

Rolling rebuild test log:

Identified reverse build depends in main:

* sbsigntool: PASS/amd64 PASS/riscv64 PASS/arm64 PASS/armhf
* syslinux (amd64-only): PASS
* systemd: PASS/amd64 PASS/riscv64 PASS/arm64 PASS/armhf PASS/i386

Initial amd64 and riscv64 test rebuilds performed by autopkgtest in a podman container, everything except riscv64 was also rebuildt in

https://launchpad.net/~ubuntu-uefi-team/+archive/ubuntu/rebuild-ppa/+packages

[Steve Langasek (vorlon)]

Hello Julian, or anyone else affected,

Accepted gnu-efi into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/gnu-efi/3.0.15-1~22.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Julian Andres Klode (juliank)]

I have issued test rebuilds for the universe packages in the same PPA

https://launchpad.net/~ubuntu-uefi-team/+archive/ubuntu/rebuild-ppa/+packages

[Julian Andres Klode (juliank)]

The additional test rebuilds completed sucessfully as well, except for kexec-tools on riscv64, which is not a regression, so marking as verified.

If you want to double check in the PPA, I want to note I did cancel the riscv64 builds for sbsigntool and systemd in there and had them built locally as especially for systemd the build time on riscv64 eats up lots of resources, so that was faster.

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for gnu-efi has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package gnu-efi - 3.0.15-1~22.10.1

---------------
gnu-efi (3.0.15-1~22.10.1) kinetic; urgency=medium

  * New upstream version 3.0.15 (LP: #2011804)

 -- Julian Andres Klode <email address hidden> Thu, 16 Mar 2023 10:45:06 +0100