Spurious conffile prompts for /etc/default/grub

[Daniel Richard G.]

[Impact]
All users of Ubuntu, especially on updates of the grub packages. (Grub is used nearly everywhere to boot)

[Test case]
== Upgrade prompting ==
0) Install Ubuntu
1) Modify /usr/share/grub/default/grub options
2) Run 'sudo apt install --reinstall grub-pc ((or grub-efi-amd64))

Verify that the user IS prompted to approve grub.cfg changes due to changes in the template coming from the process.

== User-specified changes ==
0) Install Ubuntu
1) Modify /etc/default/grub.cfg options
2) Update grub to the new package

Verify that the user is not prompted to approve grub.cfg changes unless the grub2 package unless the grub packages have changed the contents of the default grub.cfg.

== Post-deployment upgrades on MAAS-controlled system ==
0) Deploy a system using MAAS
1) Update grub to the new package

Verify that the user is not prompted to approve grub.cfg changes unless the grub2 package unless the grub packages have changed the contents of the default grub.cfg.

[Regression potential]
Pay attention to prompting behavior on grub updates as well as any failure to update the grub* packages. Prompting should be limited to the cases where the grub2 source package has changed the contents for the default provided grub.cfg; and on MAAS-controlled systems, the local modifications have changed in some way from the original copy of grub2 installed on the system.

---

Binary package hint: grub-pc

This concerns grub-pc 1.98-1ubuntu5 in Lucid beta1 (upgrading from 1.98-1ubuntu4).

I have a locally modified /etc/default/grub file. When I upgraded to this version of grub-pc, I got the "A new version of configuration file /etc/default/grub is available, but the version installed currently has been locally modified. What do you want to do about modified configuration file grub?" question.

The problem is, when I look at the diff, it just shows the differences between my file, and the way it was originally. In other words, the upgraded package does not include any updates to this file; its "pristine" copy of /etc/default/grub is the same as the previous version's. So I shouldn't even be getting a conffile prompt in the first place---as far as the administrator is concerned, nothing has changed.

[Daniel Richard G. (skunk)]

Scott, thank you for providing the script, and the analysis that led to it. I've run into this issue numerous times but have not been able to suss out exactly what leads to it such that it can be reproduced.

I've linked a relevant Debian bug, which appears to address the same issue, and was filed more recently.

[Scott Moser (smoser)]

As a comment (from the header in the reproduce script)

# The problem is that the user will be prompted with a dialog:
# What do you want to do about modified configuration file grub?
# even when there is no upstream change to the config file if they
# have made *both*:
# a. changes to grub-pc.postinst fields:
# GRUB_CMDLINE_LINUX, GRUB_CMDLINE_LINUX_DEFAULT, GRUB_TIMEOUT,
# GRUB_HIDDEN_TIMEOUT
# b. any other changes

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2 - 2.02+dfsg1-12ubuntu1

---------------
grub2 (2.02+dfsg1-12ubuntu1) disco; urgency=medium

  * Merge against Debian unstable; remaining changes (LP: #564853):
    - debian/control: Update Vcs fields for code location on Ubuntu.
    - debian/control: Breaks shim (<< 13).
    - Secure Boot support: use newer patchset from rhboot repo:
      - many linuxefi_* patches added and modified
      - dropped debian/patches/linuxefi_require_shim.patch
      - renamed: debian/patches/no_insmod_on_sb.patch ->
        debian/patches/linuxefi_no_insmod_on_sb.patch
    - debian/patches/install_signed.patch, grub-install-extra-removable.patch:
      - Make sure if we install shim; it should also be exported as the default
        bootloader to install later to a removable path, if we do.
      - Rework grub-install-extra-removable.patch to reverse its logic: in the
        default case, install the bootloader to /EFI/BOOT, unless we're trying
        to install on a removable device, or explicitly telling grub *not* to
        do it.
      - Install a BOOT.CSV for fallback to use.
      - Make sure postinst and templates know about the replacement of
        --force-extra-removable with --no-extra-removable.
    - debian/patches/add-an-auto-nvram-option-to-grub-install.patch: Add the
      --auto-nvram option to grub-install for auto-detecting NVRAM availability
      before attempting NVRAM updates.
    - debian/build-efi-images: provide a new grub EFI image which enforces that
      loaded kernels are signed for Secure Boot: build gsb$arch.efi; which is
      the same as grub$arch.efi minus the 'linux' module. Without fallback to
      'linux' for unsigned loading, this makes it effectively enforce having a
      signed kernel.
    - Verify that the current and newer kernels are signed when grub is
      updated, to make sure people do not accidentally shutdown without a
      signed kernel.
    - debian/default/grub: replace GRUB_HIDDEN_* variables with the less
      confusing GRUB_TIMEOUT_STYLE=hidden.
    - debian/patches/support_initrd-less_boot.patch: Added knobs to allow
      non-initrd boot config.
    - Disable os-prober for ppc64el on the PowerNV platform, to reduce the
      number of entries/clutter from other OSes in Petitboot
    - debian/patches/shorter_version_info.patch: Only show the upstream version
      in menu and console, and hide the package one in a package_version
      variable.
    - debian/patches/skip_text_gfxpayload_where_not_supported.patch: Skip the
      'text' payload if it's not supported but present in gfxpayload, such as
      on EFI systems.
    - debian/patches/bufio_sensible_block_sizes.patch: Don't use arbitrary file
      fizes as block sizes in bufio: this avoids potentially seeking back in
      the files unnecessarily, which may require re-open files that cannot be
      seeked into, such as via TFTP.
    - debian/patches/ofnet-init-structs-in-bootpath-parser.patch: initialize
      structs in bootpath parser.
    - debian/rules: shuffle files around for now to keep build artefacts
      for signing at the same location as they were expected by Launchpad.
    - debian/ru...

[Brian Murray (brian-murray)]

Could you add a test case for the user getting prompted to approve grub.cfg changes? I think we should make sure that still works.

[Brian Murray (brian-murray)]

Hello Daniel, or anyone else affected,

Accepted grub2 into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2/2.02+dfsg1-5ubuntu8.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello Daniel, or anyone else affected,

Accepted grub2-signed into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2-signed/1.110.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello Daniel, or anyone else affected,

Accepted grub2 into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2/2.02-2ubuntu8.13 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello Daniel, or anyone else affected,

Accepted grub2-signed into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2-signed/1.93.14 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Mathieu Trudel-Lapierre (cyphermox)]

Verification-done on bionic:

ubuntu@brave-elf:~$ dpkg -l grub\* | grep ii
ii grub-common 2.02-2ubuntu8.13 amd64 GRand Unified Bootloader (common files)
ii grub-gfxpayload-lists 0.7 amd64 GRUB gfxpayload blacklist
ii grub-pc 2.02-2ubuntu8.13 amd64 GRand Unified Bootloader, version 2 (PC/BIOS version)
ii grub-pc-bin 2.02-2ubuntu8.13 amd64 GRand Unified Bootloader, version 2 (PC/BIOS binaries)
ii grub2-common 2.02-2ubuntu8.13 amd64 GRand Unified Bootloader (common files for version 2)

With the new version, the changes that previously triggered a conffile prompt now no longer do; using changes made manually to the grub.cfg file or using the reproducer script provided by Scott.

[Mathieu Trudel-Lapierre (cyphermox)]

Verification-done for cosmic:

ubuntu@noted-fish:~$ dpkg -l grub\* | grep ii
ii grub-common 2.02+dfsg1-5ubuntu8.3 amd64 GRand Unified Bootloader (common files)
ii grub-efi-amd64 2.02+dfsg1-5ubuntu8.3 amd64 GRand Unified Bootloader, version 2 (EFI-AMD64 version)
ii grub-efi-amd64-bin 2.02+dfsg1-5ubuntu8.3 amd64 GRand Unified Bootloader, version 2 (EFI-AMD64 binaries)
ii grub-efi-amd64-signed 1.110.3+2.02+dfsg1-5ubuntu8.3 amd64 GRand Unified Bootloader, version 2 (EFI-AMD64 version, signed)
ii grub2-common 2.02+dfsg1-5ubuntu8.3 amd64 GRand Unified Bootloader (common files for version 2)

As for bionic; with the new version, there are no conffile prompts for the same grub.cfg manipulations that would have normally resulted from a prompt.

[Brian Murray (brian-murray)]

irc logs regarding some confusion regarding verification of this bug:

08:58 < bdmurray> cyphermox: it looks like you only verified 1 of the three
                  test cases in bug 564853
08:58 < ubot5`> bug 564853 in grub2-signed (Ubuntu Cosmic) "Spurious conffile
                prompts for /etc/default/grub" [Undecided,Fix committed]
                https://launchpad.net/bugs/564853
08:59 < cyphermox> bdmurray: err, no; I tested forcing to get a prompt, and the
                   two different ways you normally should have had one and now
                   won't.
09:01 < bdmurray> "the changes that previously triggered a conffile prompt now
                  no longer do;"
09:02 < bdmurray> that's only one (okay two) right?
09:03 < cyphermox> bdmurray: I'm not sure I follow what you mean
09:03 < cyphermox> there are three different cases; one is maas-deployed,
                   that's how I was deploying the systems to begin with
09:04 < cyphermox> there's people changing /etc/default/grub and triggering
                   debconf prompts; I did this as well
09:04 < cyphermox> and you can further muck with the files to reproduce the
                   case where you /should/ be getting a prompt (ie. we changed
                   our default settings)

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for grub2 has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2 - 2.02+dfsg1-5ubuntu8.3

---------------
grub2 (2.02+dfsg1-5ubuntu8.3) cosmic; urgency=medium

   * debian/build-efi-images: add HTTP to generated UEFI images. (LP: #1787630)
   * debian/config.in, debian/grub-common.dirs, debian/postinst.in,
     debian/postrm.in: cherry-pick Colin's changes to ucf handling from
     2.02+dfsg1-11 to avoid unnecessarily prompting about grub.cfg changes.
     (LP: #564853)

 -- Mathieu Trudel-Lapierre <email address hidden> Mon, 18 Mar 2019 12:01:26 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2-signed - 1.110.3

---------------
grub2-signed (1.110.3) cosmic; urgency=medium

  * Rebuild against grub2 2.02+dfsg1-5ubuntu8.3. (LP: #1787630) (LP: #564853)

 -- Mathieu Trudel-Lapierre <email address hidden> Mon, 18 Mar 2019 14:16:34 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2 - 2.02-2ubuntu8.13

---------------
grub2 (2.02-2ubuntu8.13) bionic; urgency=medium

   * debian/build-efi-images: add HTTP to generated UEFI images. (LP: #1787630)
   * debian/config.in, debian/grub-common.dirs, debian/postinst.in,
     debian/postrm.in: cherry-pick Colin's changes to ucf handling from
     2.02+dfsg1-11 to avoid unnecessarily prompting about grub.cfg changes.
     (LP: #564853)

 -- Mathieu Trudel-Lapierre <email address hidden> Mon, 18 Mar 2019 12:11:57 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2-signed - 1.93.14

---------------
grub2-signed (1.93.14) bionic; urgency=medium

  * Rebuild against grub2 2.02-2ubuntu8.13. (LP: #1787630) (LP: #564853)

 -- Mathieu Trudel-Lapierre <email address hidden> Mon, 18 Mar 2019 14:24:36 -0400