classic installs on UEFI system don't install BIOS bootloader support

[Steve Langasek]

After install with the 20230825.2 canary image a classic install (no tpm fde) does not have the grub-pc-bin package installed.

This makes the resulting installed system unusable on a machine with BIOS instead of UEFI.

[Michael Hudson-Doyle (mwhudson)]

I'm sure this is true for the mantic desktop installer too.

[Steve Langasek (vorlon)]

Actually this bug was filed very specifically because it was a difference between the canary install and the desktop image!

[Michael Hudson-Doyle (mwhudson)]

Those logs are from an *unencrypted* core boot classic / hybrid install, which isn't supposed to be possible!

See the capability=<GuidedCapability.CORE_BOOT_UNENCRYPTED: 7> bit in:

GuidedChoiceV2(target=GuidedStorageTargetReformat(disk_id='disk-vda', allowed=[<GuidedCapability.CORE_BOOT_UNENCRYPTED: 7>, <GuidedCapability.DIRECT: 2>, <GuidedCapability.LVM: 3>, <GuidedCapability.LVM_LUKS: 4>, <GuidedCapability.ZFS: 5>], disallowed=[GuidedDisallowedCapability(capability=<GuidedCapability.CORE_BOOT_ENCRYPTED: 6>, reason=<GuidedDisallowedCapabilityReason.CORE_BOOT_ENCRYPTION_UNAVAILABLE: 2>, message='not encrypting device storage as checking TPM gave: not a supported EFI system')]), capability=<GuidedCapability.CORE_BOOT_UNENCRYPTED: 7>, sizing_policy=<SizingPolicy.ALL: 2>, reset_partition=False)

It's interesting that CORE_BOOT_UNENCRYPTED is the first element of allowed -- I guess this is another symptom of bug 2033244.

I'm also not surprised that this install did not boot under BIOS -- we should probably not allow it on a BIOS system (but the client is still being weird)

[Steve Langasek (vorlon)]

I think the difference in packages on the installed system is related to bug #2033115: in daily-live, the kernel and bootloader packages are installed in the standard layer, and in canary they're installed in the standard.live layer (and therefore are not part of the source copied to the rootfs).

So we might fix this bug by doing the linux+grub install in the standard layer and removing them in the enhanced-secureboot layer, instead of omitting them from the standard layer and including them in the live layer.

[Steve Langasek (vorlon)]

Ok so the question was raised about whether, with the new installer, it's possible to install the BIOS GRUB at all on a UEFI system because we don't create a separate GRUB partition.

After installing grub-pc-bin by hand:

# grub-install --target=i386-pc /dev/vda
Installing for i386-pc platform.
grub-install: warning: this GPT partition label contains no BIOS Boot partition; embedding won't be possible.
grub-install: warning: Embedding is not possible. GRUB can only be installed in this setup by using blocklists. However, blocklists are UNRELIABLE and their use is discouraged..
grub-install: error: will not proceed with blocklists.
# echo $?
1
#

The inability to boot an Ubuntu root disk in BIOS mode is not good, but that needs to be fixed in the installer to actually create the BIOS Boot partition before it's useful, and on a system with no BIOS Boot partition it doesn't matter if grub-pc-bin is installed.

So I'm taking this off the list of bugs for the landing of TPM support.