Generate per-machine MOK for dkms signing

[Mathieu Trudel-Lapierre]

shim-signed's update-secureboot-policy should allow creating a machine-owner key, and using this for signing kernel modules built via DKMS. Key generation and enrolling should be made as easy as possible for users.

[Mathieu Trudel-Lapierre (cyphermox)]

There are dkms changes and shim-signed changes for this. I'm linking both.

[Mathieu Trudel-Lapierre (cyphermox)]

dkms changes in debdiff format. There didn't seem to be a code branch for dkms specific to Ubuntu.

[Mathieu Trudel-Lapierre (cyphermox)]

https://code.launchpad.net/~ubuntu-core-dev/shim/+git/shim-signed/+ref/self-signed

[Mathieu Trudel-Lapierre (cyphermox)]

I'm uploading things now; let's keep them blocked in proposed just long enough that I have the time for one last test before it reaches everyone.

[Steve Langasek (vorlon)]

Hello Mathieu, or anyone else affected,

Accepted dkms into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dkms/2.3-3ubuntu7 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Steve Langasek (vorlon)]

we really ought to fix those scripts to not do the bug tampering for devel ;)

[Steve Langasek (vorlon)]

This has been in -proposed for 4 days now, and there have been multiple bug reports in that time from users who have -proposed enabled - but none against the latest version which has been in -proposed for 24h+. Dropping the block-proposed tag now to let this migrate.

[Launchpad Janitor (janitor)]

This bug was fixed in the package shim-signed - 1.34.4

---------------
shim-signed (1.34.4) bionic; urgency=medium

  * Handle the case that there are no kernel modules available for a given
    dkms package. This probably indicates there is a problem with the dkms
    module's installation, but that should not cause this package's
    installation to fail. LP: #1765954.

 -- Steve Langasek <email address hidden> Sat, 21 Apr 2018 10:13:41 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package dkms - 2.3-3ubuntu7

---------------
dkms (2.3-3ubuntu7) bionic; urgency=medium

  * 0009-Add-support-for-UEFI-Secure-Boot-validation-toggling.patch: update
    for the new update-secureboot-policy code: have it generate a new MOK if
    there isn't one yet, and use that so sign newly-built kernel modules.
    (LP: #1748983)

 -- Mathieu Trudel-Lapierre <email address hidden> Wed, 18 Apr 2018 17:23:41 -0400