grub-efi-amd64-signed should depends on mokutil

[Yuan-Chen Cheng]

as turn on secure boot, the postinst script to do configure will call mokutils. if mokutils is not installed, it will fail.

Base on that, maybe grub-efi-amd64-signed should depend on mokutils.

The postinst script call /usr/share/grub/grub-check-signatures from grub-common package. grub-check-signatures call mokutils to extract key and use the key to check if then kernel is properly signed.

[Yuan-Chen Cheng (ycheng-twn)]

per $4:

grub-efi-amd64-signed's postinst will execute /usr/share/grub/grub-check-signatures when Secure Boot is on, and then it will execute mokutil no matter there is any DKMS or not.

[Ivan Hu (ivan.hu)]

What does grub-check-signatures use mokutil for?
It makes more sense mokutil depends on shim not grub.
Can mokutil depend on shim package solve your issue?

[Shih-Yuan Lee (fourdollars)]

This issue happens when installing grub-efi-amd64-signed while the image still using old mokutil so it is better to fix the issue directly in grub-efi-amd64-signed.

[Yuan-Chen Cheng (ycheng-twn)]

@Ivan, I update how grub-check-signatures use mokutils in bug description.
Can you please check again?

[Ivan Hu (ivan.hu)]

shim-signed package has already depended on mokutil.
When secureboot enabled, shim is needed and mokutil should be installed.

[Yuan-Chen Cheng (ycheng-twn)]

per code in ubiquity:/usr/share/grub-installer/grub-installer
it install grub-efi-amd64-signed first, and then install shim-signed.
(grub_package=grub-efi-amd64-signed as the code run to here.)
===
        apt-install $grub_package || exit_code=$?
        case $grub_package in
            *-signed)
                apt-install shim-signed || true
                apt-install grub-pc || true
                ;;
        esac
===