grub-efi-amd64-signed does not respect grub2/update_nvram

[Louis Sautier]

Hi,
Unlike grub-efi-amd64, grub-efi-amd64-signed doesn't respect the value of "grub2/update_nvram":
# debconf-show grub-efi-amd64 | grep grub2/update_nvram:
* grub2/update_nvram: false
# efibootmgr
BootCurrent: 0002
Timeout: 1 seconds
BootOrder: 0002,0003,0004,0007
Boot0002* UEFI: PXE IP4 P0 Intel(R) Ethernet Controller X550
Boot0003* UEFI: PXE IP4 P1 Intel(R) Ethernet Controller X550
Boot0004* UEFI: Built-in EFI Shell
Boot0007* UEFI: PXE IP4 P0 American Megatrends Inc.
# dpkg-reconfigure grub-efi-amd64-signed
Installing grub to /boot/efi.
Installing for x86_64-efi platform.
Installation finished. No error reported.
Installing grub to /var/lib/grub/esp.
Installing for x86_64-efi platform.
Installation finished. No error reported.
#
# debconf-show grub-efi-amd64 | grep grub2/update_nvram:
* grub2/update_nvram: false
# efibootmgr
BootCurrent: 0002
Timeout: 1 seconds
BootOrder: 0002,0003,0004,0007
Boot0002* UEFI: PXE IP4 P0 Intel(R) Ethernet Controller X550
Boot0003* UEFI: PXE IP4 P1 Intel(R) Ethernet Controller X550
Boot0004* UEFI: Built-in EFI Shell
Boot0007* UEFI: PXE IP4 P0 American Megatrends Inc.
# dpkg-reconfigure grub-efi-amd64-signed
Installing grub to /boot/efi.
Installing for x86_64-efi platform.
Installation finished. No error reported.
Installing grub to /var/lib/grub/esp.
Installing for x86_64-efi platform.
Installation finished. No error reported.
# efibootmgr
BootCurrent: 0002
Timeout: 1 seconds
BootOrder: 0000,0001,0002,0003,0004,0007
Boot0000* ubuntu
Boot0001* ubuntu
Boot0002* UEFI: PXE IP4 P0 Intel(R) Ethernet Controller X550
Boot0003* UEFI: PXE IP4 P1 Intel(R) Ethernet Controller X550
Boot0004* UEFI: Built-in EFI Shell
Boot0007* UEFI: PXE IP4 P0 American Megatrends Inc.

This is especially problematic as grub-efi-amd64-signed is a dependency of shim-signed, an essential package, making its removal slightly problematic.

From what I see, the postinst script is too simple: https://git.launchpad.net/~git-ubuntu-import/ubuntu/+source/grub2-signed/tree/debian/grub-efi-amd64-signed.postinst?h=import/1.180#n14

It should probably do something similar to grub-efi-amd64's postinst, i.e. run_grub_multi_install --target="$target" "$NO_EXTRA_REMOVABLE" "$NO_NVRAM"

I also noticed that Debian doesn't have a postinst script for grub-efi-amd64-signed so I don't have a problem there.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.