update to 2.04-1ubuntu47.4 drops zz-update-grub

[dann frazier]

[Impact]
New kernels don't appear in boot menu after install

[Test plan]
On a bionic VM, purge all grub and shim packages.

Test 1: Upgrade release EFI stack
- Install shim-signed with only release pocket
- Enable -updates and add the proposed package, and upgrade

Test 2: Upgrade broken EFI stack
- Install shim-signed with only release and updates pocket
- Upgrade grub2 binaries from proposed

Test 3: Install latest EFI stack
- Install shim-signed with release, updates, proposed grub2 enabled.

Test 1a: Upgrade hybrid release stack:
(same as 1, but install shim-signed and grub-pc)
Test 2a: Upgrade hybrid broken stack:
(same as 2, but install shim-signed and grub-pc)
Test 3a: Upgrade hybrid broken stack:
(same as 2, but install shim-signed and grub-pc)

In all cases check that no errors occur and the /etc/kernel/postinst.d/zz-update-grub script exists at the end.

Test 10: (grub2-unsigned)

Ensure that grub-efi-{amd64,arm64} binary cannot be installed with older grub2-common binary installed / pulls in new binary.

Test 20: (grub2-signed)

Ensure that grub-efi-{amd64,arm64}-signed binary cannot be installed with older grub2-common binary installed / pulls in new binary.

[Where problems could occur]
Could have missed a grub-.* binary or gotten the versions wrong and cause file conflicts.

[build in -security]
SRU is built in -security and binary copied to facilitate releasing the security update to grub2-unsigned that needs it.

[Original bug report]
A user reported that the GRUB menu was no longer being updated on a freshly deployed bionic system, and that this appears to be because /etc/kernel/postinst.d/zz-update-grub has disappeared.

# The version in the bionic-security pocket has it:
ubuntu@akis:~$ dpkg -c grub-efi-amd64_2.04-1ubuntu44.1.2_amd64.deb | grep zz
-rwxr-xr-x root/root 646 2021-03-03 11:42 ./etc/kernel/postinst.d/zz-update-grub
-rwxr-xr-x root/root 646 2021-03-03 11:42 ./etc/kernel/postrm.d/zz-update-grub

# The version in bionic-updates does not:
ubuntu@akis:~$ dpkg -c grub-efi-amd64_2.04-1ubuntu47.4_amd64.deb | grep zz
ubuntu@akis:~$

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Julian Andres Klode (juliank)]

This is a reintroduction of bug 1928674 because Steve fixed that locally in a grub2-unsigned upload in bionic that got overriden by a binary copy again because everybody forgot about that and you don't see it in testing because the conffiles stay around after upgrades I suppose.

We should move the files to grub2-common instead of reintroducing them in grub-efi-amd64 because while that's easier to reintroduce there, it's also more likely to get screwed up by more security uploads.

[Julian Andres Klode (juliank)]

So what we need is to move the files and adjust Breaks for this grub2-unsigned version and for unsignable targets, the version of the grub2 upload.

Then we should add Breaks from the grub2-unsigned package so that they also force an upgrade of the old version.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Francis Ginther (fginther)]

The workaround for this issue is to manually run 'sudo update-grub' after installing a new kernel.

[Julian Andres Klode (juliank)]

https://bileto.ubuntu.com/#/ticket/4950

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2 - 2.02-2ubuntu8.25

---------------
grub2 (2.02-2ubuntu8.25) bionic; urgency=medium

  [ Colin Watson ]
  * Move kernel maintainer script snippets into grub2-common (thanks,
    Bastian Blank; closes: #910959) (LP: #1995751)

 -- Julian Andres Klode <email address hidden> Tue, 15 Nov 2022 12:13:43 +0100

[Steve Langasek (vorlon)]

Hello dann, or anyone else affected,

Accepted grub2-unsigned into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2-unsigned/2.04-1ubuntu47.5 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Steve Langasek (vorlon)]

Hello dann, or anyone else affected,

Accepted grub2-signed into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/grub2-signed/1.173.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[dann frazier (dannf)]

= focal verification =
The verification steps required some tweaking to get them to work on focal. Where divergences were required, I've noted them with a "**Note**" below.

== Test 1 ==
ubuntu@ubuntu:~$ sudo apt install -y shim-signed
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following additional packages will be installed:
  grub-common grub-efi-amd64 grub-efi-amd64-bin grub-efi-amd64-signed grub2-common
  os-prober shim
Suggested packages:
  multiboot-doc grub-emu xorriso desktop-base
The following NEW packages will be installed:
  grub-common grub-efi-amd64 grub-efi-amd64-bin grub-efi-amd64-signed grub2-common
  os-prober shim shim-signed
0 upgraded, 8 newly installed, 0 to remove and 0 not upgraded.
Need to get 4597 kB of archives.
After this operation, 32.5 MB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu focal/main amd64 grub-common amd64 2.04-1ubuntu26 [1853 kB]
Get:2 http://archive.ubuntu.com/ubuntu focal/main amd64 grub-efi-amd64-bin amd64 2.04-1ubuntu26 [702 kB]
Get:3 http://archive.ubuntu.com/ubuntu focal/main amd64 grub2-common amd64 2.04-1ubuntu26 [589 kB]
Get:4 http://archive.ubuntu.com/ubuntu focal/main amd64 grub-efi-amd64 amd64 2.04-1ubuntu26 [46.6 kB]
Get:5 http://archive.ubuntu.com/ubuntu focal/main amd64 grub-efi-amd64-signed amd64 1.142+2.04-1ubuntu26 [468 kB]
Get:6 http://archive.ubuntu.com/ubuntu focal/main amd64 os-prober amd64 1.74ubuntu2 [20.1 kB]
Get:7 http://archive.ubuntu.com/ubuntu focal/main amd64 shim amd64 15+1533136590.3beb971-0ubuntu1 [575 kB]
Get:8 http://archive.ubuntu.com/ubuntu focal/main amd64 shim-signed amd64 1.40.3+15+1533136590.3beb971-0ubuntu1 [344 kB]
Fetched 4597 kB in 0s (13.3 MB/s)
Preconfiguring packages ...
Selecting previously unselected package grub-common.
(Reading database ... 63129 files and directories currently installed.)
Preparing to unpack .../0-grub-common_2.04-1ubuntu26_amd64.deb ...
Unpacking grub-common (2.04-1ubuntu26) ...
Selecting previously unselected package grub-efi-amd64-bin.
Preparing to unpack .../1-grub-efi-amd64-bin_2.04-1ubuntu26_amd64.deb ...
Unpacking grub-efi-amd64-bin (2.04-1ubuntu26) ...
Selecting previously unselected package grub2-common.
Preparing to unpack .../2-grub2-common_2.04-1ubuntu26_amd64.deb ...
Unpacking grub2-common (2.04-1ubuntu26) ...
Selecting previously unselected package grub-efi-amd64.
Preparing to unpack .../3-grub-efi-amd64_2.04-1ubuntu26_amd64.deb ...
Unpacking grub-efi-amd64 (2.04-1ubuntu26) ...
Selecting previously unselected package grub-efi-amd64-signed.
Preparing to unpack .../4-grub-efi-amd64-signed_1.142+2.04-1ubuntu26_amd64.deb ...
Unpacking grub-efi-amd64-signed (1.142+2.04-1ubuntu26) ...
Selecting previously unselected package os-prober.
Preparing to unpack .../5-os-prober_1.74ubuntu2_amd64.deb ...
Unpacking os-prober (1.74ubuntu2) ...
Selecting previously unselected package shim.
Preparing to unpack .../6-shim_15+1533136590.3beb971-0ubuntu1_amd64.deb ...
Unpacking shim (15+1533136590.3beb971-0ubuntu1) ...
Selecting previously unselected package shim-signed.
Preparing to unpack .../7-shim-signed_1.40.3+15+1533136590.3beb971-0ubuntu1_am...

[Launchpad Janitor (janitor)]

This bug was fixed in the package grub2-unsigned - 2.04-1ubuntu47.5

---------------
grub2-unsigned (2.04-1ubuntu47.5) focal; urgency=medium

  [ Chris Coulson ]
  * SECURITY UPDATE: Fix out of bounds writes due specially crafted fonts.
    - add debian/patches/font-Fix-several-integer-overflows-in-grub_font_construct.patch
    - add debian/patches/font-Fix-an-integer-underflow-in-blit_comb.patch
    - CVE-2022-2601, CVE-2022-3775
    - LP: #1996950
  * Fix various issues as a result of fuzzing, static analysis and code
    review:
    - add debian/patches/font-Reject-glyphs-exceeds-font-max_glyph_width-or-font-m.patch
    - add debian/patches/font-Fix-size-overflow-in-grub_font_get_glyph_internal.patch
    - add debian/patchces/font-Remove-grub_font_dup_glyph.patch
    - add debian/patches/font-Fix-integer-overflow-in-ensure_comb_space.patch
    - add debian/patches/font-Fix-integer-overflow-in-BMP-index.patch
    - add debian/patches/font-Fix-integer-underflow-in-binary-search-of-char-index.patch
    - add debian/patches/fbutil-Fix-integer-overflow.patch
    - add debian/patches/font-Harden-grub_font_blit_glyph-and-grub_font_blit_glyph.patch
    - add debian/patches/font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
    - add debian/patches/normal-charset-Fix-an-integer-overflow-in-grub_unicode_ag.patch
  * Forbid loading of external fonts when secure boot is enabled:
    - add debian/patches/font-Forbid-loading-of-font-files-when-secure-boot-is-ena.patch
  * Bundle unicode.pf2 in a squashfs memdisk attached to the signed EFI binary
    - update debian/control
    - update debian/build-efi-image
    - add debian/patches/font-Try-opening-fonts-from-the-bundled-memdisk.patch
  * Fix the squashfs tests during the build
    - remove debian/patches/ubuntu-fix-reproducible-squashfs-test.patch
    - add debian/patches/tests-Explicitly-unset-SOURCE_DATE_EPOCH-before-running-f.patch
  * Bump SBAT generation:
    - update debian/sbat.ubuntu.csv.in
  * Make grub-efi-{amd64,arm64} depend on grub2-common 2.02~beta2-36ubuntu3.33
    in xenial and 2.02-2ubuntu8.25 in bionic to fix LP: #1995751 (thanks
    Julian Klode for the base-files hack to make a single binary be able to
    depend on 2 different versions of the same package)

  [ dann frazier ]
  * linuxefi: Invalidate i-cache before starting the kernel (LP: #1987924)
    - d/p/linuxefi-Invalidate-i-cache-before-starting-the-kern.patch

  [ Chris Coulson ]
  * Source package generated from src:grub2 using make -f ./debian/rules
    generate-grub2-unsigned

 -- Chris Coulson <email address hidden> Thu, 17 Nov 2022 13:27:15 +0000

[Steve Langasek (vorlon)]

The verification of the Stable Release Update for grub2-unsigned has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.