This bug was fixed in the package grub2 - 2.02+dfsg1-5ubuntu1 --------------- grub2 (2.02+dfsg1-5ubuntu1) cosmic; urgency=medium [ Mathieu Trudel-Lapierre] * Merge against Debian unstable; remaining changes: - debian/control: Update Vcs fields for code location on Ubuntu. - debian/control: Breaks shim (<< 13). - Secure Boot support: use newer patchset from rhboot repo: - many linuxefi_* patches added and modified - dropped debian/patches/linuxefi_require_shim.patch - renamed: debian/patches/no_insmod_on_sb.patch -> debian/patches/linuxefi_no_insmod_on_sb.patch - debian/patches/install_signed.patch, grub-install-extra-removable.patch: - Make sure if we install shim; it should also be exported as the default bootloader to install later to a removable path, if we do. - Rework grub-install-extra-removable.patch to reverse its logic: in the default case, install the bootloader to /EFI/BOOT, unless we're trying to install on a removable device, or explicitly telling grub *not* to do it. - Move installing fb$arch.efi to --no-extra-removable; as we don't want fallback to be installed unless we're also installing to /EFI/BOOT. (LP: #1684341) - Install a BOOT.CSV for fallback to use. - Make sure postinst and templates know about the replacement of --force-extra-removable with --no-extra-removable. - debian/patches/add-an-auto-nvram-option-to-grub-install.patch: Add the --auto-nvram option to grub-install for auto-detecting NVRAM availability before attempting NVRAM updates. - debian/build-efi-images: provide a new grub EFI image which enforces that loaded kernels are signed for Secure Boot: build gsb$arch.efi; which is the same as grub$arch.efi minus the 'linux' module. Without fallback to 'linux' for unsigned loading, this makes it effectively enforce having a signed kernel. (LP: #1401532) - Verify that the current and newer kernels are signed when grub is updated, to make sure people do not accidentally shutdown without a signed kernel. - debian/default/grub: replace GRUB_HIDDEN_* variables with the less confusing GRUB_TIMEOUT_STYLE=hidden. (LP: #1258597) - debian/patches/support_initrd-less_boot.patch: Added knobs to allow non-initrd boot config. (LP: #1640878) - Disable os-prober for ppc64el on the PowerNV platform, to reduce the number of entries/clutter from other OSes in Petitboot (LP: #1447500) - debian/patches/shorter_version_info.patch: Only show the upstream version in menu and console, and hide the package one in a package_version variable. (LP: #1723434) - debian/patches/skip_text_gfxpayload_where_not_supported.patch: Skip the 'text' payload if it's not supported but present in gfxpayload, such as on EFI systems. (LP: #1711452) - debian/patches/bufio_sensible_block_sizes.patch: Don't use arbitrary file fizes as block sizes in bufio: this avoids potentially seeking back in the files unnecessarily, which may require re-open files that cannot be seeked into, such as via TFTP. (LP: #1743249) * util/grub-install.c: Drop extra handling for x.efi.signed files for mok and fallback binaries: shim now installs them without the .signed extension. (LP: #1708245) - debian/patches/dont-fail-efi-warnings.patch: handle linuxefi patches and the casting they do on some architectures: we don't want to fail build because of some of the warnings that can show up since we otherwise build with -Werror. * debian/rules: shuffle files around for now to keep putting build artefacts for signing at the same location as they were expected by Launchpad. [ Julian Andres Klode ] * debian/patches/ofnet-init-structs-in-bootpath-parser.patch: initialize structs in bootpath parser. Fixes netboot issues on ppc64el. (LP: #1785859) grub2 (2.02+dfsg1-5) unstable; urgency=medium [ Colin Watson ] * Change Maintainer to