Comment 6 for bug 1864223

@Steve

Yes; from what I can gather this will definitely require source modifications to shim.

The concern I have is that beta is the milestone that many more people start to download and actually start testing Ubuntu images. With how widely OEMs support UEFI firmware updates now, I expect a larger influx of bugs to be reported around failing firmware updates as people load the beta images on their machines.

If it's not possible to fix this particular issue by the beta milestone but the shim changes are preferable to keep in, I wonder if it would make sense to make some modifications to fwupd. Some alternative idea proposals:

1) If secure boot is not turned on, don't build the "Linux Firmware Updater" entry to use shim "at all". Instead BDS would load fwupdx64.efi directly. This would prevent hitting this particular bug if secure boot was turned off.
2) If secure boot is turned on, detect the version of shim on the system at runtime from fwupd and add a blacklist of this particular shim version so that updates are not offered.

Those would both require some source modifications to fwupd, but I think they're achievable workarounds by beta milestone.