ubuntu must support upgrading images with grub in removable path

[Dimitri John Ledkov]

ubuntu must support upgrading images with grub in removable path

Currently whilst we install shim into removable path, we never upgrade grubx64.efi in the removable path.

This leads to inconsistent behavior, where upgraded shim will boot grubx64.efi from /boot/grubx64.efi which might lack sbat sections and thus will not boot.

Either we need to support upgrade grubx64.efi in /boot/*.efi, or remove it whenever we install new shim into /boot/bootx64.efi.

[Steve Langasek (vorlon)]

Why is this a "must"? After the recent changes to the cloud images, the only places where we are installing grub to the removable path are the install images, and grub doesn't get upgraded on those.

[Dimitri John Ledkov (xnox)]

When upgrading shim-signed, it will install new shim in /boot/bootx64.efi and in /ubuntu/shimx64.efi, it will also install grub with sbat section to /ubuntu/grubx64.efi.

If the machine was booting /boot/grubx64.efi before, it will fail, as /boot/grubx64.efi will remain an old one without sbat section.

I am concerned about cloud images that were launched earlier than like march 2020 and are applying upgrades, resulting in failure to boot.

I shall test this out, cause hopefully/maybe if boot/grubx64.efi fails to verify, fallback is activated.