Ubuntu
subiquity package

No MOK enrolment for a secure boot installation

Bug #2036812 reported by fossfreedom on 2023-09-20

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	subiquity (Ubuntu)	New	Undecided	Unassigned

Bug Description

Testing Ubuntu Budgie 23.10 beta

Virtualbox 7- EFI + Secure boot chosen.

I chose the proprietary graphics/wifi option.

I noted that no screen was offered to select an enrolment password.

After installation on reboot that was confirmed that no MOK enrolment was requested.

I repeated this with the legacy ISO. This time ubiquity asked for an enrolment password and on install/reboot a MOK enrolment option was requested by VirtualBox EFI

Not sure if this is actually two issues or one - maybe ubuntu-desktop-provision for the missing password and subiquity for the lack of MOK enrolment ? or is it ubuntu-desktop-provision not passing the right options to subiquity?

Attached is the /var/log/installer that has been tar'd

See original description

Tags:

Revision history for this message

fossfreedom (fossfreedom) wrote on 2023-09-20:

installer.tar Edit (790.0 KiB, application/x-tar)

Revision history for this message

Ubuntu QA Website (ubuntuqa) wrote on 2023-09-20:

This bug has been reported on the Ubuntu ISO testing tracker.

A list of all reports related to this bug can be found here:
https://iso.qa.ubuntu.com/qatracker/reports/bugs/2036812

tags:

added: iso-testing

fossfreedom (fossfreedom) on 2023-09-22

summary:	- No MOK enrolement for a secure boot installation + No MOK enrollment for a secure boot installation
description:	updated
summary:	- No MOK enrollment for a secure boot installation + No MOK enrolment for a secure boot installation

Revision history for this message

Dan Bungert (dbungert) wrote on 2023-09-22:

There are two angles on this:

1. It's OK that it doesn't always prompt for MOK enrollment
2. But we probably want to actually do MOK enrollment sometimes.

I understand that item 1 is a change from Ubiquity, but in some cases that's OK. Just because we search for drivers to install doesn't mean there actually are any that match the hardware, so that case does not require MOK enrollment. And other cases like the nvidia (which are non-DKMS) drivers also do not require MOK enrollment today. Really this is about DKMS drivers, which means that this report is the same as LP: #2008142.