Install third party software should be dependent on Secure Boot being disabled

[Jeremy Bícha]

What happens
------------
I tested today's daily Ubuntu GNOME yakkety installer on a computer with Secure Boot enabled.

On the "Preparing to install Ubuntu" screen, these are the default options:
- Download updates (unchecked and active)
- Install third party software (unchecked and active)
  - Turn off Secure Boot (checked and inactive unless the above box is checked)
  - Secure Boot password (inactive unless both Install third party software is checked)

Quit Back Continue (inactive unless either Turn off Secure Boot is unchecked or a good password is entered)

Screenshot attached.

If "Install third party software" is checked, "Turn off Secure Boot" can be unchecked and the Continue button is still present. This should not be allowed according to the text "Installing third-party drivers requires turning off Secure Boot."

What should happen
------------------
I think the workflow needs to be re-examined by the Design team.

1. Secure Boot should be enabled by default (so the box should be unchecked). See bug 1612450.

2. I think the dependency is in the wrong order. "Install third party software" should be a dependency of disabling Secure Boot. In other words, "Install third party software" should be indented and below the Secure Boot section.

Why should we allow disabling Secure Boot during the install without checking the "Install third party software option? For example, I believe disabling Secure Boot is required to use VirtualBox's kernel drivers. I don't think Ubuntu currently off a graphical way to disable Secure Boot except in the installer.

3. The "Install third party software" box should only be active only if Turn off Secure Boot is enabled and an acceptable password is entered. If either of those change, "Install third party software" should be both inactive and unchecked.

I think fixing #3 which depends on #2 fixes the Continue bug logic error.

Since #2 and #3 deviate from the design spec found at https://wiki.ubuntu.com/Ubiquity this will need Design Team input.

ProblemType: Bug
DistroRelease: Ubuntu 16.10
Package: ubiquity 16.10.7
ProcVersionSignature: Ubuntu 4.4.0-34.53-generic 4.4.15
Uname: Linux 4.4.0-34-generic x86_64
ApportVersion: 2.20.3-0ubuntu5
Architecture: amd64
CasperVersion: 1.376
CurrentDesktop: GNOME
Date: Thu Aug 11 22:03:53 2016
InstallCmdLine: BOOT_IMAGE=/casper/vmlinuz.efi file=/cdrom/preseed/ubuntu-gnome.seed boot=casper quiet splash ---
LiveMediaBuild: Ubuntu-GNOME 16.10 "Yakkety Yak" - Alpha amd64 (20160811)
ProcEnviron:
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: ubiquity
UpgradeStatus: No upgrade log present (probably fresh install)

[Ubuntu QA Website (ubuntuqa)]

This bug has been reported on the Ubuntu ISO testing tracker.

A list of all reports related to this bug can be found here:
http://iso.qa.ubuntu.com/qatracker/reports/bugs/1612449

[Jeremy Bícha (jbicha)]

mpt, could you triage this?

[Matthew Paul Thomas (mpt)]

I find that whenever a bug report summary contains “should”, it is assuming a particular solution to an often-underspecified problem. Here, if I understand it, the problem is that you can’t use VirtualBox kernel drivers without installing other third-party software. Maybe fixing that requires making it possible to turn off Secure Boot independently, or maybe it doesn’t. Are there other reasons to turn off Secure Boot?

<cyphermox> mpt: this needs more discussion, things aren't so simple as they're described in the bug

Bug 1612450 is probably more urgent, but if this bug was fixed probably it would involve rewriting the solution to that one.