[Bug 1726803] Re: unattended-upgrades + nvidia stack upgrade == dkms fail (package shim-signed 1.32~16.04.1+0.9+1474479173.6c180c6-1ubuntu1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1)

[Balint Reczey]

@vorlon My bad, thought that a generic solution would be useful in u-u,
but now I'm implementing now the special case.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to unattended-upgrades in Ubuntu.
https://bugs.launchpad.net/bugs/1726803

Title:
  unattended-upgrades + nvidia stack upgrade == dkms fail (package shim-
  signed 1.32~16.04.1+0.9+1474479173.6c180c6-1ubuntu1 failed to
  install/upgrade: subprocess installed post-installation script
  returned error exit status 1)

Status in shim-signed package in Ubuntu:
  New
Status in unattended-upgrades package in Ubuntu:
  Incomplete
Status in shim-signed source package in Bionic:
  Triaged
Status in unattended-upgrades source package in Bionic:
  Incomplete

Bug description:
  [Impact]

   * When Secure Boot is enabled and a new dkms module is installed sim-
  signed asks for a new Secure Boot key, or aborts package installation
  in non-interactive mode. When unattended-upgrades performed the
  upgrade the aborted installation leaves an unconfigured system behind
  that may even fail to boot.

   * The fix in u-u detects new dkms-related packages and holds them
  back from installation.

  [Test Case]

  1. Set up a fully - or almost fully updated Bionic system.

  2. Install packagages to trigger the block:
  apt install dkms shim-signed r8168-dkms

  3. Fake enabled secure boot:
  echo "shim-signed shim/enable_secureboot boolean true" | debconf-set-selections

  4. Add and enable PPA hosting updated dkms package pulling in a new dkms-like dependency:
  add-apt-repository ppa:rbalint/scratch
  echo 'Unattended-Upgrade::Allowed-Origins {"LP-PPA-rbalint-scratch:${distro_codename}";}' > /etc/apt/apt.conf.d/51unattended-upgrades-all

  5. Observe u-u keeping back the new package:
  unattended-upgrade --verbose --dry-run --debug
  ...
  Checking: r8168-dkms ([<Origin component:'main' archive:'bionic' origin:'LP-PPA-rbalint-scratch' label:"Scratch space, don't use" site:'ppa.launchpad.net' isTrusted:True>])
  pkg new-dkms-dep may trigger secure boot key prompt
  sanity check failed
  ...

  [Regression Potential]

  * Since the fix is holding back packages from installation it is
  expected that systems that would have otherwise broke during the
  installation would not receive all updates. Since exact detection of
  the installation failure reported here does not seem possible u-u
  holds back more packages than it would be absolutely necessary.

  * Administrators are expected to set up email notifications about the
  updates performed by u-u and act on held back packages.

  * Since updates pulling in new packages are fairly rare especially in
  the -security pocket which u-u installs from by default unwanted
  regressions are unlikely to show up.

  [Original Bug Text]

  Occurred a minute after logging in

  ProblemType: Package
  DistroRelease: Ubuntu 16.04
  Package: shim-signed 1.32~16.04.1+0.9+1474479173.6c180c6-1ubuntu1
  ProcVersionSignature: Ubuntu 4.10.0-37.41~16.04.1-generic 4.10.17
  Uname: Linux 4.10.0-37-generic x86_64
  .proc.sys.kernel.moksbstate_disabled: 0
  ApportVersion: 2.20.1-0ubuntu2.10
  Architecture: amd64
  Date: Tue Oct 24 11:35:53 2017
  EFITables:
   Oct 24 11:33:04 paddy-laptop kernel: efi: EFI v2.40 by American Megatrends
   Oct 24 11:33:04 paddy-laptop kernel: efi:  ACPI=0x78660000  ACPI 2.0=0x78660000  SMBIOS=0xf0000  SMBIOS 3.0=0xf0020  ESRT=0x79360598
   Oct 24 11:33:04 paddy-laptop kernel: esrt: Reserving ESRT space from 0x0000000079360598 to 0x00000000793605d0.
   Oct 24 11:33:04 paddy-laptop kernel: Secure boot enabled
  ErrorMessage: subprocess installed post-installation script returned error exit status 1
  InstallationDate: Installed on 2017-09-11 (42 days ago)
  InstallationMedia: Ubuntu 16.04.3 LTS "Xenial Xerus" - Release amd64 (20170801)
  RelatedPackageVersions:
   dpkg 1.18.4ubuntu1.2
   apt  1.2.24
  SecureBoot: 6   0   0   0   1
  SourcePackage: shim-signed
  Title: package shim-signed 1.32~16.04.1+0.9+1474479173.6c180c6-1ubuntu1 failed to install/upgrade: subprocess installed post-installation script returned error exit status 1
  UpgradeStatus: No upgrade log present (probably fresh install)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/shim-signed/+bug/1726803/+subscriptions