[Bug 1928434] Re: shim-signed does not boot on EFI 2.40 by Apple

[Julian Andres Klode]

This is trying to mirror our insanely large MokListX to MokListXRT,
which is so large due to COVID related travel restrictions preventing
the generation of a new signing key, and having to revoke all binaries
this way instead.

However, we do not actually need to mirror that list AFAIUI, because the
kernel, which would consume the list, does not actually support revoking
binaries by hash (and it can kexec kernels, but not the grubs we worry
about).

On other platforms, this just causes a warning followed by a 10s wait.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to shim-signed in Ubuntu.
https://bugs.launchpad.net/bugs/1928434

Title:
  shim-signed does not boot on EFI 2.40 by Apple

Status in shim package in Ubuntu:
  Triaged
Status in shim-signed package in Ubuntu:
  Incomplete

Bug description:
  Hi,

  I have a MacBookPro14,3. After upgrade to Ubuntu 21.04 it failed to boot.
  At first I thought I'm affected by https://bugs.launchpad.net/ubuntu/+source/shim/+bug/1925010.

  But my MacBook has newer efi Version and the fixed version of shim-
  signed is not solving my issues.

  >sudo dmesg | grep EFI
  [    0.000000] efi: EFI v2.40 by Apple
  [    0.011978] ACPI: UEFI 0x000000007AF7D000 000042 (v01 INTEL  EDK2     00000002      01000013)
  [    0.012029] ACPI: Reserving UEFI table memory at [mem 0x7af7d000-0x7af7d041]
  [    0.411423] fb0: EFI VGA frame buffer device
  [    0.418914] EFI Variables Facility v0.08 2004-May-17
  [    2.696996] fb0: switching to amdgpudrmfb from EFI VGA

  I reinstalled Ubuntu 21.04 from scratch and updated all packages during installation.
  The reboot failed. I hear the apple start sound and then an endless repeating echo.
  I've chrooted inside my system and verified that shim-signed 1.47+15.4-0ubuntu2 is installed.

  The suggested workaround from the other bug works (I can normally boot afterwards):
  /boot/efi/EFI# cp -b ubuntu/grubx64.efi ubuntu/shimx64.efi
  /boot/efi/EFI# cp -b ubuntu/grubx64.efi BOOT/BOOTX64.EFI

  "sudo apt reinstall shim-signed" reliable breaks my macbook again.

  Is there anything I can do to help solving this issue? What do you
  need?

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/shim/+bug/1928434/+subscriptions