[Bug 2004208] Re: arm64 package has hardcoded x64 references

[Andy Whitcroft]

** Changed in canonical-signing-jobs/task00
     Status explanation: validate \
   --exclude kinetic:shim --publications ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14471577
copy \
   --from ppa:ubuntu-uefi-team/ubuntu/ppa --from-suite kinetic --sources \
     shim-signed/1.54/signing \
   --to signing:ubuntu/4 --to-suite kinetic
copy \
   --from signing:ubuntu/4 --from-suite kinetic --sources \
     shim-signed/1.54 \
   --to ppa:ubuntu-uefi-team/ubuntu/proposed --to-suite kinetic
delete \
   --from signing:ubuntu/4 --from-suite kinetic --sources \
     shim-signed/1.54 => validate \
   --exclude kinetic:shim --publications ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14154501 ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14471577
copy \
   --from ppa:ubuntu-uefi-team/ubuntu/ppa --from-suite kinetic --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.54/signing \
   --to signing:ubuntu/4 --to-suite kinetic
copy \
   --from signing:ubuntu/4 --from-suite kinetic --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.54 \
   --to ppa:ubuntu-uefi-team/ubuntu/proposed --to-suite kinetic
delete \
   --from signing:ubuntu/4 --from-suite kinetic --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.54

** Changed in canonical-signing-jobs/task01
     Status explanation: validate \
   --exclude jammy:shim --publications ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14471576
copy \
   --from ppa:ubuntu-uefi-team/ubuntu/ppa --from-suite jammy --sources \
     shim-signed/1.51.3/signing \
   --to signing:ubuntu/4 --to-suite jammy
copy \
   --from signing:ubuntu/4 --from-suite jammy --sources \
     shim-signed/1.51.3 \
   --to ppa:ubuntu-uefi-team/ubuntu/proposed --to-suite jammy
delete \
   --from signing:ubuntu/4 --from-suite jammy --sources \
     shim-signed/1.51.3 => validate \
   --exclude jammy:shim --publications ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14464729 ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14471576
copy \
   --from ppa:ubuntu-uefi-team/ubuntu/ppa --from-suite jammy --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.51.3/signing \
   --to signing:ubuntu/4 --to-suite jammy
copy \
   --from signing:ubuntu/4 --from-suite jammy --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.51.3 \
   --to ppa:ubuntu-uefi-team/ubuntu/proposed --to-suite jammy
delete \
   --from signing:ubuntu/4 --from-suite jammy --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.51.3

** Changed in canonical-signing-jobs/task02
     Status explanation: validate \
   --exclude focal:shim --publications ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14471540
copy \
   --from ppa:ubuntu-uefi-team/ubuntu/ppa --from-suite focal --sources \
     shim-signed/1.40.9/signing \
   --to signing:ubuntu/4 --to-suite focal
copy \
   --from signing:ubuntu/4 --from-suite focal --sources \
     shim-signed/1.40.9 \
   --to ppa:ubuntu-uefi-team/ubuntu/proposed --to-suite focal
delete \
   --from signing:ubuntu/4 --from-suite focal --sources \
     shim-signed/1.40.9 => validate \
   --exclude focal:shim --publications ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14464730 ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14471540
copy \
   --from ppa:ubuntu-uefi-team/ubuntu/ppa --from-suite focal --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.40.9/signing \
   --to signing:ubuntu/4 --to-suite focal
copy \
   --from signing:ubuntu/4 --from-suite focal --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.40.9 \
   --to ppa:ubuntu-uefi-team/ubuntu/proposed --to-suite focal
delete \
   --from signing:ubuntu/4 --from-suite focal --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.40.9

** Changed in canonical-signing-jobs/task03
     Status explanation: validate \
   --exclude bionic:shim --publications ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14471532
copy \
   --from ppa:ubuntu-uefi-team/ubuntu/ppa --from-suite bionic --sources \
     shim-signed/1.37~18.04.13/signing \
   --to signing:ubuntu/4 --to-suite bionic
copy \
   --from signing:ubuntu/4 --from-suite bionic --sources \
     shim-signed/1.37~18.04.13 \
   --to ppa:ubuntu-uefi-team/ubuntu/proposed --to-suite bionic
delete \
   --from signing:ubuntu/4 --from-suite bionic --sources \
     shim-signed/1.37~18.04.13 => validate \
   --exclude bionic:shim --publications ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14464731 ~ubuntu-uefi-team/+archive/ubuntu/ppa/+sourcepub/14471532
copy \
   --from ppa:ubuntu-uefi-team/ubuntu/ppa --from-suite bionic --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.37~18.04.13/signing \
   --to signing:ubuntu/4 --to-suite bionic
copy \
   --from signing:ubuntu/4 --from-suite bionic --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.37~18.04.13 \
   --to ppa:ubuntu-uefi-team/ubuntu/proposed --to-suite bionic
delete \
   --from signing:ubuntu/4 --from-suite bionic --sources \
     shim/15.7-0ubuntu1 \
     shim-signed/1.37~18.04.13

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to shim-signed in Ubuntu.
https://bugs.launchpad.net/bugs/2004208

Title:
  arm64 package has hardcoded x64 references

Status in canonical-signing-jobs:
  Fix Committed
Status in canonical-signing-jobs task00 series:
  In Progress
Status in canonical-signing-jobs task01 series:
  In Progress
Status in canonical-signing-jobs task02 series:
  In Progress
Status in canonical-signing-jobs task03 series:
  In Progress
Status in shim-signed package in Ubuntu:
  New
Status in shim-signed source package in Bionic:
  New
Status in shim-signed source package in Focal:
  New
Status in shim-signed source package in Jammy:
  New
Status in shim-signed source package in Kinetic:
  New

Bug description:
  [Impact] 
  I couldn't figure out why the alternative wasn't being updated to the new shim after I installed a kernel installed w/ a 2022 key. Turns out its because we hardcode shim*x64* in the kernel hook:

  ubuntu at ubuntu:~$ grep x64 /etc/kernel/postinst.d/zz-shim
  if update-alternatives --query shimx64.efi.signed | grep "Best: /usr/lib/shim/shimx64.efi.signed.previous" -q; then

  There also seems to be a number of residual x64 references in the postinst:
  ubuntu at ubuntu:~$ grep x64 /var/lib/dpkg/info/shim-signed.*
  /var/lib/dpkg/info/shim-signed.postinst:	for efi_arch in x64 aa64; do
  /var/lib/dpkg/info/shim-signed.postinst:			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shimx64.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.latest 100
  /var/lib/dpkg/info/shim-signed.postinst:			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shimx64.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.previous 50
  /var/lib/dpkg/info/shim-signed.postinst:			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shimx64.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.latest 50
  /var/lib/dpkg/info/shim-signed.postinst:			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shimx64.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.previous 100
  /var/lib/dpkg/info/shim-signed.postinst:	if update-alternatives --query shimx64.efi.signed | grep "Best: /usr/lib/shim/shimx64.efi.signed.previous" -q; then

  [Test plan]
  Install a kernel signed with 2022 key on arm64, make sure that shimaa64.efi.signed alternative points to latest

  [Where problems could occur]
  Added/changed code could potentially break stuff on amd64.

To manage notifications about this bug go to:
https://bugs.launchpad.net/canonical-signing-jobs/+bug/2004208/+subscriptions