[Bug 2031896] Re: [canary] installation failed with "cannot seal the encryption keys"

[James Paton-Smith]

Tested again on a VM and managed to get it working. As far as I can
tell, the only thing I changed was the EFI boot order.

I simply made sure that CD/DVD was the first boot option and made sure
to shutdown the VM before booting into the ISO image.

So potentially, having other boot options before the CD/DVD option, even
if they don't succeed (e.g disk is unformatted), could be causing the
issue.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to subiquity in Ubuntu.
https://bugs.launchpad.net/bugs/2031896

Title:
  [canary] installation failed with "cannot seal the encryption keys"

Status in snapd:
  New
Status in subiquity:
  Confirmed
Status in ubuntu-desktop-installer:
  Triaged
Status in subiquity package in Ubuntu:
  Triaged

Bug description:
  Mantic 20230817

  For some reason installation in a VM failed with:

  =====
  2023-08-18 08:42:55,702 ERROR root:30 finish: subiquity/Install/install/curtin_install/finish_install: FAIL: cannot perform the following tasks:
  - Finish setup of run system for "enhanced-secureboot-desktop" (cannot seal the encryption keys: cannot add EFI secure boot policy profile: cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI application that returned to the boot manager, without a reboot in between)
  2023-08-18 08:42:55,702 ERROR root:30 finish: subiquity/Install/install/curtin_install: FAIL: cannot perform the following tasks:
  - Finish setup of run system for "enhanced-secureboot-desktop" (cannot seal the encryption keys: cannot add EFI secure boot policy profile: cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI application that returned to the boot manager, without a reboot in between)
  2023-08-18 08:42:55,702 DEBUG subiquity.common.errorreport:394 generating crash report
  2023-08-18 08:42:55,714 INFO subiquity.common.errorreport:415 saving crash report 'install failed crashed with ClientError' to /var/crash/1692348175.702773333.install_fail.crash
  2023-08-18 08:42:55,714 ERROR root:30 finish: subiquity/Install/install: FAIL: cannot perform the following tasks:
  - Finish setup of run system for "enhanced-secureboot-desktop" (cannot seal the encryption keys: cannot add EFI secure boot policy profile: cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI application that returned to the boot manager, without a reboot in between)
  2023-08-18 08:42:55,715 INFO root:30 start: subiquity/ErrorReporter/1692348175.702773333.install_fail/add_info: 
  2023-08-18 08:42:55,715 ERROR subiquity.server.server:414 top level error
  Traceback (most recent call last):
    File "/snap/ubuntu-desktop-installer/1197/bin/subiquity/subiquity/server/controllers/shutdown.py", line 74, in _wait_install
      await self.app.controllers.Install.install_task
  aiohttp.client_exceptions.ClientError: cannot perform the following tasks:
  - Finish setup of run system for "enhanced-secureboot-desktop" (cannot seal the encryption keys: cannot add EFI secure boot policy profile: cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI application that returned to the boot manager, without a reboot in between)
  2023-08-18 08:42:55,717 ERROR subiquity.server.server:414 top level error
  Traceback (most recent call last):
    File "/snap/ubuntu-desktop-installer/1197/bin/subiquity/subiquity/server/controllers/shutdown.py", line 74, in _wait_install
      await self.app.controllers.Install.install_task
  aiohttp.client_exceptions.ClientError: cannot perform the following tasks:
  - Finish setup of run system for "enhanced-secureboot-desktop" (cannot seal the encryption keys: cannot add EFI secure boot policy profile: cannot compute secure boot policy profile: the current boot was preceeded by a boot attempt to an EFI application that returned to the boot manager, without a reboot in between)
  =====

  The error should be exposed to the user instead of crashing. There
  error is not displayed in the console of the installer either.

  About the error itself, I've no clue what it means, since it's an
  installation from a fresh VM, straight to the live session.

To manage notifications about this bug go to:
https://bugs.launchpad.net/snapd/+bug/2031896/+subscriptions