[Bug 2167127] Re: noble desktop 24.04.5: remnants of "enhanced-secure-boot" present on ISO results in install failures when using the "Extended" install option

[Dan Bungert]

very unofficial test ISO, repacked from the above livefs-build from proposed
https://people.ubuntu.com/~dbungert/noble-desktop-lp-2167127-repack-amd64.iso
https://people.ubuntu.com/~dbungert/noble-desktop-lp-2167127-repack-amd64.iso.sha256sum

** Tags removed: verification-needed-noble
** Tags added: verification-done-noble

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to livecd-rootfs in Ubuntu.
https://bugs.launchpad.net/bugs/2167127

Title:
  noble desktop 24.04.5: remnants of "enhanced-secure-boot" present on
  ISO results in install failures when using the "Extended" install
  option

Status in livecd-rootfs package in Ubuntu:
  Confirmed
Status in subiquity package in Ubuntu:
  Confirmed
Status in livecd-rootfs source package in Noble:
  Fix Committed
Status in subiquity source package in Noble:
  Fix Committed

Bug description:
  [ Impact ]

  An install may fail as follows:

  The following packages have unmet dependencies:
    boot-managed-by-snapd : Conflicts: grub-efi-amd64 but 2.12-1ubuntu7.3 is to be installed
                            Conflicts: grub-efi-amd64-signed but 1.202.5+2.12-1ubuntu7.3 is to be installed
                            Conflicts: secureboot-db but 1.9build1 is to be installed
                            Conflicts: shim-signed but 1.58+15.8-0ubuntu1 is to be installed

  Underlying issues:
  * livecd-rootfs: in commit 7c77dd158b7728583bf8251c02ff6bce42b6dce0, part of the "enhanced-secure-boot" aka TPMFDE support was removed from the Noble ISOs.  This means that the required files to do TPMFDE are mostly gone. Other references to "enhanced-secure-boot" are present, which leads subiquity to believe that TPMFDE is possible, kind of.
  * subiquity: while subiquity notices that the TPMFDE bits are not present, it falls back to non-TPMFDE incompletely.  It should ignore the TPMFDE option entirely.

  Why aren't other artifacts affected: server, flavors, other arches
  don't have the TPMFDE support in place, so there is no mix of half
  TPMFDE/half classic happening

  Resolution:
  * livecd-rootfs: remove vestigial references to TPMFDE on ubuntu/noble.
  * subiquity: more robust error handling - when TPMFDE bits not present, absolutely ignore them as an option and use the strict classic layers.

  either livecd-rootfs change or subiquity change sufficient to address
  the problem, I personally recommend doing both.

  [ Test Plan ]

  * build a livefs using livecd-rootfs with the fix.  This is somewhat complicated, but I have notes on the matter at https://git.launchpad.net/~dbungert/+git/livecd-rootfs-testing/tree/
  * Do test installs covering both the "Default selection" and "Extended selection" options for the "What apps would you like to install to start with?" screen
  * repeat all manual testing normally done for Ubuntu Desktop AMD64

  [ Where problems could occur ]

  * Single deliverable needs a respin, so this helps limit collateral damage somewhat
  * Limited changes in livecd-rootfs on the ubuntu desktop amd64 codepath helps
  * Limited changes in subiquity including logging showing the improved handling helps further
  * Do better coverage of ISO testing to address the rest.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/livecd-rootfs/+bug/2167127/+subscriptions