backport needed to enable users to reset SBAT level

Uploads sponsored w/ minor adjustment to reduce debian/compat to 12 in focal as well, matching the depends, as lintian complained about level 13 not being ready then yet. Build output is binary identical.

$ md5sum {~/Downloads,..}/mokutil_0.6.0-2~20.04.1_amd64.deb
f0db822020bf68509153e4e900037362 /home/jak/Downloads/mokutil_0.6.0-2~20.04.1_amd64.deb
f0db822020bf68509153e4e900037362 ../mokutil_0.6.0-2~20.04.1_amd64.deb

 Package: mokutil
-Architecture: any-amd64 any-arm any-arm64 any-i386 any-ia64 any-riscv64
+Architecture: any
 Depends: ${shlibs:Depends}, ${misc:Depends}

Not clear why that packaging change is desirable. But in practice it won't change the set of architectures where this builds successfully, so <shrug>

Hello Steve, or anyone else affected,

Accepted mokutil into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/mokutil/0.6.0-2~22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

I have verified this using mokutil 0.6.0-2~22.04.1 from jammy-proposed:

Inside the VM:

ubuntu@ubuntu:~$ apt-cache policy mokutil
mokutil:
  Installed: 0.6.0-2~22.04.1
  Candidate: 0.6.0-2~22.04.1
  Version table:
 *** 0.6.0-2~22.04.1 500
        500 http://archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages
        100 /var/lib/dpkg/status
     0.4.0-1ubuntu2 500
        500 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages
ubuntu@ubuntu:~$ sudo mokutil --set-verbosity true
ubuntu@ubuntu:~$ sudo mokutil --set-sbat-policy delete

Booting to 22.04.2 grub again:

nr@six:/t/test-lp2015664$ ./secureboot-vm -cdrom ubuntu-22.04.2-desktop-amd64.iso -serial file:jammy-boot.log
+ MACHINE_NAME=test
+ QEMU_IMG=test.img
+ SSH_PORT=5555
+ OVMF_CODE=/usr/share/OVMF/OVMF_CODE_4M.ms.fd
+ OVMF_VARS_ORIG=/usr/share/OVMF/OVMF_VARS_4M.ms.fd
++ basename /usr/share/OVMF/OVMF_VARS_4M.ms.fd
+ OVMF_VARS=OVMF_VARS_4M.ms.fd
+ '[' '!' -e test.img ']'
+ '[' '!' -e OVMF_VARS_4M.ms.fd ']'
+ qemu-system-x86_64 -enable-kvm -cpu host -smp cores=4,threads=1 -m 4096 -object rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 -name test -drive file=test.img,format=qcow2 -net nic,model=virtio -net user,hostfwd=tcp::5555-:22 -vga virtio -machine q35,smm=on -global driver=cfi.pflash01,property=secure,value=on -drive if=pflash,format=raw,unit=0,file=/usr/share/OVMF/OVMF_CODE_4M.ms.fd,readonly=on -drive if=pflash,format=raw,unit=1,file=OVMF_VARS_4M.ms.fd -cdrom ubuntu-22.04.2-desktop-amd64.iso -serial file:jammy-boot.log
^Cqemu: terminating on signal 2
nr@six:/t/test-lp2015664$ grep -I sbat.c jammy-boot.log
sbat.c:477:set_sbat_uefi_variable() SbatLevel variable is 25 bytes, attributes are 0x00000003
sbat.c:479:set_sbat_uefi_variable() Deleting SbatLevel variable.
sbat.c:512:set_sbat_uefi_variable() SbatLevel variable initialization succeeded

Inside 22.04.1 VM after re-enabling secureboot:

ubuntu@ubuntu:/$ mokutil --sb-state
SecureBoot enabled
ubuntu@ubuntu:/$ cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.1 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.1 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy

Hello Steve, or anyone else affected,

Accepted mokutil into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/mokutil/0.6.0-2~20.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

This bug was fixed in the package mokutil - 0.6.0-2~22.04.1

---------------
mokutil (0.6.0-2~22.04.1) jammy; urgency=medium

  * Backport 0.6.0-2 to jammy (LP: #2015664).

 -- Nick Rosbrook <email address hidden> Wed, 26 Apr 2023 09:56:23 -0400

The verification of the Stable Release Update for mokutil has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

I have verified this using mokutil 0.6.0-2~20.04.1 from focal-proposed:

Edit: I omitted this for brevity initially, but to avoid any confusion for SRU reviewers:

Boot 22.04.2 ISO and kill the VM after grub is reached:

nr@six:/t/test-lp2015664$ ./secureboot-vm -cdrom ubuntu-22.04.2-desktop-amd64.iso
+ MACHINE_NAME=test
+ QEMU_IMG=test.img
+ SSH_PORT=5555
+ OVMF_CODE=/usr/share/OVMF/OVMF_CODE_4M.ms.fd
+ OVMF_VARS_ORIG=/usr/share/OVMF/OVMF_VARS_4M.ms.fd
++ basename /usr/share/OVMF/OVMF_VARS_4M.ms.fd
+ OVMF_VARS=OVMF_VARS_4M.ms.fd
+ '[' '!' -e test.img ']'
+ qemu-img create -f qcow2 test.img 20G
Formatting 'test.img', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=21474836480 lazy_refcounts=off refcount_bits=16
+ '[' '!' -e OVMF_VARS_4M.ms.fd ']'
+ cp /usr/share/OVMF/OVMF_VARS_4M.ms.fd OVMF_VARS_4M.ms.fd
+ qemu-system-x86_64 -enable-kvm -cpu host -smp cores=4,threads=1 -m 4096 -object rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 -name test -drive file=test.img,format=qcow2 -net nic,model=virtio -net user,hostfwd=tcp::5555-:22 -vga virtio -machine q35,smm=on -global driver=cfi.pflash01,property=secure,value=on -drive if=pflash,format=raw,unit=0,file=/usr/share/OVMF/OVMF_CODE_4M.ms.fd,readonly=on -drive if=pflash,format=raw,unit=1,file=OVMF_VARS_4M.ms.fd -cdrom ubuntu-22.04.2-desktop-amd64.iso
^Cqemu: terminating on signal 2

Now boot 20.04.5 ISO and disable secureboot before grub is loaded. After that, continue booting into live Ubuntu environment:

nr@six:/t/test-lp2015664$ ./secureboot-vm -cdrom ubuntu-20.04.5-desktop-amd64.iso -boot menu=on
+ MACHINE_NAME=test
+ QEMU_IMG=test.img
+ SSH_PORT=5555
+ OVMF_CODE=/usr/share/OVMF/OVMF_CODE_4M.ms.fd
+ OVMF_VARS_ORIG=/usr/share/OVMF/OVMF_VARS_4M.ms.fd
++ basename /usr/share/OVMF/OVMF_VARS_4M.ms.fd
+ OVMF_VARS=OVMF_VARS_4M.ms.fd
+ '[' '!' -e test.img ']'
+ '[' '!' -e OVMF_VARS_4M.ms.fd ']'
+ qemu-system-x86_64 -enable-kvm -cpu host -smp cores=4,threads=1 -m 4096 -object rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 -name test -drive file=test.img,format=qcow2 -net nic,model=virtio -net user,hostfwd=tcp::5555-:22 -vga virtio -machine q35,smm=on -global driver=cfi.pflash01,property=secure,value=on -drive if=pflash,format=raw,unit=0,file=/usr/share/OVMF/OVMF_CODE_4M.ms.fd,readonly=on -drive if=pflash,format=raw,unit=1,file=OVMF_VARS_4M.ms.fd -cdrom ubuntu-20.04.5-desktop-amd64.iso -boot menu=on

From inside the VM:

ubuntu@ubuntu:~$ apt-cache policy mokutil
mokutil:
  Installed: 0.6.0-2~20.04.1
  Candidate: 0.6.0-2~20.04.1
  Version table:
 *** 0.6.0-2~20.04.1 500
        500 http://archive.ubuntu.com/ubuntu focal-proposed/main amd64 Packages
        100 /var/lib/dpkg/status
     0.3.0+1538710437.fb6250f-1 500
        500 http://archive.ubuntu.com/ubuntu focal/main amd64 Packages
ubuntu@ubuntu:~$ sudo mokutil --set-verbosity true
ubuntu@ubuntu:~$ sudo mokutil --set-sbat-policy delete

Booting to 22.04.2 grub again:

nr@six:/t/test-lp2015664$ ./secureboot-vm -cdrom ubuntu-22.04.2-desktop-amd64.iso -serial file:focal-boot.log
+ MACHINE_NAME=test
+ QEMU_IMG=test.img
+ SSH_PORT=5555
+ OVMF_CODE=/usr/share/OVMF/OVMF_CODE_4M.ms.fd
...

Thank you for the Focal verification!

The build is in dep-wait for ppc64el, riscv64 and s390x, but as with Jammy that's fine because I see these architectures weren't built before so there is no regression.

However, i386 _was_ built before, and now it isn't. If I release this then the old i386 binary will remain in the apt archive and I think will become NBS. Do we need to also build the i386 binary? Or, if exceptionally this is correct as-is, then please could that be documented with an AA sign-off for the NBS?

It is not built on i386 because no build record was created, because mokutils is not in the i386 whitelist for focal. It was *built* for the focal release pocket but was subject to binary removal per https://launchpad.net/ubuntu/focal/i386/mokutil and was not actually shipped in focal.

This bug was fixed in the package mokutil - 0.6.0-2~20.04.1

---------------
mokutil (0.6.0-2~20.04.1) focal; urgency=medium

  * Backport 0.6.0-2 to focal (LP: #2015664).
  * Drop debhelper version to 12 to build on focal.

 -- Nick Rosbrook <email address hidden> Wed, 12 Apr 2023 13:59:25 -0400

I hadn't considered the i386 special casing. Thank you for clarifying! So this is fine to release then, which I've just done.

New shim is also being published to bionic (in the main archive, not ESM), so we need the mokutils SRUed to bionic as well.

Hello Steve, or anyone else affected,

Accepted mokutil into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/mokutil/0.6.0-2~18.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

I have verified the fix using mokutil 0.6.0-2~18.04.1 from bionic-proposed:

* Boot 22.04.2 ISO:

nr@six:/t/tmp.iHWPr6jPZI$ ./secureboot-vm -cdrom ubuntu-22.04.2-desktop-amd64.iso
+ MACHINE_NAME=test
+ QEMU_IMG=test.img
+ SSH_PORT=5555
+ OVMF_CODE=/usr/share/OVMF/OVMF_CODE_4M.ms.fd
+ OVMF_VARS_ORIG=/usr/share/OVMF/OVMF_VARS_4M.ms.fd
++ basename /usr/share/OVMF/OVMF_VARS_4M.ms.fd
+ OVMF_VARS=OVMF_VARS_4M.ms.fd
+ '[' '!' -e test.img ']'
+ qemu-img create -f qcow2 test.img 20G
Formatting 'test.img', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=21474836480 lazy_refcounts=off refcount_bits=16
+ '[' '!' -e OVMF_VARS_4M.ms.fd ']'
+ cp /usr/share/OVMF/OVMF_VARS_4M.ms.fd OVMF_VARS_4M.ms.fd
+ qemu-system-x86_64 -enable-kvm -cpu host -smp cores=4,threads=1 -m 4096 -object rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 -name test -drive file=test.img,format=qcow2 -net nic,model=virtio -net user,hostfwd=tcp::5555-:22 -vga virtio -machine q35,smm=on -global driver=cfi.pflash01,property=secure,value=on -drive if=pflash,format=raw,unit=0,file=/usr/share/OVMF/OVMF_CODE_4M.ms.fd,readonly=on -drive if=pflash,format=raw,unit=1,file=OVMF_VARS_4M.ms.fd -cdrom ubuntu-22.04.2-desktop-amd64.iso
^Cqemu: terminating on signal 2

* Boot 18.04.6 ISO and observe secureboot violation:

nr@six:/t/tmp.iHWPr6jPZI$ ./secureboot-vm -cdrom ubuntu-18.04.6-desktop-amd64.iso
+ MACHINE_NAME=test
+ QEMU_IMG=test.img
+ SSH_PORT=5555
+ OVMF_CODE=/usr/share/OVMF/OVMF_CODE_4M.ms.fd
+ OVMF_VARS_ORIG=/usr/share/OVMF/OVMF_VARS_4M.ms.fd
++ basename /usr/share/OVMF/OVMF_VARS_4M.ms.fd
+ OVMF_VARS=OVMF_VARS_4M.ms.fd
+ '[' '!' -e test.img ']'
+ '[' '!' -e OVMF_VARS_4M.ms.fd ']'
+ qemu-system-x86_64 -enable-kvm -cpu host -smp cores=4,threads=1 -m 4096 -object rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 -name test -drive file=test.img,format=qcow2 -net nic,model=virtio -net user,hostfwd=tcp::5555-:22 -vga virtio -machine q35,smm=on -global driver=cfi.pflash01,property=secure,value=on -drive if=pflash,format=raw,unit=0,file=/usr/share/OVMF/OVMF_CODE_4M.ms.fd,readonly=on -drive if=pflash,format=raw,unit=1,file=OVMF_VARS_4M.ms.fd -cdrom ubuntu-18.04.6-desktop-amd64.iso
^Cqemu: terminating on signal 2

* Disable secureboot and continue into live system:

nr@six:/t/tmp.iHWPr6jPZI$ ./secureboot-vm -cdrom ubuntu-18.04.6-desktop-amd64.iso -boot menu=on
+ MACHINE_NAME=test
+ QEMU_IMG=test.img
+ SSH_PORT=5555
+ OVMF_CODE=/usr/share/OVMF/OVMF_CODE_4M.ms.fd
+ OVMF_VARS_ORIG=/usr/share/OVMF/OVMF_VARS_4M.ms.fd
++ basename /usr/share/OVMF/OVMF_VARS_4M.ms.fd
+ OVMF_VARS=OVMF_VARS_4M.ms.fd
+ '[' '!' -e test.img ']'
+ '[' '!' -e OVMF_VARS_4M.ms.fd ']'
+ qemu-system-x86_64 -enable-kvm -cpu host -smp cores=4,threads=1 -m 4096 -object rng-random,filename=/dev/urandom,id=rng0 -device virtio-rng-pci,rng=rng0 -name test -drive file=test.img,format=qcow2 -net nic,model=virtio -net user,hostfwd=tcp::5555-:22 -vga virtio -machine q35,smm=on -global driver=cfi.pflash01,property=secure,value=on -drive if=pflash,format=raw,unit=0,file=/usr/share/OVMF/OVMF_CODE_4M.ms.fd,readonly=on -drive if=pflash,format=raw,unit=1,file=OVMF_VARS_4M.ms.fd -cdrom...

This bug was fixed in the package mokutil - 0.6.0-2~18.04.1

---------------
mokutil (0.6.0-2~18.04.1) bionic; urgency=medium

  * Backport 0.6.0-2 to bionic (LP: #2015664).
    - debian/control,debian/compat: Drop debhelper version to 11
      to build on bionic.
    - debian/patches/manually-define-LIBKEYUTILS-make-vars.patch: Workaround
      missing libkeyutils.pc in bionic.

mokutil (0.6.0-2) unstable; urgency=medium

  * *Actually* switch to Arch: any to allow for more
    architectures. :-( Closes: #987613.

mokutil (0.6.0-1) unstable; urgency=medium

  * Move to new upstream version 0.6.0.
    + Drop old patches, no longer needed.
  * Switch to Arch: any to allow for more architectures.
    Closes: #987613, #991933.
  * Clean up old tweaks in debian/rules, no longer needed.
  * Add build-dep on libkeyutils-dev, new dependency.
  * Bump Standards-Version to 4.6.1, no changes needed.

mokutil (0.4.0-1) unstable; urgency=medium

  * Take mokutil under the wing of efi-team.
    Thanks to Simon for his work previously, added him as an uploader
  * Import the upstream source
  * Move to new upstream version 0.4.0. Closes: #925223
    + Includes manpage fixes. Closes: #930759
  * Fix compiler warnings about potential unaligned pointers
  * Update packaging:
    + Raise debhelper-compat to 13
    + Raise Standards-Version to 4.5.1
    + Remove now-redundant build-dep on dh-autoreconf

mokutil (0.3.0+1538710437.fb6250f-1) unstable; urgency=medium

  * Upload to Debian (Closes: #925471).
  * Adopt the package; thanks to Steve Langasek for your work!
  * Update Vcs-* to reflect the move to Salsa.

 -- Nick Rosbrook <email address hidden> Wed, 07 Jun 2023 14:14:30 -0400