fwupdate-signed doesn't get installed on upgrade

Yes, I have hit this bug with my laptop during xenial release sprint. My understanding was that we have agreed to make -signed to be installed by default, however naive approach was shut-down due to dependency cycle (can't remember exactly now). At the time I have manually installed -signed to get the fwupdates working. But we should be install -signed by default. Similar to how installers no longer make destinction between signed/unsigned installs -> we always install both, as one can flip between signed and unsigned boot throughout the lifetime of the machine.

No I think we have fixed it:

ubuntu-meta (1.361) xenial; urgency=medium

  * Refreshed dependencies
  * Added fwupdate-signed to desktop-recommends [amd64 arm64 armhf i386]
  * Added ubuntu-software to desktop-recommends
  * Added unity to desktop [s390x]
  * Removed gnome-software from desktop-recommends

 -- Iain Lane <email address hidden> Tue, 19 Apr 2016 21:15:56 +0100

Is ubuntu-desktop package installed on your machine?

I now realise that this bug was filed _before_ we fixed it at the release sprint. Marking as fixed.

So that said, this fix that was put in place was a bit heavy handed wasn't it? With the luxury of time, is it worth adjusting it now to do as I was recommending?

Ubiquity already has code to make an educated decision about when to install fwupdate-signed so that it's not needlessly added to systems installed in legacy mode.

We have people flipping between uefi <-> legacy boot too. because they can in firmware =) granted they need to extra steps to get that to work. I don't think it is heavy-handed, instead it is forward-looking =) and doing it at package level, catches "apt full-upgrade" installation too - as a few people don't use release-upgrader.

Another suggestion is to split the tool, efi, signed-efi into separate pacakges.

Maybe even migrate to ubuntu-drivers infrastructure to pull in fwupdate on known machines. As far as I understand, my UEFI desktop will never receive fwupdate based updates, because board manufacturer doesn't provide things like that.

Ubiquity doesn't today install both an MBR and UEFI bootloader, so making that work does require extra planning and effort.

The tool, efi and signed-efi are actually all separate packages. fwupdate-signed depends upon fwupdate. fwupd provides the userspace tool.

It's hard to predict what machines will be getting UEFI capsule updates from LVFS and install from ubuntu-drivers because a manufacturer can start using it at any time. That would mean ubuntu-drivers would need to download the metadata daily, compare the ESRT and only install if your machine is applicable. At that point it definitely is easier if the tools are just "there" already.