[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#990082: marked as done (High chance of boot problems with buster's version of arm64 shim)

Your message dated Wed, 23 Jun 2021 18:18:51 +0000
with message-id <E1lw7Sd-0004Ms-LF@fasolo.debian.org>
and subject line Bug#990082: fixed in shim 15.4-6
has caused the Debian Bug report #990082,
regarding High chance of boot problems with buster's version of arm64 shim
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org

990082: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990082
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Package: shim-signed
Version: 1.36~1+15.4-5~deb10u1
Severity: grave


In pre-release testing I found problems with shim on signed versions
of shim on arm64. The shim binary crashes very early (Synchronous
Exception). Because of that problem, I took the hard decision to
disable Secure Boot support for arm64 in Debian Buster until a
solution could be found:


In testing a new build to go into Buster, I found that non-signed
versions were working fine on various machines. Unfortunately, it
seems that the boot issues might be affected by environment. Trying
the same binary build today as part of the 10.10 point release,
booting an installer image crashes repeatably in a VM. It also seems
that at least one of Debian's own arm64 hosts has been similarly
affected. :-(

Arm64 users are **strongly** advised to be careful about upgrading to
the latest Buster point release (10.10). If upgrading immediately, it
is recommended to disable remove shim-signed and reinstall GRUB on those
systems to ensure that they will continue to boot:

# apt-get remove shim-signed
# dpkg --reconfigure grub-efi-amd64

and disable Secure Boot in their system firmware if it's enabled.

I'm working on a more user-friendly fix now, and I hope to push it out
via the Buster security archive shortly. This will still not be
*working* Secure Boot for arm64, as we're still awaiting better
toolchain support to make that work.

-- System Information:
Debian Release: 10.9
  APT prefers stable-debug
  APT policy: (500, 'stable-debug'), (500, 'stable'), (500, 'oldstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-0.bpo.5-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_CPU_OUT_OF_SPEC
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages shim-signed depends on:
ii  grub-efi-amd64-bin         2.02+dfsg1-20+deb10u4
ii  grub2-common               2.02+dfsg1-20+deb10u4
ii  shim-helpers-amd64-signed  1+15.4+2~deb10u1

Versions of packages shim-signed recommends:
pn  secureboot-db  <none>

shim-signed suggests no packages.

-- debconf information excluded

--- End Message ---
--- Begin Message ---
Source: shim
Source-Version: 15.4-6
Done: Steve McIntyre <93sam@debian.org>

We believe that the bug you reported is fixed in the latest version of
shim, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 990082@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
Steve McIntyre <93sam@debian.org> (supplier of updated shim package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)

Hash: SHA256

Format: 1.8
Date: Wed, 23 Jun 2021 19:03:54 +0100
Source: shim
Architecture: source
Version: 15.4-6
Distribution: unstable
Urgency: high
Maintainer: Debian EFI team <debian-efi@lists.debian.org>
Changed-By: Steve McIntyre <93sam@debian.org>
Closes: 989962 990082 990158 990190
 shim (15.4-6) unstable; urgency=high
   * Add arm64 patch to tweak section layout and stop crashing
     problems. Upstream issue #371. Closes: #990082, #990190
   * In insecure mode, don't abort if we can't create the MokListXRT
     variable. Upstream issue #372. Closes: #989962, #990158
 2112b70489b4660c77eeb63207f54628fd0c5c04 2300 shim_15.4-6.dsc
 a2242f538b3f7e826b8ee78ef8caa49a9e766643 33932 shim_15.4-6.debian.tar.xz
 0409d674a6becceb329de2e29f8561fdd0ea0fdd 6054 shim_15.4-6_source.buildinfo
 0316b340550238a3fb4cbb2a2b2a736fc93ba460327000032c1e683ee1db8831 2300 shim_15.4-6.dsc
 624357f05fdbf212523d9adcc6c4f92c03b442b3fb76732576ab56c756d8834a 33932 shim_15.4-6.debian.tar.xz
 dfb64efa1657ea734dc16cb07f9e497faa23cd11a58420e38bc62b21a38fefcf 6054 shim_15.4-6_source.buildinfo
 55b09f08418b65e28a14bbb7a27bfbda 2300 admin optional shim_15.4-6.dsc
 99e10023060aea0b923d3f566b415554 33932 admin optional shim_15.4-6.debian.tar.xz
 e41eaf923d9217c0afc50ed5177ab2d3 6054 admin optional shim_15.4-6_source.buildinfo



--- End Message ---

Reply to: