Bug#1108278: shim-signed: Asks to disable EFI Secure Boot with enrolled DKMS key

[Guillem Jover <guillem@debian.org>]

Hi!

On Tue, 2025-07-29 at 20:20:30 +0100, Steve McIntyre wrote:
> As you'll have seen, I've just uploaded the new shim-signed and it's
> just been built in unstable.

Thanks for the fix!

> I've tested the changes on a few machines here (of course!), but I'd
> love it if you could also test it for me on your setups. DKMS can vary
> widely, as I've found in the past...

I've just upgraded now the system where I initially noticed this, and
everything went fine. This was the output:

  ,---
  (Reading database ... 361429 files and directories currently installed.)
  Preparing to unpack .../shim-signed-common_1.47+15.8-1_all.deb ...
  Unpacking shim-signed-common (1.47+15.8-1) over (1.46+15.8-1) ...
  Preparing to unpack .../shim-signed_1.47+15.8-1_amd64.deb ...
  Unpacking shim-signed:amd64 (1.47+15.8-1) over (1.46+15.8-1) ...
  Setting up shim-signed-common (1.47+15.8-1) ...
  /usr/sbin/update-secureboot-policy: Checking status of DKMS module signing:
    [ OK ] System DKMS key found in /var/lib/dkms/mok.pub
    [ OK ] System DKMS key is registered via MOK
    [ OK ] All DKMS modules signed with the DKMS key
  All OK, nothing to do.
  Setting up shim-signed:amd64 (1.47+15.8-1) ...
  Installing for x86_64-efi platform.
  Installation finished. No error reported.
  /usr/sbin/update-secureboot-policy: Checking status of DKMS module signing:
    [ OK ] System DKMS key found in /var/lib/dkms/mok.pub
    [ OK ] System DKMS key is registered via MOK
    [ OK ] All DKMS modules signed with the DKMS key
  All OK, nothing to do.
  `---

Regards,
Guillem