Acknowledgement sent
to Niels Thykier <[email protected]>:
Extra info received and forwarded to list. Copy sent to Debian EFI team <[email protected]>.
(Sat, 28 Dec 2024 12:21:01 GMT) (full text, mbox, link).
Control: tags -1 patch
On Sat, 7 Dec 2024 21:37:28 +0100 Niels Thykier <[email protected]> wrote:
> Source: shim
> Version: 15.8-1
> Severity: important
> Tags: ftbfs
> Justification: FTBFS
> X-Debbugs-Cc: [email protected]
> User: [email protected]
> Usertags: rrr-no-as-default-issue
>
> Dear maintainer,
>
> During a test rebuild for building packages with
> `Rules-Requires-Root: no` as the default in `dpkg`,
> shim failed to rebuild.
>
> [...]
There is an MR at
https://salsa.debian.org/efi-team/shim/-/merge_requests/17 with a patch
for how to solve this.
Best regards,
Niels
Acknowledgement sent
to Niels Thykier <[email protected]>:
Extra info received and forwarded to list. Copy sent to Debian EFI team <[email protected]>.
(Sat, 04 Jan 2025 09:03:01 GMT) (full text, mbox, link).
On Sat, 28 Dec 2024 13:00:45 +0100 Niels Thykier <[email protected]> wrote:
> Control: tags -1 patch
>
> [...]
>
> There is an MR at
> https://salsa.debian.org/efi-team/shim/-/merge_requests/17 with a patch
> for how to solve this.
>
> Best regards,
> Niels
>
Hi
The bugs are now become RC (both this for shim and the one for
shim-helpers-arm64-signed).
I can do an NMU for this package to resolve the RC bug. However, I am
not sure if will be helpful or just be in the way. My end goal is to
have the bug fixed in testing and I am not sure my fix would transition
(I am unclear on how the shim signing interacts with the packages and
the transition).
Note the patch does not affect the produced binaries but there has been
changes to the toolchains changing a "MinorLinkerVersion" and a
"CheckSum" field in many of the efi files. I assume this means it will
need a resign on upload and I don't remember if it is something Debian
can just do.
There are also a lot of changes in shim-helpers-amd64-helpers that I do
not understand which includes a whole debian/ subdir under
"usr/share/code-signing/shim-helpers-amd64-signed-template/source-template",
which are unrelated to my change (FWIW, I built from git rather than a
minimum patch on top of latest sid version).
So, we are back to: Would it be helpful if I NMUed the shim or/and
shim-helpres-arm64-signed package? If not, then I will leave it in your
capable hands.
Best regards,
Niels
Acknowledgement sent
to Steve McIntyre <[email protected]>:
Extra info received and forwarded to list. Copy sent to Debian EFI team <[email protected]>.
(Sat, 04 Jan 2025 17:45:01 GMT) (full text, mbox, link).
Subject: Re: shim: Supporting rootless builds by default
Date: Sat, 4 Jan 2025 17:43:11 +0000
Hey Niels!
On Sat, Jan 04, 2025 at 09:59:06AM +0100, Niels Thykier wrote:
>On Sat, 28 Dec 2024 13:00:45 +0100 Niels Thykier <[email protected]> wrote:
>> Control: tags -1 patch
>>
>> [...]
>>
>> There is an MR at
>> https://salsa.debian.org/efi-team/shim/-/merge_requests/17 with a patch
>> for how to solve this.
>>
>> Best regards,
>> Niels
>>
>
>Hi
>
>The bugs are now become RC (both this for shim and the one for
>shim-helpers-arm64-signed).
ACK.
>I can do an NMU for this package to resolve the RC bug. However, I am not
>sure if will be helpful or just be in the way. My end goal is to have the bug
>fixed in testing and I am not sure my fix would transition (I am unclear on
>how the shim signing interacts with the packages and the transition).
Thanks for being cautious and reaching out to me! In general, NMUing
shim is *never* the correct thing to do due to its special nature. The
interaction with the Microsoft signing (etc.) makes things difficult
here.
>Note the patch does not affect the produced binaries but there has been
>changes to the toolchains changing a "MinorLinkerVersion" and a "CheckSum"
>field in many of the efi files. I assume this means it will need a resign on
>upload and I don't remember if it is something Debian can just do.
>
>There are also a lot of changes in shim-helpers-amd64-helpers that I do not
>understand which includes a whole debian/ subdir under
>"usr/share/code-signing/shim-helpers-amd64-signed-template/source-template",
>which are unrelated to my change (FWIW, I built from git rather than a
>minimum patch on top of latest sid version).
>
>So, we are back to: Would it be helpful if I NMUed the shim or/and
>shim-helpres-arm64-signed package? If not, then I will leave it in your
>capable hands.
I'm looking at your MR now, thanks!
I should warn you: I'm *not* planning on doing a new upload of the
current packages soon, even so. There's a new upstream version due
soon, and I'll fold things in there.
--
Steve McIntyre, Cambridge, UK. [email protected]
"C++ ate my sanity" -- Jon Rabone
Acknowledgement sent
to Niels Thykier <[email protected]>:
Extra info received and forwarded to list. Copy sent to Debian EFI team <[email protected]>.
(Sun, 05 Jan 2025 08:06:01 GMT) (full text, mbox, link).
Steve McIntyre:
> Hey Niels!
>
> On Sat, Jan 04, 2025 at 09:59:06AM +0100, Niels Thykier wrote:
>> On Sat, 28 Dec 2024 13:00:45 +0100 Niels Thykier <[email protected]> wrote:
>>> Control: tags -1 patch
>>>
>>> [...]
>>>
>>> There is an MR at
>>> https://salsa.debian.org/efi-team/shim/-/merge_requests/17 with a patch
>>> for how to solve this.
>>>
>>> Best regards,
>>> Niels
>>>
>>
>> Hi
>> [...]
>>
>> So, we are back to: Would it be helpful if I NMUed the shim or/and
>> shim-helpres-arm64-signed package? If not, then I will leave it in your
>> capable hands.
>
> I'm looking at your MR now, thanks!
>
> I should warn you: I'm *not* planning on doing a new upload of the
> current packages soon, even so. There's a new upstream version due
> soon, and I'll fold things in there.
>
I had a feeling that might be case with the NMUs (I got a similar
feeling for debian-installer, that also turned out to be correct). I am
fine with leaving this as it is. The most important part is that it is
fixed before the freeze and I suspect the RT is ok knowing you got this.
Thanks for merging the patch! :)
Best regards,
Niels
Acknowledgement sent
to Kurt Roeckx <[email protected]>:
Extra info received and forwarded to list. Copy sent to Debian EFI team <[email protected]>.
(Sat, 26 Apr 2025 17:18:01 GMT) (full text, mbox, link).
Subject: Re: shim: Supporting rootless builds by default
Date: Sat, 26 Apr 2025 19:06:47 +0200
On Sat, Jan 04, 2025 at 05:43:11PM +0000, Steve McIntyre wrote:
>
> I'm looking at your MR now, thanks!
>
> I should warn you: I'm *not* planning on doing a new upload of the
> current packages soon, even so. There's a new upstream version due
> soon, and I'll fold things in there.
Do you have an update on this?
Kurt
Acknowledgement sent
to Steve McIntyre <[email protected]>:
Extra info received and forwarded to list. Copy sent to Debian EFI team <[email protected]>.
(Sun, 27 Apr 2025 15:24:01 GMT) (full text, mbox, link).
Subject: Re: shim: Supporting rootless builds by default
Date: Sun, 27 Apr 2025 16:19:14 +0100
On Sat, Apr 26, 2025 at 07:06:47PM +0200, Kurt Roeckx wrote:
>On Sat, Jan 04, 2025 at 05:43:11PM +0000, Steve McIntyre wrote:
>>
>> I'm looking at your MR now, thanks!
>>
>> I should warn you: I'm *not* planning on doing a new upload of the
>> current packages soon, even so. There's a new upstream version due
>> soon, and I'll fold things in there.
>
>Do you have an update on this?
Sorry, I've not been updating bugs here enough to share progress.
I've had changes for this ready for some time, just not pushed yet.
The shim 16.0 release has already happened upstream, and it passes CI
for me locally.
*However*, we're waiting on a bugfix for
https://github.com/rhboot/shim/issues/741
which is a show-stopper bug for secure boot chains where UKIs are
going to be a thing. A fix is coming Real Soon Now, I've been
promised. That's going to prompt a 16.1 release.
In the meantime, I really don't want to upload a 16.0 build, as that
makes things much more awkward in terms of the signing pipeline (etc.)
--
Steve McIntyre, Cambridge, UK. [email protected]
"Yes, of course duct tape works in a near-vacuum. Duct tape works
anywhere. Duct tape is magic and should be worshipped."
-― Andy Weir, "The Martian"
Debbugs is free software and licensed under the terms of the GNU General
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.