diff options
| -rw-r--r-- | debian/changelog | 8 | ||||
| -rw-r--r-- | debian/shim-signed.preinst.in | 29 |
2 files changed, 24 insertions, 13 deletions
diff --git a/debian/changelog b/debian/changelog index 0eeeb78..8a0bda7 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,8 +1,10 @@ -shim-signed (1.49) UNRELEASED; urgency=medium +shim-signed (1.49) unstable; urgency=medium - * Make sure we remove shim-signed.preinst during clean + * Make mokutil parsing more robust. Closes: #1137063 + + Cope with "Platform is in Setup Mode" message + + If we get any other unexpected output, print what we got for debugging. - -- Steve McIntyre <93sam@debian.org> Mon, 18 May 2026 14:10:06 +0100 + -- Steve McIntyre <93sam@debian.org> Tue, 19 May 2026 09:42:16 +0100 shim-signed (1.48) unstable; urgency=medium diff --git a/debian/shim-signed.preinst.in b/debian/shim-signed.preinst.in index 6f3e13c..cfbcc8c 100644 --- a/debian/shim-signed.preinst.in +++ b/debian/shim-signed.preinst.in @@ -50,18 +50,27 @@ case "$type" in SB_BOOT_ERROR=$ERR_NONE else # Check that we can safely boot this shim. - SB_STATE=$(mokutil --sb-state 2>&1 || true) + # We don't care if the platform is in setup mode. + SB_STATE=$(mokutil --sb-state 2>&1 | grep -v "Platform is in Setup Mode") # If SB is not enabled (etc.) then this shim is fine - case $SB_STATE in + case "${SB_STATE}" in "SecureBoot disabled"|"This system doesn't support Secure Boot") - echo " $SB_STATE; shim installation is safe." - SB_BOOT_ERROR=$ERR_NONE - ;; - "EFI variables are not supported on this system") - echo " $SB_STATE; assuming shim installation is safe." - SB_BOOT_ERROR=$ERR_NONE - ;; - esac + echo " ${SB_STATE}; shim installation is safe." + SB_BOOT_ERROR=$ERR_NONE + ;; + "EFI variables are not supported on this system"|"Cannot determine secure boot state") + echo " ${SB_STATE}; assuming shim installation is safe." + SB_BOOT_ERROR=$ERR_NONE + ;; + *) + echo "Unexpected output from mokutil:" + echo '"""' + echo "${SB_STATE}" + echo '"""' + echo "Please report this as a bug agsinst shim-signed, including the above information." + exit 1 + ;; + esac fi if [ $SB_BOOT_ERROR != $ERR_NONE ]; then |