diff options
| -rw-r--r-- | debian/changelog | 8 | ||||
| -rw-r--r-- | debian/shim-signed.preinst.in | 8 |
2 files changed, 15 insertions, 1 deletions
diff --git a/debian/changelog b/debian/changelog index 8a0bda7..b319c63 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,11 @@ +shim-signed (1.50) unstable; urgency=medium + + * Fix up stupid omission in the previous package upload - the + changes in 1.49 did not take into account the "SecureBoot enabled" + case when adding a default error trap. Closes: #1137098, #1137101. + + -- Steve McIntyre <93sam@debian.org> Tue, 19 May 2026 23:35:39 +0100 + shim-signed (1.49) unstable; urgency=medium * Make mokutil parsing more robust. Closes: #1137063 diff --git a/debian/shim-signed.preinst.in b/debian/shim-signed.preinst.in index cfbcc8c..a6c3443 100644 --- a/debian/shim-signed.preinst.in +++ b/debian/shim-signed.preinst.in @@ -51,7 +51,9 @@ case "$type" in else # Check that we can safely boot this shim. # We don't care if the platform is in setup mode. - SB_STATE=$(mokutil --sb-state 2>&1 | grep -v "Platform is in Setup Mode") + SB_STATE=$(mokutil --sb-state 2>&1 | grep -v \ + -e "Platform is in Setup Mode" \ + -e "SecureBoot validation is disabled in shim") # If SB is not enabled (etc.) then this shim is fine case "${SB_STATE}" in "SecureBoot disabled"|"This system doesn't support Secure Boot") @@ -62,6 +64,10 @@ case "$type" in echo " ${SB_STATE}; assuming shim installation is safe." SB_BOOT_ERROR=$ERR_NONE ;; + "SecureBoot enabled") + echo " ${SB_STATE}; need to check for signatures." + SB_BOOT_ERROR=$ERR_NO_VALID_SIG + ;; *) echo "Unexpected output from mokutil:" echo '"""' |