Package: shim-signed
Version: 1.51~1+deb13u1+16.1-2~deb13u1
Severity: important
X-Debbugs-Cc: [email protected]
Dear Maintainer,
Upgrading shim-signed from 1.47+15.8-1 to 1.51~1+deb13u1+16.1-2~deb13u1 fails
in the package pre-installation script on a
system whose firmware supports UEFI booting but apparently does not implement
UEFI Secure Boot variables.
The system is a Supermicro X10SLH-F. It is booted in UEFI mode, and efivarfs is
mounted normally.
However, the firmware does not expose the SetupMode or SecureBoot variables,
and the Aptio firmware setup utility contains
no Secure Boot configuration menus.
The failure occurred during a routine upgrade:
apt update && apt upgrade -y
The relevant output was:
Preparing to unpack .../shim-signed_1.51~1+deb13u1+16.1-2~deb13u1_amd64.deb
...
shim-signed: checking if we can safely install
/usr/lib/shim/shimx64.efi.signed
Unexpected output from mokutil:
"""
Failed to read "SetupMode" variable: No such file or directory
"""
Please report this as a bug agsinst shim-signed, including the above
information.
dpkg: error processing archive
.../shim-signed_1.51~1+deb13u1+16.1-2~deb13u1_amd64.deb (--unpack):
new shim-signed:amd64 package pre-installation script subprocess returned
error exit status 1
The package upgrade therefore aborts and leaves dpkg in a partially
completed transaction.
* What led up to the situation?
* What exactly did you do (or not do) that was effective (or
ineffective)?
* What was the outcome of this action?
* What outcome did you expect instead?
The following checks confirm that the machine is booted using UEFI and that
efivarfs is mounted:
$ test -d /sys/firmware/efi && echo UEFI
UEFI
$ findmnt /sys/firmware/efi/efivars
TARGET SOURCE FSTYPE OPTIONS
/sys/firmware/efi/efivars efivarfs efivarfs rw,nosuid,nodev,noexec,relatime
mokutil produces:
$ mokutil --sb-state
Failed to read "SetupMode" variable: No such file or directory
The motherboard firmware supports normal UEFI booting, EFI boot entries, and
EFI runtime variables, but appears not to
implement Secure Boot.
There are no Secure Boot, Key Management, PK, KEK, db, or dbx settings in the
motherboard's firmware setup utility.
Expected result:
The package should recognize firmware without Secure Boot support, or allow
installation to continue with a warning or
explicit administrator override.
Actual result:
The pre-installation script treats mokutil's failure to read SetupMode as fatal
and blocks the complete apt/dpkg transaction.
This system was originally installed by the Debian installer in UEFI mode.
shim-signed was installed automatically as part of that installation; Secure
Boot was not enabled.
Motherboard:
Manufacturer: Supermicro
Model: X10SLH-F
BIOS version: 3.4
BIOS release date: 01/21/2021
Please let me know if additional EFI variable or firmware information would be
useful.
-- System Information:
Debian Release: 13.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.95+deb13-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages shim-signed depends on:
ii grub-efi-amd64-bin 2.12-9+deb13u2
ii grub2-common 2.12-9+deb13u2
ii shim-helpers-amd64-signed 1+16.1+2~deb13u1
ii shim-signed-common 1.51~1+deb13u1+16.1-2~deb13u1
shim-signed recommends no packages.
shim-signed suggests no packages.
-- debconf information:
shim-signed/revoked-sig:
shim-signed/no-valid-sigs:
