Re: Bug#1131862: Bug#1131861: trixie-pu: package shim/16.1-1~deb13u1
On Wed, May 06, 2026 at 06:36:16PM +0100, Steve McIntyre wrote: >On Thu, Apr 30, 2026 at 08:57:10PM +0100, Steve McIntyre wrote: >> >>We're making progress, but it's slow. The SPI account for shim signing >>is undergoing renewed vetting now, but despite me pushing people and >>saying this is urgent it's taking time. I'm really not expecting to >>have signed shims back in time for the next point release. >> >>I'll update again as and when I have more to share. > >After a lot of chasing, we've managed to upload things *now*. Hoping >that we should get fast turnaround, let's see. > >If so, I'll be asking for new shim-signed packages to go in as well of >course. Pushing it on time, I know... :-/ We finally received the signed shims on Wednesday 13th. I'm working on prepping the matching shim-signed updates now so we'll have things ready for the next point release - obviously we're way too late for this weekend. -- Steve McIntyre, Cambridge, [email protected] Can't keep my eyes from the circling sky, Tongue-tied & twisted, Just an earth-bound misfit, I...
Re: Bug#1131862: Bug#1131861: trixie-pu: package shim/16.1-1~deb13u1
On Thu, Apr 30, 2026 at 08:57:10PM +0100, Steve McIntyre wrote: > >We're making progress, but it's slow. The SPI account for shim signing >is undergoing renewed vetting now, but despite me pushing people and >saying this is urgent it's taking time. I'm really not expecting to >have signed shims back in time for the next point release. > >I'll update again as and when I have more to share. After a lot of chasing, we've managed to upload things *now*. Hoping that we should get fast turnaround, let's see. If so, I'll be asking for new shim-signed packages to go in as well of course. Pushing it on time, I know... :-/ -- Steve McIntyre, Cambridge, [email protected] "Yes, of course duct tape works in a near-vacuum. Duct tape works anywhere. Duct tape is magic and should be worshipped." -― Andy Weir, "The Martian"
Re: Bug#1131862: Bug#1131861: trixie-pu: package shim/16.1-1~deb13u1
On Fri, Apr 17, 2026 at 11:41:39AM +0100, Steve McIntyre wrote: >Hey folks, > >Update for reference... > >On Mon, Apr 06, 2026 at 04:17:23PM +0100, Steve McIntyre wrote: >>On Mon, Apr 06, 2026 at 04:00:23PM +0100, Jonathan Wiltshire wrote: > >... > >>But before we get there, I need to get build logs and binaries for >>these unsigned shims - we need that for the review process. So if you >>could accept these sources that would be appreciated. :-) > >We submitted the new shims for review and signing in the last couple >of weeks. Review is going very well, as expected. But there are >problems with the process of submitting to Microsoft. I'm chasing >contacts there to help, and I'll keep you updated. We're making progress, but it's slow. The SPI account for shim signing is undergoing renewed vetting now, but despite me pushing people and saying this is urgent it's taking time. I'm really not expecting to have signed shims back in time for the next point release. I'll update again as and when I have more to share. -- Steve McIntyre, Cambridge, [email protected] “Rarely is anyone thanked for the work they did to prevent the disaster that didn’t happen.” -- Mikko Hypponen (https://twitter.com/mikko/)
Re: Bug#1131862: Bug#1131861: trixie-pu: package shim/16.1-1~deb13u1
Hey folks, Update for reference... On Mon, Apr 06, 2026 at 04:17:23PM +0100, Steve McIntyre wrote: >On Mon, Apr 06, 2026 at 04:00:23PM +0100, Jonathan Wiltshire wrote: ... >But before we get there, I need to get build logs and binaries for >these unsigned shims - we need that for the review process. So if you >could accept these sources that would be appreciated. :-) We submitted the new shims for review and signing in the last couple of weeks. Review is going very well, as expected. But there are problems with the process of submitting to Microsoft. I'm chasing contacts there to help, and I'll keep you updated. -- Steve McIntyre, Cambridge, [email protected] Google-bait: https://www.debian.org/CD/free-linux-cd Debian does NOT ship free CDs. Please do NOT contact the mailing lists asking us to send them to you.
Re: Bug#1131862: Bug#1131861: trixie-pu: package shim/16.1-1~deb13u1
On Mon, Apr 06, 2026 at 04:00:23PM +0100, Jonathan Wiltshire wrote:
>On Sun, Apr 05, 2026 at 09:47:45PM +0100, Steve McIntyre wrote:
>> Again, following up on both bugs for a different reason.
>>
>> I've ended up uploading versions of shim for bookworm and trixie with
>> slightly different versions to match up with the latest version I've
>> uploaded in unstable.
>>
>> I'm not seeing any sign of builds happening in either case, so I guess
>> I need to ask for an update to allow that? Pretty please! :-)
>>
>> I now have:
>>
>> shim/16.1-2~deb13u1 in trixie (#1131861)
>> shim/16.1-2~deb12u1 in bookworm (#1131862)
>
>Builds won't start until the sources are accepted, after which they will be
>automatically added to {,oldstable-}proposed-updates and roll out to users
>of those suites.
>
>If I understand right, that will break secure boot for grub for those users
>because of the change of sbat level? Therefore should we get grub2
>accepted and built first? Where will updating shim leave users while we
>await shim-signed?
The change of SBAT will not take effect until we have those signed
shims for people to install, in fact. So we'll need to make sure that
the new shim-signed and signed grub packages hit bookworm together,
that's all. Trixie already contains updated grub packages so it will
be ok.
But before we get there, I need to get build logs and binaries for
these unsigned shims - we need that for the review process. So if you
could accept these sources that would be appreciated. :-)
--
Steve McIntyre, Cambridge, [email protected]
Is there anybody out there?
Re: Bug#1131862: Bug#1131861: trixie-pu: package shim/16.1-1~deb13u1
On Sun, Apr 05, 2026 at 09:47:45PM +0100, Steve McIntyre wrote:
> Again, following up on both bugs for a different reason.
>
> I've ended up uploading versions of shim for bookworm and trixie with
> slightly different versions to match up with the latest version I've
> uploaded in unstable.
>
> I'm not seeing any sign of builds happening in either case, so I guess
> I need to ask for an update to allow that? Pretty please! :-)
>
> I now have:
>
> shim/16.1-2~deb13u1 in trixie (#1131861)
> shim/16.1-2~deb12u1 in bookworm (#1131862)
Builds won't start until the sources are accepted, after which they will be
automatically added to {,oldstable-}proposed-updates and roll out to users
of those suites.
If I understand right, that will break secure boot for grub for those users
because of the change of sbat level? Therefore should we get grub2
accepted and built first? Where will updating shim leave users while we
await shim-signed?
--
Jonathan Wiltshire [email protected]
Debian Developer http://people.debian.org/~jmw
4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC 74C3 5394 479D D352 4C51
ed25519/0x196418AAEB74C8A1: CA619D65A72A7BADFC96D280196418AAEB74C8A1
