unsigned images installed

Asked by Sebastian Goette

I've installed Ubuntu 12.04.2 on a Medion Akoya laptop with Windows 8 preinstalled. Afterwards, Windows wouldn't boot, so I've run boot-repair from ppa:yannubuntu/boot-repair-dev (see log under http://paste.ubuntu.com/5588724/) . Then it was possible to boot windows.
On the other hand, I could only get Ubuntu to run by selecting an older version of the kernel (3.5.0-17) manually in grub under "Advanced Options" (It took me a few days to find this out). The reason is that boot-repair left two newer unsigned kernel versions behind (3.5.0-23 and 3.5.0-25). I have now installed the corresponding EFI signature packages manually, but maybe a future version of boot repair could do this automatically.
Also, I wonder if future automated updates will load the signature packages correctly.

Question information

Language:
English Edit question
Status:
Expired
For:
Boot-Repair Edit question
Assignee:
YannUbuntu Edit question
Last query:
Last reply:
Revision history for this message
YannUbuntu (yannubuntu) said :
#1

Hi Sebastian, thanks for your feedback.
Boot-Repair should handle correctly EFI signatures, so you should transform this question into a bug report.

According to the log, Boot-Repair should have installed a signed version of the newest kernel (3.5.0-25), and left the other kernels unsigned (3.5.0-17 and 3.5.0-23).

How did you check that 3.5.0-25 was unsigned ?
Which signature packages did you install manually ?

Revision history for this message
Sebastian Goette (sebastian-goette) said :
#2

Dear YannUbuntu,

thanks for the quick response. I thought about a bug report, but maybe it is a "linux-signed-generic" bug?

Here are the commands that boot-repair asked me to type in (copied from .bash_history)

sudo dpkg --configure -a
sudo apt-get install -fy
sudo apt-get purge -y --force-yes grub*-common shim-signed linux-signed*
sudo apt-get install -y --force-yes grub-efi-amd64-signed shim-signed linux-signed-generic

The purge command told me that one could remove the 3.5.0-23 version, but it seems to have stayed installed.
The install command then loaded a bunch of 3.5.0-17 packages (if apt keeps a log and you tell me where it is, I will mail it to you). I noticed that because of the lower version number.

When booting the standard option (3.5.0-25), the screen simply stayed pink. After I found out that I could boot the 3.5.0-17 kernel, I installed "synaptics" and had a look at the installed packages. The 3.5.0-17 version had two extra package named "linux-signed-image-3.5.0-17-generic" and "linux-image-extra-3.5.0-17-generic". The other kernel packages were installed for all three versions. So I tried to install the corresponding 3.5.0-25 packages. I only found the signed image package.

Another point: linux-signed-generic depends on linux-signed-image-generic, and both have newest version 3.5.0.17.19 (it says: download: not available in synaptics package properties window. Icannot tell you which repository it came from). Also, linux-image-extra exists only in version 3.5.0-17. I do not if that helps.

If you still think that I should file a bug report, I will do that. But for boot-repair, or for some of the kernel
packages?

Best wishes, Sebastian

Revision history for this message
YannUbuntu (yannubuntu) said :
#3

Your linux-signed-image-generic package should have been version 3.5.0-25, so maybe you had a package problem.

Please could you indicate the content of the following commands?

dpkg-query -W -f='${Version}' linux-signed-image-generic
grep main /etc/apt/sources.list
ls /etc/apt/sources.list.d

Revision history for this message
Sebastian Goette (sebastian-goette) said :
#4

Hi,

here you are

> dpkg-query -W -f='${Version}' linux-signed-image-generic
3.5.0.17.19

> grep main /etc/apt/sources.list
# deb cdrom:[Ubuntu 12.04.2 LTS _Precise Pangolin_ - Release amd64 (20130213)]/ dists/precise/main/binary-i386/
# deb cdrom:[Ubuntu 12.04.2 LTS _Precise Pangolin_ - Release amd64 (20130213)]/ precise main restricted
deb http://de.archive.ubuntu.com/ubuntu/ precise main restricted
deb-src http://de.archive.ubuntu.com/ubuntu/ precise main restricted
deb http://de.archive.ubuntu.com/ubuntu/ precise-updates main restricted
deb-src http://de.archive.ubuntu.com/ubuntu/ precise-updates main restricted
## extensively as that contained in the main release, although it includes
deb http://de.archive.ubuntu.com/ubuntu/ precise-backports main restricted universe multiverse
deb-src http://de.archive.ubuntu.com/ubuntu/ precise-backports main restricted universe multiverse
deb http://security.ubuntu.com/ubuntu precise-security main restricted
deb-src http://security.ubuntu.com/ubuntu precise-security main restricted
deb http://extras.ubuntu.com/ubuntu precise main
deb-src http://extras.ubuntu.com/ubuntu precise main

> ls /etc/apt/sources.list.d
yannubuntu-boot-repair-precise.list

Revision history for this message
YannUbuntu (yannubuntu) said :
#5

strange, I can't find linux-signed-image-generic 3.5.0.17.19 here: http://packages.ubuntu.com/search?keywords=linux-signed-image-generic
How many weeks ago did you use Boot-Repair ?

Revision history for this message
Sebastian Goette (sebastian-goette) said :
#6

Dear YannUbuntu,

according to the log file, it was last tuesday, and I donwloaded it from
your ppa immediately before use.

When I tried to install the most recent signed image, I also noticed that
in synaptic, the package "linux-signed-generic" was tagged "unavailable".
However, it was definitely downloaded by bott-repair.

I am including the relevant parts of /var/log/apt/history.log and
/var/log/apt/term.log in the hope that it will help you.

If there are other logs that you would like to see, please tell me
quickly, because my son will take the computer starting from monday
morning.

Best wishes,
  Sebastian Goette

PS: I could file a bug report, but at which place? It is not clear to me
that this is a bug in boot-repair.

> Your question #223499 on Boot-Repair changed:
> https://answers.launchpad.net/boot-repair/+question/223499
>
> Status: Open => Needs information
>
> YannUbuntu requested more information: strange, I can't find
> linux-signed-image-generic 3.5.0.17.19 here:
> http://packages.ubuntu.com/search?keywords=linux-signed-image-generic
> How many weeks ago did you use Boot-Repair ?
>
>

--
Sebastian Goette Tel.: ++49-761/2035571, Fax.: ++49-761/2035541.
Mathematisches Institut, Universitaet Freiburg, Eckerstr. 1, D79104 Freiburg.
         e-mail: <email address hidden>
         WWW: http://home.mathematik.uni-freiburg.de/goette/

Revision history for this message
YannUbuntu (yannubuntu) said :
#7

hi Sebastian
can you reproduce the bug with the last version from the PPA? (ppa:yannubuntu/boot-repair)

if yes, please open a bug report.

Revision history for this message
Sebastian Goette (sebastian-goette) said :
#8

Dear YannUbuntu,

I thought that problem was resolved for quite some time by now.

Anyway, thanks for your help,
  Sebastian

> Your question #223499 on Boot-Repair changed:
> https://answers.launchpad.net/boot-repair/+question/223499
>
> Status: Open => Answered
>
> YannUbuntu proposed the following answer:
> hi Sebastian
> can you reproduce the bug with the last version from the PPA? (ppa:yannubuntu/boot-repair)
>
> if yes, please open a bug report.
>
>

--
Sebastian Goette Tel.: ++49-761/2035571, Fax.: ++49-761/2035541.
Mathematisches Institut, Universitaet Freiburg, Eckerstr. 1, D79104 Freiburg.
         e-mail: <email address hidden>
         WWW: http://home.mathematik.uni-freiburg.de/goette/

Revision history for this message
YannUbuntu (yannubuntu) said :
#9

won't fix. Boot-Repair is not a tool to clean-up old kernels