Building Ubuntu noble VM from `images/ubuntu.yaml` produces an image that doesn't immediately boot about lxc-ci HOT 6 CLOSED

Yep, that's why we're not currently building noble images on our image server :)

Someone needs to figure out what changed in Ubuntu between mantic and noble and how to fix the YAML for it.

from lxc-ci.

From initial testing, changing grub-install --uefi-secure-boot --target="${TARGET}-efi" --no-nvram --removable to grub-install --no-uefi-secure-boot --target="${TARGET}-efi" --no-nvram --removable changes something to allow grub to continue without user intervention.

When --uefi-secure-boot is given, the grub-mkimage command is invoked as follows (this can be determined adding the -v flag to grub-install in the post-files action):

grub-install: info: grub-mkimage --directory '/usr/lib/grub/x86_64-efi' --prefix '/boot/grub' --output '/boot/grub/x86_64-efi/core.efi'  --dtb '' --sbat '' --format 'x86_64-efi' --compression 'auto'   --config '/boot/grub/x86_64-efi/load.cfg' 'ext2' 'part_gpt' 'search_fs_uuid' 

When --no-uefi-secure-boot is given, the command is:

grub-install: info: grub-mkimage --directory '/usr/lib/grub/x86_64-efi' --prefix '(,gpt2)/boot/grub' --output '/boot/grub/x86_64-efi/core.efi'  --dtb '' --sbat '' --format 'x86_64-efi' --compression 'auto'   'ext2' 'part_gpt' 

from lxc-ci.

In images/debian.yaml, the post-files action which installs grub runs grub-install twice (https://github.com/lxc/lxc-ci/blob/e5f93e469bdab592d29b10128df79b0a7e5358ad/images/debian.yaml#L1471C1-L1474C72):

    # This will create EFI/BOOT
    grub-install --uefi-secure-boot --target="${TARGET}-efi" --no-nvram --removable
    # This will create EFI/debian
    grub-install --uefi-secure-boot --target="${TARGET}-efi" --no-nvram

As both grub2 in Ubuntu and Debian are carrying the patch for installing signed copies, and the Debian sid is still passing I wondered if the second invocation does something.

The grub-mkimage command invoked when installing with --removable is:

grub-mkimage --directory '/usr/lib/grub/x86_64-efi' --prefix '/boot/grub' --output '/boot/grub/x86_64-efi/core.efi'  --dtb '' --sbat '' --format 'x86_64-efi' --compression 'auto'   --config '/boot/grub/x86_64-efi/load.cfg' 'ext2' 'part_gpt' 'search_fs_uuid'

And without --removable,

grub-mkimage --directory '/usr/lib/grub/x86_64-efi' --prefix '' --output '/boot/grub/x86_64-efi/grub.efi'  --dtb '' --sbat '' --format 'x86_64-efi' --compression 'auto'   --config '/boot/grub/x86_64-efi/load.cfg' 'ext2' 'part_gpt' 'search_fs_uuid' 

Including both grub-install statements results in an image that passes through grub without user intervention.

I also tested using only grub-install --uefi-secure-boot --target="${TARGET}-efi" --no-nvram in the post-files action: this worked and the system booted without user interaction.

from lxc-ci.

@stgraber I see you comitted a change to sync the ubuntu.yaml and debian.yaml. I think it might be worth trying to figure out if using only a single grub-install invocation works across multiple releases. It could be that the original reasons for running it twice are no longer applicable.

from lxc-ci.

Thanks a lot for the detective work. I just pushed a couple of fixes to align Debian and Ubuntu.

It certainly sounds like calling without --removable would be sufficient, though I think it's still safer to perform both calls as in theory, --removable should install the bootx64.efi and the normal call should install grubx64.efi.

This isn't quite as simple as that since the shim also needs to be installed and is actually what ends up being bootx64.efi, but I can't be sure that both always get installed in all the right places on all versions of Ubuntu and Debian that folks build images for, calling the install twice doesn't really cost much, so let's just do that ;)

from lxc-ci.

Sounds good to me. Thanks for comitting a fix :)

from lxc-ci.