Bug#984760: grub-efi-amd64: upgrade works, boot fails (error: symbol `grub_is_lockdown` not found)

[Ryan Thoryk]

On 7/17/21 10:09 AM, Ryan Thoryk wrote:
> On 7/17/21 9:44 AM, Steve McIntyre wrote:
> 
> I found that I was using an older ARM image from last year, but that 
> doesn't mean the issue was fixed later.  In AWS's community AMI section, 
> the main one I tried is listed as "debian-10-arm64-20200511-260".  When 
> you launch it, if you do a package upgrade it installs a newer version 
> of grub.  Then running a grub-install makes it unbootable.  If you do 
> the dpkg-reconfigure method, you have to choose "yes" to the "force 
> extra installation" question, if you choose "no", it won't boot anymore.
> 
> I tried launching a newer AMI, titled "debian-10-arm64-20210621-680", 
> and that one reboots fine if you do a "grub-install", but that's because 
> it didn't install a newer version of grub, since the packages are 
> recent.  I don't know what would happen if it installed a newer grub, 
> you might have to look into that.  In the boot folder the EFI boot 
> loader is listed as "/boot/efi/EFI/BOOT/BOOTAA64.EFI", there's no 
> "EFI/debian" folder.  I'm not sure what they did to generate the AMI image.
> 
> The AMI IDs I used are:
> ami-00249fe66e0872181
> and
> ami-025a7500c83d92798
> 
> I didn't try the Marketplace one.
> 

One thing to add to that - when I did a "grub-install" on the newer AMI, 
it didn't write a "EFI/debian" folder, just an "EFI/BOOT" folder, which 
means that it might be working properly.  If that's the case, then the 
older instances are broken, which would affect existing systems.  I'm 
not sure if a grub upgrade would change that or not.

-- 
Ryan Thoryk
ryan at thoryk.com
ryan at tliquest.net