Bug#1051271: GRUB2 2.12~rc1-7 prevent machine to boot

[M. Zhou]

On Tue, 5 Sep 2023 18:11:55 +0200 "Miguel A. Vallejo"
<ea4eoz at gmail.com> wrote:
> M. Zhou wrote:
> 
> > But after that I noticed that the most important
> > package grub-efi-amd64-signed:amd64 (1+2.06+13,
> > 1+2.12~rc1+7) was not upgraded along with the other
> > grub packages.
> 
> You are right. I revised apt log and grub-efi-amd64-signed was NOT
> updated, in fact, the version I have installed now is 1+2.06+13, but
> all other grub packages have  2.06-3~deb11u5.
> 
> Now, if I run apt update, and apt list --upgradable it shows:
> 
> grub-common/unstable 2.12~rc1-7 amd64 [upgradable from: 2.06-
3~deb11u5]
> grub-efi-amd64-bin/unstable 2.12~rc1-7 amd64 [upgradable from: 2.06-
3~deb11u5]
> grub-efi-amd64-signed/unstable 1+2.12~rc1+7 amd64 [upgradable from:
1+2.06+13]
> grub-efi-amd64/unstable 2.12~rc1-7 amd64 [upgradable from: 2.06-
3~deb11u5]
> grub2-common/unstable 2.12~rc1-7 amd64 [upgradable from: 2.06-
3~deb11u5]
> 
> 
> All of them with version 2.12~rc1-7
> 
> Is it safe to upgrade now? I'll wait a bit until I hear from the
> package maintainers.

I am able to boot with 2.12~rc1-7 now. And my currrent status is

grub-common/unstable,now 2.12~rc1-7 amd64 [installed]
grub-efi-amd64-bin/unstable,now 2.12~rc1-7 amd64 [installed,automatic]
grub-efi-amd64-signed/unstable,now 1+2.12~rc1+7 amd64
[installed,automatic]
grub-efi-amd64/unstable,now 2.12~rc1-7 amd64 [installed,automatic]
grub2-common/unstable,now 2.12~rc1-7 amd64 [installed,automatic]

I reinstalled grub using 2.12~rc1-7.
But I still cannot guarantee it is safe to upgrade.


I believe the issue is the missing versioned dependency, which
allowed partial upgrade.

If you check the testing, you will find that

 grub-efi-amd64-signed/1+2.06+13 Depends: grub-common (>= 2.06-13)

Then, if we upgrade grub-common to 2.12~rc1-7, without
upgrading grub-efi-amd64-signed itself, then the boot is broken.

TLDR: the boot is broken with the following partial upgrade:
grub-common/2.12~rc1-7
grub-efi-amd64-signed/2.06+13

A possible fix might be specifying
 Depends: grub-common (>= 2.12~rc1-7)), grub-common (<= 2.13~)
to prevent incompatible grub-common and grub-efi-amd64-signed
from co-existing. Although it does not help this time.