Bug 1226017

Summary: fwupd fails TPM fw upgrade with 'Secure boot is enabled, but shim isn't installed to EFI/opensuse/shim.efi'
Product: [openSUSE] openSUSE Aeon Reporter: Gora <anselm.gora>
Component: BaseAssignee: Tseng <dennis.tseng>
Status: NEW --- QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P5 - None CC: rbrown, solutionroute
Version: Current   
Target Milestone: ---   
Hardware: x86-64   
OS: Other   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: os-release
/boot/ layout on Aeon

Description Gora 2024-06-05 21:14:23 UTC
User-Agent:       Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Build Identifier: 

fwupd expects to find EFI/opensuse/shim.efi while on openSUSE Aeon the path is  EFI/systemd/shim.efi

https://github.com/fwupd/fwupd/blob/eb3d26079d7b0e6f0db70b066fcb7b31ac7bcecf/plugins/uefi-capsule/fu-uefi-common.c fwupd seems to use os release ID but it's also a build option: https://github.com/fwupd/fwupd/blob/eb3d26079d7b0e6f0db70b066fcb7b31ac7bcecf/meson_options.txt#L491

Tumbleweed seems to patch it: https://build.opensuse.org/projects/openSUSE:Factory/packages/fwupd/files/fwupd-bsc1130056-change-shim-path.patch?expand=1 



Reproducible: Always
Comment 1 Gora 2024-06-05 21:15:53 UTC
Created attachment 875345 [details]
os-release
Comment 2 Gora 2024-06-05 21:16:44 UTC
Created attachment 875346 [details]
/boot/ layout on Aeon
Comment 3 Gary Ching-Pang Lin 2024-06-07 06:09:09 UTC
Assign to fwupd maintainer.
Comment 4 Tseng 2024-06-11 01:48:26 UTC
Would you please check where the cap/cab of updated shim location is ?
$ls /boot/efi/EFI/opensuse/fw
$ls /boot/efi/EFI/systemd/fw
$fwupdmgr --version
Comment 5 Richard Brown 2024-06-11 09:17:49 UTC
(In reply to Tseng from comment #4)
> Would you please check where the cap/cab of updated shim location is ?

It doesn't look like the cap/cab is present at all on any systemd-boot installation (tested on both MicroOS and Aeon)

> $ls /boot/efi/EFI/opensuse/fw

This path does not exist, all *SUSE distributions using systemd-boot do not have an 'opensuse' path, but only a systemd path.

> $ls /boot/efi/EFI/systemd/fw

ls /boot/efi/EFI/systemd/fw
ls: cannot access '/boot/efi/EFI/systemd/fw': No such file or directory

ls -lh /boot/efi/EFI/systemd/
total 2.0M
-rwxr-xr-x. 1 root root 827K Mar 14 06:58 MokManager.efi
-rwxr-xr-x. 1 root root   64 Jun  7 01:06 boot.csv
-rwxr-xr-x. 1 root root  96K May 31 13:37 grub.efi
-rwxr-xr-x. 1 root root   14 Jun  7 01:06 installed_by_sdbootutil
-rwxr-xr-x. 1 root root 913K Mar 14 06:58 shim.efi

> $fwupdmgr --version

fwupdmgr --version
compile   com.hughsie.libxmlb           0.3.18
compile   com.hughsie.libjcat           0.2.1
compile   org.freedesktop.fwupd         1.9.20
runtime   org.freedesktop.fwupd-efi     1.3
compile   org.freedesktop.gusb          0.4.8
runtime   com.hughsie.libxmlb           0.3.x
runtime   com.hughsie.libjcat           0.2.1
runtime   org.freedesktop.gusb          0.4.8
runtime   org.kernel                    6.9.3-1-default
runtime   org.freedesktop.fwupd         1.9.20


efivar -l|grep fw
0abba7dc-e516-4167-bbf5-4d9d1c739416-fwupd-7ceaf7a8-0611-4480-9e30-64d8de420c7c-0
Comment 6 Gora 2024-06-11 10:58:06 UTC
(In reply to Tseng from comment #4)
> Would you please check where the cap/cab of updated shim location is ?
> $ls /boot/efi/EFI/opensuse/fw
> $ls /boot/efi/EFI/systemd/fw
> $fwupdmgr --version

Hi, it's fwupdmgr (or fwupdmgr via Gnome Software) that creates the opensuse dir:

>ls -lh /boot/efi/EFI/opensuse/fw/
total 320K
-rwxr-xr-x. 1 root root 279K Jun 11 12:40 fwupd-01ae569c-30cd-44bc-8437-5e329c6a391c.cap

>sudo rm -rf /boot/efi/EFI/opensuse/

>sudo fwupdmgr update
Devices with no available firmware updates: 
 • Integrated Camera
 • Lexar SSD NM790 4TB
 • Prometheus IOTA Config
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
Devices with the latest available firmware version:
 • Embedded Controller
 • Prometheus
 • System Firmware
╔══════════════════════════════════════════════════════════════════════════════╗
║ Upgrade TPM from 7.2.768 to 7.2.769?                                         ║
╠══════════════════════════════════════════════════════════════════════════════╣
║ This stable release fixes the following issues:                              ║
║                                                                              ║
║ • This version tpm firmware fixed system hang up issue                       ║
║                                                                              ║
║ 21CK002RGE must remain plugged into a power source for the duration of the   ║
║ update to avoid damage.                                                      ║
╚══════════════════════════════════════════════════════════════════════════════╝
Perform operation? [Y|n]: Y
Decompressing…           [                                       ] Less than one minute remaining…
Secure boot is enabled, but shim isn't installed to EFI/opensuse/shim.efi


> ls -lh /boot/efi/EFI/
total 192K
drwxr-xr-x. 2 root root 64K Jun  8 14:35 BOOT
drwxr-xr-x. 3 root root 64K Jun 11 12:41 opensuse
drwxr-xr-x. 2 root root 64K Jun  8 14:35 systemd
> ls -lh /boot/efi/EFI/opensuse/fw/
total 320K
-rwxr-xr-x. 1 root root 279K Jun 11 12:41 fwupd-01ae569c-30cd-44bc-8437-5e329c6a391c.cap


(In reply to Tseng from comment #4)
> Would you please check where the cap/cab of updated shim location is ?
> $ls /boot/efi/EFI/opensuse/fw
> $ls /boot/efi/EFI/systemd/fw
> $fwupdmgr --version

compile   com.hughsie.libxmlb           0.3.18
compile   com.hughsie.libjcat           0.2.1
compile   org.freedesktop.fwupd         1.9.20
runtime   org.freedesktop.fwupd-efi     1.3
compile   org.freedesktop.gusb          0.4.8
runtime   com.hughsie.libxmlb           0.3.x
runtime   com.hughsie.libjcat           0.2.1
runtime   org.freedesktop.gusb          0.4.8
runtime   org.kernel                    6.9.3-1-default
runtime   org.freedesktop.fwupd         1.9.20
Comment 7 Mike Watkins 2024-06-23 18:41:12 UTC
Same fwupd issue.

/boot # find . | grep cap
./efi/EFI/opensuse/fw/fwupd-85686610-06c3-4be4-97c5-565e3d149fc9.cap
/boot # find . | grep shim
./efi/EFI/systemd/shim.efi

Dell Latitude 7420.

Updated Aeon today.

fwupdmgr --version
compile   com.hughsie.libxmlb           0.3.18
compile   com.hughsie.libjcat           0.2.1
compile   org.freedesktop.fwupd         1.9.20
runtime   org.freedesktop.fwupd-efi     1.3
compile   org.freedesktop.gusb          0.4.8
runtime   com.hughsie.libxmlb           0.3.x
runtime   com.hughsie.libjcat           0.2.1
runtime   org.freedesktop.gusb          0.4.8
runtime   org.kernel                    6.9.3-1-default
runtime   org.freedesktop.fwupd         1.9.20