grub-signed packages, removal: How to analyze this? package question, grub question?

[Qqmike]

Trusty GRUB packages? --> Took me a few hours to see what was going on here, and left me with questions.

Bottom-line:
Trusty, Kubuntu 14.04
On Wed, July 8, 2015, the following package was removed (shown in Muon History log):
grub-efi-amd64-signed
(1.34+2.02-beta2-9ubuntu1.3)
I also note in Muon Details that "Critical updates until February 8, 2015."

Grub question:

Although I don't use secure boot, isn't this package supposed to be installed? But then, anyway, no more critical updates to it?

Package question:

How to track down why this was removed, what is going on with it, will there be some replacement?


What I have looked at--no expert here:
http://packages.ubuntu.com/trusty/grub-efi-amd64-signed
http://packages.ubuntu.com/trusty-up...i-amd64-signed
http://packages.ubuntu.com/trusty-up...grub-efi-amd64


I don't see how to figure out what they have in mind for the package grub-efi-amd64-signed and why it is OK to have removed it automatically?


How I discovered this:

My grub-efi in Trusty seems to work fine after the update-removal of the -signed, but its behavior changed in a noticeable way.
Usually, when installing GRUB, say doing grub-install, I see these files installed in /EFI/ubuntu:
grub.cfg, grubx64.efi, shimx64.efi., MokManager64.efi

After this change (removal of the grub-efi-amd64-signed), I see only:
grubx64.efi

Although I do not get grub.cfg telling me where GRUB is pointing to for its boot files, the grubx64.efi executable must have this pointer hard-coded in it because it works properly, taking me to the correct boot files.


Very strange. Anyone know about:

(1) What's going on with the grub-efi signing deal?

(2) How I would go about investigating this further, short of emailing Colin Watson--which I won't bother him with this kind of issue.

[Qqmike]

I am also trying to search
http://lists.gnu.org/archive/html/grub-devel/
but, as yet, don't see anything standing out -- doesn't mean it's not there!

[Qqmike]

Another tidbit for anyone trying to help:

What should I do as apt-get wants to remove grub-efi-amd64-signed
http://askubuntu.com/questions/64262...i-amd64-signed

grub-efi-amd64-signed Forced Uninstall Causes Boot Failure https://bugs.launchpad.net/ubuntu/+s...d/+bug/1469995

Not exactly on target, but it seems this removal of grub-efi-amd64-signed has come up before and caused more serious booting problems. Many of the comments posted are familiar to me.

I gather that if you are not using Secure Boot, you can safely do without grub-efi-amd64-signed. However, I sure miss the file /EFI/ubuntu/grub.cfg for the purposes of easily doing experiments. Now, without the EFI grub.cf pointer, the only way to check the results of a test is to re-boot and see where it takes you. NBD, but this was not a small change to what I'm used to here in the Trusty GRUB2-EFI setup (and my documentation of such).

Any ideas/insights/comments are welcome!

[Qqmike]

I'm not seeing this problem in Mint 17.1 KDE. It has the same-version grub-efi-amd64-signed, even after I double-check for all updates to the system--it has not been removed, no mention of it not receiving critical updates; and the grub-install there works the way I like.

I sure don't use Secure Boot, but as I explained above, I like the version of grub-install that comes with the -signed "presence." It really is handy when doing these complicated booting experiments with multiple installations.

WTH, I may just re-install the -signed file and try it, see what happens. I think it was removed during the installation of another grub package (for which it was "in the way"), but then didn't get re-installed. Or something like that.

[Qqmike]

Interesting. I installed the package that somehow got removed by Muon (and that I don't need):
grub-efi-amd64-signed
(1.34.4+2.02-beta2-9ubuntu1.3)

and it does give me a grub-install command that I like but with a twist:
I do get, in the ESP, /boot/efi/EFI/ubuntu, these two files:
grub.cfg, grubx64.efi
and it is the grub.cfg file I find convenient to have and so I am happy.
However, unlike the previous grub-install commands, I do NOT get the shim and Mok files, shimx64.efi, MokManagerx64.efi, and that's OK, but interesting.

So I could see any warnings and such, I used the CLI to do the install, after an apt-get update and search, I installed the package using
apt-get install grub-efi-amd64-signed
and there was a note telling me that shim was no longer needed and could be removed, and instead the grub-efi-amd64-signed package would be installed. (I have not removed that shim file.) Just an fyi here.

The take-away (for me) is this: The effect (result) of the GRUB2-EFI commands you issue depends on the packages you have installed. Obviously. But in this case, the effect is VERY obvious.