UEFI: add option to set override EFI/vendor directory

When using Secure Boot, grub2 as built by Debian will now load a config file from EFI/$VENDOR instead of having EFI/debian hardcoded. $VENDOR comes from dpkg-vendor or from the user building grub2. Use dpkg-vendor from the chroot by default, and let users override it via a new --uefi-vendor option.

The changes to Grub are here: https://salsa.debian.org/pmhahn/grub/commits/signing and the process to merge them back into sid is starting, so we should get ready.

Hum, this is sub-optimal for derived distributions which are not rebuilding grub2. live-build will put the config file in the EFI/$vendor directory while grub2 will look for it in the EFI/debian directory.

Is there no way to extract the expected path from the grub2 package that we are using ? Maybe you should suggest @pmhahn to add some simple way to find out the information.

That's why I added the optional config - I run one of those derived distros that really don't want to rebuild grub :-)

I've been messing around with grub&shim for a year or so, but I wouldn't know where to add this info in a way that can be programmatically accessed and that is non-intrusive for Debian users and devs.

Isn't the config override enough? After all, downstream maintainers know whether they are rebuilding grub or not.

Downstream maintainers do, but not downstream users who are trying to build a live image for their own.

The interface with grub doesn't need to be complicated. We could ask grub maintainers to just create a file with the required data.

Cheers,

mentioned in merge request pmhahn/grub!2 (merged)

added 1 commit

• d9c64f0e - UEFI: parse vendor from Grub package metadata

Compare with previous version

@hertzog I've added some control metadata, pending review but it works, see: pmhahn/grub!2 (merged)

added 1 commit

• 316b1281 - UEFI: parse vendor from Grub package metadata

Compare with previous version

The grub mr was merged, so I'll merge this later today and upload to sid

merged