Repost from help-grub:
https://lists.gnu.org/archive/html/help-grub/2024-03/msg00004.html
I'm using grub-mkrescue in combination with the pgp --pubkey feature to
put grub into check_signatures=enforce mode, and to only have signed
data loaded and processed. Something like:
grub-mkrescue --modules='normal pgp' -o test.iso
boot/grub/grub.cfg=grub.cfg boot/grub/grub.cfg.sig=grub.cfg.sig --pubkey
testkey.pub
This used to work with GRUB 2.06 for both efi-x86_64 and pc-i386. With
GRUB 2.12 however, efi-x86_64 does no longer work.
I traced the problem by omitting the --pubkey argument to grub-mkrescue.
It seems that with GRUB 2.12 a special file is used to determine root,
e.g. '(hd0)/.disk/2024-03-07-18-32-41-00.uuid'. This can be seen in the
attached backtrace starting from grub_env_write_root where the correct
root is set in the check_signatures=no configuration.
The relevant information in the backtrace is the command used to find
and set root:
search --set=root --file /.disk/2024-03-07-17-16-00-00.uuid
This correctly sets root to (hd0), whereas with the --pubkey argument,
root remains at (hd0,gpt2) (i.e. fwdevice). The problem seems to be that
this file is not signed, so grub cannot open it. This results in the
following error:
error: no such device: /.disk/2024-03-07-19-09-45-00.uuid.
The file is visible via the grub console however, but 'ls' on it returns:
error: not a directory.
Kind regards
#0 grub_env_write_root (var=0x7be32e20, val=0x7feca590 "hd0") at
kern/main.c:104
#1 0x000000007e31af15 in grub_env_set (name=<optimized out>,
val=val@entry=0x7feca590 "hd0") at kern/env.c:93
#2 0x000000007be37adc in iterate_device (name=0x7feca590 "hd0",
data=0x7feca630) at commands/search.c:178
#3 0x000000007e316e53 in iterate_disk (disk_name=0x7feca590 "hd0",
data=0x7feca5e8) at kern/device.c:147
#4 0x000000007e3155ff in grub_efidisk_iterate (hook=0x7e316e2e <iterate_disk>,
hook_data=0x7feca5e8, pull=<optimized out>) at disk/efi/efidisk.c:414
#5 0x000000007e316f7a in grub_disk_dev_iterate (hook=0x7e316e2e
<iterate_disk>, hook_data=0x7feca5e8) at ../include/grub/disk.h:245
#6 grub_device_iterate (hook=hook@entry=0x7be37940 <iterate_device>,
hook_data=hook_data@entry=0x7feca630) at kern/device.c:193
#7 0x000000007be37cc9 in try (ctx=ctx@entry=0x7feca630) at
commands/search.c:280
#8 0x000000007be37df1 in grub_search_fs_file (key=0x7be324b9
"/.disk/2024-03-07-17-16-00-00.uuid", var=<optimized out>, flags=<optimized
out>, hints=<optimized out>, nhints=<optimized out>) at commands/search.c:303
#9 0x000000007be36555 in grub_cmd_search (ctxt=<optimized out>, argc=1,
args=0x7be32140) at commands/search_wrap.c:197
#10 0x000000007bef1038 in grub_extcmd_dispatcher (cmd=<optimized out>, argc=3,
args=0x7be32308, script=<optimized out>) at commands/extcmd.c:55
#11 0x000000007e31fa5a in grub_rescue_parse_line (line=line@entry=0x7be32ac0
"search --set=root --file /.disk/2024-03-07-17-16-00-00.uuid",
getline=getline@entry=0x7e31edd3 <grub_parser_execute_getline>,
getline_data=getline_data@entry=0x7feca7b8) at kern/rescue_parser.c:75
#12 0x000000007e31f42c in grub_parser_execute (source=<optimized out>) at
kern/parser.c:338
#13 0x000000007e31ca1a in grub_main () at kern/main.c:326
#14 0x000000007e315017 in start () at startup.S:34
