Public bug reported: Ubuntu Resolute install ISOs are starting to fail a promotion step, due to test failures related to sbattach / sbverify. Promotion here means that we take a built ISO, see if it passes some integration tests, and if so, allow it to be considered the "current" ISO on cdimage.
The test failure is related to kernel signatures, and has regressed with the 6.18 upload. That failing test can be found here - https://git.launchpad.net/utah/tree/utah/isotest/iso_static_validation.py#n562 I have extracted the logic from that test into a standalone script that can be used against vmlinuz files directly, without the additional challenge of needing a full UTAH setup. See attached. It needs a little configuration - see the things marked FIXME. The last passing ISO logfile can be found here - https://ubuntu-archive- team.ubuntu.com/cd-build-logs/ubuntu-server/resolute/daily- live-20251219.log - as built on December 19th, 2025. The first failing ISO logfile can be found here - https://ubuntu- archive-team.ubuntu.com/cd-build-logs/ubuntu-server/resolute/daily- live-20251220.log - as built on December 20th, 2025. This dec-20th logfile is the first one to pick up kernel 6.18. The failure in question looks like: 08:46:53 ERROR: test_efi_secure_boot_signatures (__main__.TestValidateISO) 08:46:53 ERROR: Traceback (most recent call last): 08:46:53 File "/usr/lib/python3.10/unittest/case.py", line 59, in testPartExecutor 08:46:53 yield 08:46:53 File "/usr/lib/python3.10/unittest/case.py", line 591, in run 08:46:53 self._callTestMethod(testMethod) 08:46:53 File "/usr/lib/python3.10/unittest/case.py", line 549, in _callTestMethod 08:46:53 method() 08:46:53 File "/usr/share/utah/isotest/iso_static_validation.py", line 629, in test_efi_secure_boot_signatures 08:46:53 self.assertEqual(stderr, '') 08:46:53 AssertionError: 'warning: data remaining[16721800 vs 17160[34 chars]s?\n' != '' 08:46:53 - warning: data remaining[16721800 vs 17160264]: gaps between PE/COFF sections? If you use my attached script and point it at kernels 6.17 and 6.18, you will see the `sbattach --detach` pass for 6.17 and fail for 6.18. ** Affects: linux-meta (Ubuntu) Importance: Undecided Status: New ** Affects: sbsigntool (Ubuntu) Importance: Undecided Status: New ** Attachment added: "signatures" https://bugs.launchpad.net/bugs/2137746/+attachment/5938211/+files/signatures ** Also affects: sbsigntool (Ubuntu) Importance: Undecided Status: New ** Summary changed: - sbattach / sbverify failures with 6.18 + sbattach --detach failures with 6.18 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2137746 Title: sbattach --detach failures with 6.18 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux-meta/+bug/2137746/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
