A recent dist-upgrade on Buster (in a scripted cron job run at 01:00 daily) failed due to apt-listbugs complaining about the boot-breaking bug in shim-signed, and pinning v1.33 in the process.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990082 The next (manual) dist-upgrade removed shim-signed v1.33 $ cat /var/log/apt/history.log Start-Date: 2021-06-20 18:33:29 Commandline: apt-get -y dist-upgrade Requested-By: xxxxxxxxx (1000) Upgrade: shim-signed-common:amd64 (1.33+15+1533136590.3beb971-7, 1.36~1+deb10u1+15.4-5~deb10u1) Remove: shim-signed:amd64 (1.33+15+1533136590.3beb971-7) End-Date: 2021-06-20 18:33:30 unattended-upgrades (which I had forgotten was installed) upgraded some related packages earlier the same day, but not shim-signed itself: $ cat /var/log/apt/history.log Start-Date: 2021-06-20 06:26:31 Commandline: /usr/bin/unattended-upgrade Upgrade: shim-helpers-amd64-signed:amd64 (1+15+1533136590.3beb971+7+deb10u1, 1+15.4+5~deb10u1), shim-unsigned:amd64 (15+1533136590.3beb971-7+deb10u1, 15.4-5~deb10u1) End-Date: 2021-06-20 06:26:34 The only references to shim-signed in apt history logs were the initial Buster installation, and the recent removal: /var/log/apt$ grep -n "shim-signed:" history.log* history.log:209:Remove: shim-signed:amd64 (1.33+15+1533136590.3beb971-7) history.log.6:33:Install: [...] shim-signed:amd64 (1.33+15+1533136590.3beb971-7) [...] As I don't currently use secure boot, I ignored the bug warnings when I reinstalled it and dependencies (the buster-updates version per the email from debian-stable-announce yesterday https://lists.debian.org/debian-stable-announce/2021/06/msg00001.html ...but still: $ apt policy shim-signed shim-signed: Installed: 1.36~1+deb10u2+15.4-5~deb10u1 Candidate: 1.36~1+deb10u2+15.4-5~deb10u1 $ apt-listbugs list shim-signed Retrieving bug reports... Done Parsing Found/Fixed information... Done grave bugs of shim-signed (→ ) <Outstanding> b1 - #990082 - High chance of boot problems with buster's version of arm64 shim grave bugs of shim-signed (→ ) <Resolved in some Version> b2 - #987991 - shim-signed: Recent dbx update blacklists shimx64.efi (1.33+15+1533136590.3beb971-7) (Fixed: shim-signed/1.34) Summary: shim-signed(2 bugs) $ apt-listbugs list shim-signed-common critical bugs of shim-signed-common (→ ) <Outstanding> b1 - #990158 - shim-signed-common: No UEFI boot with error "Could not create MokListXRT" Summary: shim-signed-common(1 bug) Is this referring to the non buster-updates package? Can anyone enlighten me as to: Why might shim-signed v1.33 have been removed by dist-upgrade despite the previous upgrade attempt having been aborted by apt-listbugs? What's the best way to reinstall an older package version and its old dependencies if affected by something like this, and it isn't to be found in /var/cache/apt/archives? Thanks, Gareth
