GitLab

Originally created by @intrigeri on #15806 (Redmine)

We need this for Secure Boot (#6560 (closed)) and it’ll simplify quite a few parts of our code.

Making a Tails USB image boot with GRUB is straightforward but we need to:

• Find another way to identify the boot device in our partitioning script: git grep -E 'FSUUID|sysappend'
• Update our test suite accordingly: it currently expects the syslinux UI
• Subtasks of this very issue
• Fix whatever the tests below show as broken

Team: FT (intrigeri, segfault)

Manual testing plan

Note:

• Tests done at 3c79a9cd
• Since this branch includes #8415 (closed), the upgrade tests below also cover switching from aufs to overlayfs.
• Automatic upgrade tests are done like this:
  • IUK generated using wrap_tails_create_iuks (just like in our release process)
  • IUK installed manually with tails-install-iuk (UDFs are not impacted by this branch, only IUK generation is)

Freshly installed Tails built from this branch

First, boots using isolinux from DVD: OK

Second, USB tests:

1. boot a USB stick that’s been freshly installed from this branch
2. verify that the system partition was resized
3. boot a 2nd time to ensure that resizing the system partition did not break the boot

	GNOME Disks (.img)	Tails Installer (cloning)	Etcher (.img)
boots using GRUB on EFI 64-bit + Secure Boot	OK	OK	TODO
boots using GRUB on EFI 32-bit	OK	OK	TODO
boots using syslinux on legacy BIOS	OK	OK	TODO

Tails upgraded from older version that had no GRUB 64-bit EFI

	with Tails Installer (cloning)	with automatic upgrade
boots using GRUB on EFI 64-bit + Secure Boot	OK	OK
boots using GRUB on EFI 32-bit	OK	OK
boots using syslinux on legacy BIOS	OK	OK
syslinux EFI 64-bit was deleted	OK	OK

Tails upgraded from older Tails that already had GRUB 64-bit EFI

Note: the new image & the corresponding test IUK must modify EFI/debian/grub.cfg.

	with Tails Installer (cloning)	with automatic upgrade
boots using GRUB on EFI 64-bit + Secure Boot	OK	OK
boots using GRUB on EFI 32-bit	OK	OK
boots using syslinux on legacy BIOS	OK	OK
EFI/debian/grub.cfg was updated	OK	OK

Feature Branch: feature/6560-secure-boot+force-all-tests

Parent Task: #6560 (closed)

Subtasks

• #17494 (closed)

Related issues

• Related to #7422 (closed)
• Related to #15292 (closed)
• Related to #12440 (closed)
• Related to #12439 (closed)
• Blocks #16980
• Blocks #17049 (closed)