Fedora Account System
Red Hat Associate
Red Hat Customer
While crypto-policies-scripts has logic to handle the lack of /usr/sbin/grubby, it does Recommend grubby. Note that until recently, sdubby had a "Provides: grubby" stanza, but that was removed recently. Adding in sdubby as meeting the recommends returns crypto-policies-scripts to approximate equivalency before that other fix in sdubby. Please consider updating the Recommend to be (grubby or sdubby) for those that are moving to systemd-boot. In practice, grubby or sdubby are likely already installed, so the Recommend is a no-op, but it may make package resolution easier for dnf. Proposed patch will be attached. Reproducible: Didn't try
Created attachment 2023280 [details] Patch supporting grubby or sdubby
Related (where sdubby no longer provides grubby): Bug 2269992
I'm not sure we want this, considering that sdubby does not actually seem to work with `fips-mode-setup`. See bug 2259197.
(In reply to Clemens Lang from comment #3) > I'm not sure we want this, considering that sdubby does not actually seem to > work with `fips-mode-setup`. See bug 2259197. I believe that issue was caused because sdubby "Provides: grubby" (and the sdboot version was > grubby) and now that sdubby has been changed to no longer provide grubby, it will not replace grubby (if installed).
(In reply to Gary Buhrmaster from comment #4) > I believe that issue was caused because sdubby "Provides: grubby" (and the > sdboot version was > grubby) and now that sdubby has been changed to no > longer provide grubby, it will not replace grubby (if installed). Correct. However, given that `fips-mode-setup` currently does not seem to work with sdubby (or maybe we're just trying on systems that aren't correctly set up for sdubby?), I don't think we should be adding the alternative dependency.
(In reply to Clemens Lang from comment #5) > Correct. However, given that `fips-mode-setup` currently does not seem to > work with sdubby (or maybe we're just trying on systems that aren't > correctly set up for sdubby?) I think the problem is as reported in Bug 2271533 so I am going to add a "depends" on that bug.
I'm with Clemens here, with the current state of sdubby's interface we shouldn't depend on it. Once the situation changes we can re-consider, but if it stops providing `grubby` in $PATH, the change might involve more than just adding an rpm dependency. Feel free to either reopen or file a more general "support sdubby in addition to grubby" ticket once it grows the featureset we're using.