From 52b2964648452d496d8fbc75a7f938c284b1b07b Mon Sep 17 00:00:00 2001
From: Sebastian Heid <8442432+s4heid@users.noreply.github.com>
Date: Wed, 21 Jan 2026 09:19:16 +0100
Subject: [PATCH] Enable UEFI Secure Boot

Secure Boot requires a Microsoft-signed shim that chainloads a Canonical-signed
GRUB. Installing grub-efi-amd64-signed and shim-signed makes grub-install lay
down that chain instead of the unsigned image it builds itself.

Signed GRUB binaries carry their prefix baked in, and it cannot be changed
without invalidating the signature. With --removable, grub-install installs
gcdx64.efi.signed as EFI/BOOT/grubx64.efi, whose prefix is /boot/grub relative
to the partition it was loaded from - the ESP. That image never reads the
redirect grub-install writes to EFI/BOOT/grub.cfg, so without a config at the
path it does read, GRUB drops into the rescue shell. Copy grub-install's own
redirect there instead of hardcoding the ESP UUID a second time.
---
 bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt      |  4 ++++
 bosh-stemcell/spec/stemcells/ubuntu_spec.rb         | 10 ++++++++++
 stemcell_builder/stages/image_install_grub/apply.sh |  3 +++
 stemcell_builder/stages/system_grub/apply.sh        |  2 +-
 4 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt b/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt
index f9c3bc0e3b..e12983318e 100644
--- a/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt
+++ b/bosh-stemcell/spec/assets/dpkg-list-ubuntu.txt
@@ -98,6 +98,7 @@ grep
 groff-base
 grub-common
 grub-efi-amd64-bin
+grub-efi-amd64-signed
 grub-gfxpayload-lists
 grub-pc
 grub-pc-bin
@@ -366,6 +367,7 @@ man-db
 mawk
 media-types
 module-assistant
+mokutil
 mount
 ncurses-base
 ncurses-bin
@@ -435,10 +437,12 @@ rsyslog-gnutls
 rsyslog-openssl
 rsyslog-relp
 runit
+sbsigntool
 sed
 sensible-utils
 sgml-base
 shared-mime-info
+shim-signed
 software-properties-common
 strace
 sudo
diff --git a/bosh-stemcell/spec/stemcells/ubuntu_spec.rb b/bosh-stemcell/spec/stemcells/ubuntu_spec.rb
index 3cf2ec31d9..c15380b386 100644
--- a/bosh-stemcell/spec/stemcells/ubuntu_spec.rb
+++ b/bosh-stemcell/spec/stemcells/ubuntu_spec.rb
@@ -83,6 +83,16 @@
       end
     end
 
+    describe file("/boot/efi/boot/grub/grub.cfg") do
+      it { should be_file }
+      its(:content) { should match %r{^set prefix=\(\$root\)'/EFI/grub'$} }
+      its(:content) { should match %r{^configfile \$prefix/grub\.cfg$} }
+
+      it "mirrors the config grub-install wrote to the ESP" do
+        expect(subject.content).to eq(file("/boot/efi/EFI/BOOT/grub.cfg").content)
+      end
+    end
+
     describe file("/boot/grub/menu.lst") do
       before { skip 'until alicloud/aws/openstack stop clobbering the symlink with "update-grub"' }
       it { should be_linked_to("./grub.cfg") }
diff --git a/stemcell_builder/stages/image_install_grub/apply.sh b/stemcell_builder/stages/image_install_grub/apply.sh
index 815b78cee3..ce64080679 100755
--- a/stemcell_builder/stages/image_install_grub/apply.sh
+++ b/stemcell_builder/stages/image_install_grub/apply.sh
@@ -79,6 +79,9 @@ echo "(hd0) ${device}" > ${image_mount_point}/device.map # fallback for non-UEFI
 run_in_chroot ${image_mount_point} "grub-install --target=x86_64-efi --efi-directory=/boot/efi --boot-directory=/boot/efi/EFI --removable -v --no-floppy ${device}"
 run_in_chroot ${image_mount_point} "grub-install -v --target=i386-pc  --grub-mkdevicemap=/device.map --no-floppy ${device}" # fallback for non-UEFI systems
 
+mkdir -p ${image_mount_point}/boot/efi/boot/grub
+cp ${image_mount_point}/boot/efi/EFI/BOOT/grub.cfg ${image_mount_point}/boot/efi/boot/grub/grub.cfg
+
 grub_suffix=""
 case "${stemcell_infrastructure}" in
 aws)
diff --git a/stemcell_builder/stages/system_grub/apply.sh b/stemcell_builder/stages/system_grub/apply.sh
index a544963995..60798c3b0c 100755
--- a/stemcell_builder/stages/system_grub/apply.sh
+++ b/stemcell_builder/stages/system_grub/apply.sh
@@ -5,7 +5,7 @@ set -e
 base_dir=$(readlink -nf $(dirname $0)/../..)
 source $base_dir/lib/prelude_apply.bash
 
-pkg_mgr install grub2 grub-efi-amd64-bin
+pkg_mgr install grub2 grub-efi-amd64-bin grub-efi-amd64-signed shim-signed
 
 # When a kernel is installed, update-grub is run per /etc/kernel-img.conf.
 # It complains when /boot/grub/menu.lst doesn't exist, so create it.