Skip to content

Set grub2_uefi_boot_path to /boot/grub for debian-like - #15116

Open
israel-villar wants to merge 1 commit into
ComplianceAsCode:masterfrom
israel-villar:fix/debian-grub2-uefi-boot-path
Open

Set grub2_uefi_boot_path to /boot/grub for debian-like#15116
israel-villar wants to merge 1 commit into
ComplianceAsCode:masterfrom
israel-villar:fix/debian-grub2-uefi-boot-path

Conversation

@israel-villar

Copy link
Copy Markdown
Contributor

Description:

  • In product_properties/10-grub.yml, the debian-like override sets grub2_boot_path=/boot/grub but leaves grub2_uefi_boot_path at the default /boot/grub2.
  • Add grub2_uefi_boot_path: "/boot/grub" to the debian-like block so Debian 11/12/13 use the correct path. Ubuntu (also debian-like) already sets it for > 18.04, and its own block still overrides to /boot/efi/EFI/ubuntu for <= 18.04.

Rationale:

  • /boot/grub2 is a RHEL path and does not exist on Debian. On UEFI Debian the full GRUB configuration lives in /boot/grub/grub.cfg; the file under /boot/efi/EFI/debian/ is only a stub that configfiles it.
  • Because of the wrong path, grub2_uefi_password (and any other rule keyed on grub2_uefi_boot_path) checks a non-existent file and always fails on Debian, even when set superusers and password_pbkdf2 are correctly present in /boot/grub/grub.cfg.

Review Hints:

  • One-line change.
  • ./build_product debian11 debian12 debian13 ubuntu2404 --datastream and ctest pass.
  • Verified on a Debian 13 UEFI host: grub2_uefi_password goes from fail to pass once the OVAL points at /boot/grub/grub.cfg.

The debian-like override in product_properties/10-grub.yml set
grub2_boot_path=/boot/grub but left grub2_uefi_boot_path at the RHEL
default /boot/grub2, which does not exist on Debian. As a result the
grub2_uefi_password OVAL checked /boot/grub2/grub.cfg and always failed
on Debian even with a valid superuser + password_pbkdf2 in
/boot/grub/grub.cfg.

Ubuntu (also debian-like) already sets /boot/grub for >18.04; move the
setting up to the debian-like block so Debian 11/12/13 get it too. The
ubuntu block still overrides to /boot/efi/EFI/ubuntu for <=18.04.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015YN4ez6hrFpegisiLLo3zx
@openshift-ci openshift-ci Bot added the needs-ok-to-test Used by openshift-ci bot. label Sep 10, 2026
@openshift-ci

openshift-ci Bot commented Sep 10, 2026

Copy link
Copy Markdown

Hi @israel-villar. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs-ok-to-test Used by openshift-ci bot.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant