dpkg --configure hangs on grub update (with buggy UEFI)

[stevet969]

When I try to use apt and its ilk I get the error:
"E: dpkg was interrupted, you must manually run 'dpkg --configure -a' to correct the problem."

If I try to run that command it hangs my system (and messes up my grub installation so that I have to boot manually from the grub command line prompt or a rescue disk).

I used to have unattended-updates running to install security updates. (I have that disabled now!) I think the problem must have started when unattended-updates tried to update the linux kernel or grub itself.

This is on an Acer laptop with a broken UEFI implementation so I need to install grub in the removable media path. Each time dpkg --configure -a fails I have to reinstall grub to that path by booting from the installation cd in rescue mode.

The half-configured packages can be seen with this command (note halF-configured grub and shim files):

Code: Select all

# dpkg -l | grep -v '^ii'
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                           Version                             Architecture Description
+++-==============================-===================================-============-===============================================================================
rc  firewalld                      0.6.3-5                             all          dynamically managed firewall with support for network zones
iF  grub-efi-amd64                 2.02+dfsg1-20+deb10u4               amd64        GRand Unified Bootloader, version 2 (EFI-AMD64 version)
it  libc-bin                       2.28-10                             amd64        GNU C Library: Binaries
rc  linux-image-4.19.0-10-amd64    4.19.132-1                          amd64        Linux 4.19 for 64-bit PCs (signed)
[ snip: various other inux-image-4.19.0-xx-amd64 files in the same state ]
rc  linux-image-4.19.0-13-amd64    4.19.160-2                          amd64        Linux 4.19 for 64-bit PCs (signed)
it  man-db                         2.8.5-2                             amd64        on-line manual pager
iF  shim-helpers-amd64-signed      1+15.4+5~deb10u1                    amd64        boot loader to chain-load signed boot loaders (signed by Debian)
iU  shim-signed:amd64              1.36~1+deb10u1+15.4-5~deb10u1       amd64        Secure Boot chain-loading bootloader (Microsoft-signed binary)
#

Is there some way I can convince the package managers to leave grub alone or otherwise get back to a state where I can install and update packages? Thanks for any suggestions.

[p.H]

What do you mean by "grub update" ? update-grub (automatic on kernel upgrade) or grub-install (automatic on grub or shim upgrade) ?

What are the messages before the dpkg error ?

Is there some way I can convince the package managers to leave grub alone

You can uninstall grub-efi-amd64 to avoid the invocation of grub-install when grub packages are updated. The actual GRUB files are provided by grub-efi-amd64-bin, grub2-common and grub-common, so you can still use grub-install and update-grub.

If you do not use secure boot (disabled or not available), you can also uninstall shim-signed. shim seems to cause trouble on some machines (including mine) since the latest stable update.

[stevet969]

Thanks p.H
Taking your questions and suggestions in order:
I don't think I said "grub update" in the text so I guess you are referring to the title. I suppose I should have written:

"dpkg --reconfigure -a " hangs (presumably when it tries to update grub)

.
I haven't found anything which touches grub that doesn't hang the machine or refuse to do anything.
I have tried numerous incantations of "dpkg --install grub..." and "apt install grub..." as well as the "dpkg --reconfigure -a".
Maybe I should try running "grub-install" or "update-grub" directly(?) I have checked that "grub-mkconfig" (as run by "update-grub" produces output identical to the contents of /boot/grub/grub.cfg.
I have been reluctant to try grub-install because I don't fully understand it and I do currently have a working system which I don't want to trash. I note it does have a --removable option which may be relevant to my (buggy) UEFI.

There are no messages before the dpkg failure. (See below). Only apt and its ilk give an error and that is the instruction to run "dpkg --update -a".

How can I uninstall grub-efi-amd64 (and/or the shim file)? Catch 22 applies; this is what happens (These are complete, nothing has been removed. You will notice I am ssh-ing to the machine; there are "broken pipe" messages when I reboot)):

Code: Select all

root@pw01:~# dpkg --remove grub-efi-amd64
dpkg: warning: ignoring request to remove grub-efi-amd64, only the config
 files of which are on the system; use --purge to remove them too
root@pw01:~# dpkg --remove shim-signed
(Reading database ... 88027 files and directories currently installed.)
Removing shim-signed:amd64 (1.36~1+deb10u1+15.4-5~deb10u1) ...
Installing for x86_64-efi platform.
packet_write_wait: Connection to 192.168.10.2 port 2002: Broken pipe
steve@lt01:~$ 

... and the machine hangs. Sigh.
And another attempt:

Code: Select all

root@pw01:~# apt remove grub-efi-amd64 shim-signed:amd64 shim-helpers-amd64-signed  
E: dpkg was interrupted, you must manually run 'dpkg --configure -a' to correct the problem. 
root@pw01:~# dpkg --remove grub-efi-amd64 shim-signed:amd64 shim-helpers-amd64-signed
(Reading database ... 88036 files and directories currently installed.)
Removing grub-efi-amd64 (2.02+dfsg1-20+deb10u4) ...
Removing shim-signed:amd64 (1.36~1+deb10u1+15.4-5~deb10u1) ...
Installing for x86_64-efi platform.
packet_write_wait: Connection to 192.168.10.2 port 2002: Broken pipe
steve@lt01:~$ 

... and the machine hangs again.

Finally, just for completeness, this is the entire output from the "dpkg --reconfigure -a" invocation:

Code: Select all

root@pw01:~# dpkg --configure -a
Setting up shim-helpers-amd64-signed (1+15.4+5~deb10u1) ...
Installing for x86_64-efi platform.
packet_write_wait: Connection to 192.168.10.2 port 2002: Broken pipe
steve@lt01:~$ 

Thanks for your suggestions so far, and for your remark about not needing shim-signed. I shall look into that once I can get past the problem of not being able to use the package managers.
- Steve

[p.H]

You should not run these commands remotely. Some useful messages may be displayed on a local tty.

So it looks like the shim-signed post-removal script runs grub-install and does other things. This is bad. As a workaround, you can edit /var/lib/dpkg/info/shim-signed:amd64.postrm and add

Code: Select all

exit 0

in the empty line before

Code: Select all

# If we're not on an EFI system

If grub-install hangs while trying to update EFI boot variables in NVRAM, then you could have run

Code: Select all

dpkg-reconfigure grub-efi-amd64

and selected to not update EFI NVRAM.
But now grub-efi-amd64 seems to be already uninstalled, so I guess you can't do it any more.
Can you show the output of

Code: Select all

debconf-show grub-efi-amd64

[stevet969]

Thanks.
Running over ssh means I can easily cut-and-paste the responses.
I will try running on the local console and your "exit 0" suggestion when I next get time - maybe tomorrow. (I'm watching the football atm!)
In the mean time here is the output from the command you suggested:

Code: Select all

# debconf-show grub-efi-amd64
* grub2/linux_cmdline:
  grub2/update_nvram: true
  grub2/kfreebsd_cmdline_default: quiet
* grub2/linux_cmdline_default: quiet
* grub2/force_efi_extra_removable: true
  grub2/kfreebsd_cmdline:
#

[p.H]

Code: Select all

grub2/update_nvram: true

means that grub-install will try to update EFI boot variables, so this could be the issue with a broken UEFI firmware.

[stevet969]

I'm out of my depth now!
Thinking about it, the installation (which I did many years ago) hung at the grub installation stage. For a while I used a rEFInd CD to boot before I eventually realized I could fix grub using the Debian installation CD in rescue mode. That makes me think you might be on to something looking at the grub-efi-amd64 configuration. The question is, what do I do now?
As you noted grub-efi-amd64 is not currently installed (though its config files are still there) so I can't reconfigure it. Do I reinstall it? How do i do that without hanging my system again?
As I said I'm out of my depth. Thank you for your patience.

[p.H]

If you reinstall grub-efi-amd64 right away without changing grub2/update_nvram to false, you will run into the same issue.
I do not know how to use debconf to change a setting directly in debconf database, but you can do this :

Purge grub-efi-amd64

Code: Select all

apt-get purge grub-efi-amd64

Download grub-efi-amd64 in the current directory

Code: Select all

apt-get download grub-efi-amd64

Pre-configure grub-efi-amd64

Code: Select all

dpkg-preconfigure -p low grub-efi-amd64*.deb

Answer "yes" to "force extra removable" and "no" to "update nvram".
Check values are ok

Code: Select all

debconf-show grub-efi-amd64

Install grub-efi-amd64

Code: Select all

apt-get install grub-efi-amd64

You should also be able to fix the shim upgrade.

[stevet969]

Thanks. I do believe that has fixed it.

For the record, and just in case you are interested here are all the details:
The first comand, 'apt-get purge grub-efi-amd64' hung the machine and I rebooted - I'm used to that now!
The download command gave a warning which I didn't properly understand, but it looked safe to ignore, so I did.
The 'dpkg-preconfigure -p low grub-efi-amd64*.deb' command only asked me one question - the 'nvram' one but the following command seemed to indicate it was in the desired state:

Code: Select all

# debconf-show grub-efi-amd64
* grub2/linux_cmdline_default: quiet
* grub2/force_efi_extra_removable: true
* grub2/linux_cmdline:
* grub2/update_nvram: false
  grub2/kfreebsd_cmdline_default: quiet
  grub2/kfreebsd_cmdline:
#

.. so I continued. I feared the worst when I saw the output of the install command:

Code: Select all

# apt-get install grub-efi-amd64
E: dpkg was interrupted, you must manually run 'dpkg --configure -a' to correct the problem.
#

but I did as it said (I couldn't think of anything else!) and this time it "just worked":

Code: Select all

# dpkg --configure -a
#

so I re-did the install:

Code: Select all

# apt-get install grub-efi-amd64   
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  efibootmgr grub-efi-amd64-bin grub-efi-amd64-signed grub2-common ipset libipset11 mokutil python3-decorator
  python3-selinux python3-slip python3-slip-dbus shim-signed-common shim-unsigned
Use 'apt autoremove' to remove them.
The following packages will be REMOVED:
  shim-signed
The following NEW packages will be installed:
  grub-efi-amd64
0 upgraded, 1 newly installed, 1 to remove and 18 not upgraded.
1 not fully installed or removed.
Need to get 0 B/39.8 kB of archives.
After this operation, 794 kB disk space will be freed.
Do you want to continue? [Y/n] 
Preconfiguring packages ...
(Reading database ... 88022 files and directories currently installed.)
Removing shim-signed:amd64 (1.36~1+deb10u1+15.4-5~deb10u1) ...
Installing for x86_64-efi platform.
Installation finished. No error reported.
No DKMS packages installed: not changing Secure Boot validation state.
Selecting previously unselected package grub-efi-amd64.
(Reading database ... 88022 files and directories currently installed.)
Preparing to unpack .../grub-efi-amd64_2.02+dfsg1-20+deb10u4_amd64.deb ...
Unpacking grub-efi-amd64 (2.02+dfsg1-20+deb10u4) ...
Setting up grub-efi-amd64 (2.02+dfsg1-20+deb10u4) ...
Installing for x86_64-efi platform.
Installation finished. No error reported.
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-4.19.0-16-amd64
Found initrd image: /boot/initrd.img-4.19.0-16-amd64
Found linux image: /boot/vmlinuz-4.19.0-14-amd64
Found initrd image: /boot/initrd.img-4.19.0-14-amd64
done
#

I did the 'apt autoremove' command as a first sanity check, then I shut down the machine and rebooted it successfully and without any manual intervention.
Finally I started up 'aptitude'. It immediately went into conflict resolution mode. I stepped through the proposed solutions and found one which said keep these (4) packages in their current state and applied that one. (I don't have a record of the files but they looked like grub related files that had got marked for removal in all my thrashing about earlier. It seemed like keeping them all was the sensible thing.) Then I rebooted just to be sure.
Everything seems ok now.
Thank you for your help and your patience,
Steve

[p.H]

Thanks for the feedback, always appreciated.

The first comand, 'apt-get purge grub-efi-amd64' hung the machine

I did not expect this. When I tested it on my machine, it did not run grub-install.

The 'dpkg-preconfigure -p low grub-efi-amd64*.deb' command only asked me one question - the 'nvram' one

Again it behaved differently on my machine, asking all the questions.