grub2 (2.14-2ubuntu3) stonking; urgency=medium

  * grub-initrd-fallback.service: After grub2-common.service (LP: #2156423)

 -- Mate Kukri <mate.kukri@canonical.com>  Wed, 01 Jul 2026 10:39:34 +0100

grub2 (2.14-2ubuntu2) resolute; urgency=medium

  * Handle const generic returns, fixes glibc 2.43 FTBFS (LP: #2142892)
  * Fix ISO boot on POWER (LP: #2142695)

 -- Mate Kukri <mate.kukri@canonical.com>  Fri, 06 Mar 2026 14:04:58 +0000

grub2 (2.14-2ubuntu1) resolute; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - Add Ubuntu SBAT data
    - Install canonical-uefi-ca.crt
    - Point Vcs-Git to Ubuntu packaging branch
    - build-efi-images: do not produce -installer.efi.signed. (LP #1863994)
    - build-efi-images: Drop Debian specific signed modules
    - Drop i386 from grub-efi-amd64* (LP #2020907)
    - grub-multi-install: Support installing to multiple ESP (LP #1871821)
    - Split out unsigned artefacts into grub2-unsigned
    - Default timeout changes
    - Replace grub-install-extra-removable
    - Install grub-initrd-fallback.service
    - Install grub-sort-version
    - Make empty "grub-pc/install_devices" non-fatal in "noninteractive" mode
    - Add debconf options "grub-{efi,pc}/cloud_style_installation"
    - Disable ELF metadata injection via the environment
    - Removed patches:
      + install-signed.patch with
      + grub-install-extra-removable.patch
      + grub-install-removable-shim.patch
    - Added patches:
      + ubuntu-install-signed.patch
      + ubuntu-grub-install-extra-removable.patch
      + ubuntu-zfs-enhance-support.patch
      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
      + ubuntu-zfs-mkconfig-signed-kernel.patch
      + ubuntu-zfs-gfxpayload-keep-default.patch
      + ubuntu-zfs-gfxpayload-dynamic.patch
      + ubuntu-zfs-mkconfig-recovery-title.patch
      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
      + ubuntu-support-initrd-less-boot.patch
      + ubuntu-shorter-version-info.patch
      + ubuntu-add-initrd-less-boot-fallback.patch
      + ubuntu-mkconfig-leave-breadcrumbs.patch
      + ubuntu-fix-lzma-decompressor-objcopy.patch
      + ubuntu-add-devicetree-command-support.patch
      + ubuntu-boot-from-multipath-dependent-symlink.patch
      + ubuntu-resilient-boot-ignore-alternative-esps.patch
      + ubuntu-resilient-boot-boot-order.patch
      + ubuntu-speed-zsys-history.patch
      + ubuntu-dont-verify-loopback-images.patch
      + ubuntu-recovery-dis_ucode_ldr.patch
      + ubuntu-add-initrd-less-boot-messages.patch
      + rhboot-f34-make-exit-take-a-return-code.patch
      + rhboot-f34-dont-use-int-for-efi-status.patch
      + suse-grub.texi-add-net_bootp6-document.patch
      + ubuntu-verifiers-last.patch
      + ubuntu-os-prober-auto.patch
      + grub-sort-version.patch
      + grub-install-efi-title.patch
      + arm64-add-snapdragon-quirk.patch
      + UBUNTU-Do-not-attempt-to-load-the-bli-module.patch
  * Unreleased changes from Debian:
    - Really do not append file/line prefixes to error message

 -- Mate Kukri <mate.kukri@canonical.com>  Tue, 12 Aug 2025 15:29:16 +0100

grub2 (2.14-2) unstable; urgency=medium

  [ Mate Kukri ]
  * grub-common.service: Add After/Requires=boot-complete.target
  * Provide pre-built BIOS and IEEE1275 El-Torito images
  * Drop vt-handoff support (LP #2052673)

  [ Julian Andres Klode ]
  * debian/upstream/signing-key.asc: merge keyring

  [ Mate Kukri ]
  * Do not append file/function/line prefixes to GRUB error message
  * efi: Drop support for UGA Draw and Console Control protocols (Closes: #1127371) (Closes: #1127556)

 -- Mate Kukri <mate.kukri@canonical.com>  Tue, 10 Feb 2026 11:27:19 +0000

grub2 (2.14-1) unstable; urgency=medium

  [ Aaron Rainbolt ]
  * Disable grub-extras/ntldr-img (Closes: #1122127)

  [ Mate Kukri ]
  * Import new upstream 2.14 release
  * Rebase patches on new upstream 2.14 release
  * d/control: Add autoconf-archive to build depends
  * d/p: Do not check for autoconf-archive, the check is broken
  * d/p: Do not use --image-base for linking, unbreak grub-pc
  * d/rules: Add zfs_zstd_test to XFAIL_TESTS
  * d/rules: Remove iso9660_test from XFAIL_TESTS

  [ Heinrich Schuchardt ]
  * debian: enable FLICKER_FREE_BOOT for riscv64

  [ Askar Safin ]
  * Don't use all_video by default on UEFI (Closes: #1036019)

 -- Mate Kukri <mate.kukri@canonical.com>  Thu, 05 Feb 2026 10:50:50 +0000

grub2 (2.14~git20250718.0e36779-3) UNRELEASED; urgency=medium

  [ Aaron Rainbolt ]
  * Disable grub-extras/ntldr-img (Closes: #1122127)

 -- Aaron Rainbolt <arraybolt3@ubuntu.com>  Sun, 04 Jan 2026 19:08:23 -0600

grub2 (2.14~git20250718.0e36779-2) unstable; urgency=medium

  [ Mate Kukri ]
  * Fix upstream typo in bash-completion Makefile
  * Bash-completions no longer live in one file, remove symlinks
  * d/control: Re-add grub-common as dummy transitional package (LP: #2122124)

  [ Julian Andres Klode ]
  * Upload to unstable

 -- Julian Andres Klode <jak@debian.org>  Sun, 02 Nov 2025 12:08:11 +0100

grub2 (2.14~git20250718.0e36779-1ubuntu4) questing; urgency=medium

  [ Tobias Heider ]
  * Add Snapdragon quirk

  [ Mate Kukri ]
  * Do not attempt to load the bli module
  * d/control: Re-add grub-common as dummy transitional package (LP: #2122124)

 -- Mate Kukri <mate.kukri@canonical.com>  Tue, 09 Sep 2025 16:55:15 +0100

grub2 (2.14~git20250718.0e36779-1ubuntu3) questing; urgency=medium

  * Fix upstream typo in bash-completion Makefile
  * Bash-completions no longer live in one file, remove symlinks

 -- Mate Kukri <mate.kukri@canonical.com>  Tue, 19 Aug 2025 15:28:38 +0100

grub2 (2.14~git20250718.0e36779-1ubuntu2) questing; urgency=medium

  * Fup grub-common -> grub2-common merger in Ubuntu specific delta

 -- Mate Kukri <mate.kukri@canonical.com>  Wed, 13 Aug 2025 14:57:58 +0100

grub2 (2.14~git20250718.0e36779-1ubuntu1) questing; urgency=medium

  * Merge from Debian experimental; remaining changes:
    - Add Ubuntu sbat data
    - build-efi-images: do not produce -installer.efi.signed. LP #1863994
    - grub-common: Install canonical-uefi-ca.crt
    - Check signatures
    - Support installing to multiple ESP (LP #1871821)
    - Split out unsigned artefacts into grub2-unsigned
    - Vcs-Git: Point to ubuntu packaging branch
    - Relax dependencies on grub-common and grub2-common
    - UBUNTU: Do not link grub-efi-*-unsigned docs to grub-common
    - UBUNTU: Default timeout changes
    - UBUNTU: Replace grub-install-extra-removable
    - UBUNTU: Revert "Add jfs module to signed UEFI images. Closes: #950959"
    - UBUNTU: Revert "Add f2fs module to signed UEFI images"
    - UBUNTU: Drop luks2
    - Install grub-initrd-fallback.service again
    - Build using -O1 on s390x to avoid misoptimization
    - grub-check-signatures: Support gzip compressed kernels
    - forward port fix for LP #1926748
    - Forward port the fix for LP #1930742 and make it conditional (xenial/bionic only)
    - Build grub2-unsigned packages with xz compression
    - Drop i386 from grub-efi-amd64*
    - Turn depends on grub-efi-amd64/arm64 unversioned
    - Install grub-sort-version
    - rules: Add DPKG_BUILDPACKAGE_OPTIONS to generate-grub2-unsigned
    - d/postinst.in: Make empty "grub-pc/install_devices" non-fatal in "noninteractive" mode
    - Add debconf options "grub-{efi,pc}/cloud_style_installation"
    - grub-common.service: Add After/Requires=boot-complete.target (LP #1992643)
    - d/postinst.in: Remove upgrade check for GRUB version we can no longer upgrade from
    - Disable ELF metadata injection
    - Provide pre-built BIOS and IEEE1275 El-Torito images (LP #2086841)
    - Removed patches:
      + install-signed.patch with
      + grub-install-extra-removable.patch
      + grub-install-removable-shim.patch
    - Added patches:
      + ubuntu-install-signed.patch
      + ubuntu-grub-install-extra-removable.patch
      + ubuntu-zfs-enhance-support.patch
      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
      + ubuntu-zfs-mkconfig-signed-kernel.patch
      + ubuntu-zfs-gfxpayload-keep-default.patch
      + ubuntu-zfs-gfxpayload-dynamic.patch
      + ubuntu-zfs-vt-handoff.patch
      + ubuntu-zfs-mkconfig-recovery-title.patch
      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
      + ubuntu-support-initrd-less-boot.patch
      + ubuntu-shorter-version-info.patch
      + ubuntu-add-initrd-less-boot-fallback.patch
      + ubuntu-mkconfig-leave-breadcrumbs.patch
      + ubuntu-fix-lzma-decompressor-objcopy.patch
      + ubuntu-add-devicetree-command-support.patch
      + ubuntu-boot-from-multipath-dependent-symlink.patch
      + ubuntu-resilient-boot-ignore-alternative-esps.patch
      + ubuntu-resilient-boot-boot-order.patch
      + ubuntu-speed-zsys-history.patch
      + ubuntu-dont-verify-loopback-images.patch
      + ubuntu-recovery-dis_ucode_ldr.patch
      + ubuntu-add-initrd-less-boot-messages.patch
      + rhboot-f34-make-exit-take-a-return-code.patch
      + rhboot-f34-dont-use-int-for-efi-status.patch
      + suse-grub.texi-add-net_bootp6-document.patch
      + ubuntu-verifiers-last.patch
      + ubuntu-os-prober-auto.patch
      + grub-sort-version.patch
      + Revert-kern-ieee1275-init-ppc64-Display-upper_mem_limit-w.patch
      + Revert-kern-ieee1275-init-ppc64-Fix-a-comment.patch
      + Revert-kern-ieee1275-ieee1275-Display-successful-memory-c.patch
      + Revert-loader-powerpc-ieee1275-Use-new-allocation-functio.patch
      + Revert-kern-ieee1275-cmain-ppc64-Introduce-flags-to-ident.patch
      + Revert-kern-ieee1275-init-ppc64-Rename-regions_claim-to-g.patch
      + Revert-kern-ieee1275-init-ppc64-Add-support-for-alignment.patch
      + Revert-kern-ieee1275-init-ppc64-Return-allocated-address-.patch
      + Revert-kern-ieee1275-init-ppc64-Decide-by-request-whether.patch
      + Revert-kern-ieee1275-init-ppc64-Introduce-a-request-for-r.patch
      + grub-install-efi-title.patch
  * Add grub.ubuntu26,1 SBAT entry to indicate upcoming LTS

 -- Mate Kukri <mate.kukri@canonical.com>  Tue, 12 Aug 2025 15:29:16 +0100

grub2 (2.14~git20250718.0e36779-1) experimental; urgency=medium

  [ Mate Kukri ]
  * Import git snapshot of upcoming GRUB 2.14 upstream release
  * d/patches: rebase patches for 2.14 git snapshot
  * d/rules: add erofs_test to XFAIL test
  * peimage: add NX support, fix some bugs (LP: #2104316)
  * Fix ipconfig2 route table parsing (LP: #2088181)

  [ Luca Boccassi ]
  * efi images: enable 'bli' module

  [ Graham Inggs ]
  * debian/control: mark qemu-system build-dependency <!nocheck>

  [ Pascal Hambourg ]
  * debian/grub.d/05_debian_theme: quote background image pathname in output

  [ Mate Kukri ]
  * Resolve zfs root identification (Closes: #848945)
  * Check out missing distfiles from upstream git branch
  * d/build-efi-images: Remove filesystems no longer allowed under lockdown
  * debian: Remove references to dead ports kfreebsd-* and kopensolaris-*
  * d/control: Sync dependencies of grub-efi-{riscv64,loong64} with grub-efi-*
  * d/control: Clean up package relations
  * debian: Tanglu is a dead distro, drop references to it
  * debian: Get rid of non-systemd init scripts
  * debian: Merge grub-common into grub2-common
  * debian: Get rid of update-grub script for grub-legacy
  * debian: Remove support for the yeeloong target
  * Remove support for WUBI (Windows Based Ubuntu Installer)
  * debian/patches: Drop a number of obsolete patches
  * Add "noescape" argument to cmdline creation (LP: #2112179)
  * d/control: Cleanup more package relations
  * Remove IA64 support
  * Remove old maintscripts
  * d/postinst.in: remove grub legacy related functionality
  * Add Provides grub-common to merged grub2-common
  * Update Debian specific SBAT line to grub.debian14 for forky

 -- Mate Kukri <mate.kukri@canonical.com>  Tue, 12 Aug 2025 11:51:55 +0100

grub2 (2.12-9) unstable; urgency=medium

  * Apply patch by Ben Hutchings to not strip .exec or .image files
    (Closes: #1072167)

 -- Felix Zielcke <fzielcke@z-51.de>  Thu, 03 Jul 2025 18:35:51 +0200

grub2 (2.12-8) unstable; urgency=medium

  [ Mate Kukri ]
  * d/default/grub: Always get distributor string from `/etc/os-release`
  * Avoid adding extra GNU/Linux suffix to menu entries (Closes: #1076723)

 -- Felix Zielcke <fzielcke@z-51.de>  Wed, 11 Jun 2025 17:42:34 +0200

grub2 (2.12-7) unstable; urgency=medium

  [ Mate Kukri ]
  * Drop NTFS patches that seem to be causing regressions
    (Closes: #1100486, #1100470)

 -- Felix Zielcke <fzielcke@z-51.de>  Sat, 15 Mar 2025 14:55:29 +0100

grub2 (2.12-6) unstable; urgency=medium

  [ Mate Kukri ]
  * Fix out of bounds XSDT access, re-enable ACPI SPCR table support

  [ Miroslav Kure ]
  * Updated Czech translation of grub debconf messages. (Closes: #1035052)

  [ Viktar Siarheichyk ]
  * Updated Belarusian translation. (Closes: #1034905)

  [ Carles Pina i Estany ]
  * Update translation

  [ Felix Zielcke ]
  * Move d/legacy/* files to grub-legacy.
  * Remove traces of ../legacy/ dir in d/rules.

  [ Mate Kukri ]
  * Cherry-pick upstream security patches
  * Bump SBAT level to grub,5
  * SECURITY UPDATE: video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG
    - CVE-2024-45774
  * SECURITY UPDATE: commands/extcmd: Missing check for failed allocation
    - CVE-2024-45775
  * SECURITY UPDATE: gettext: Integer overflow leads to heap OOB write or read
    - CVE-2024-45776
  * SECURITY UPDATE: gettext: Integer overflow leads to heap OOB write
    - CVE-2024-45777
  * SECURITY UPDATE: fs/bfs: Integer overflow
    - CVE-2024-45778
  * SECURITY UPDATE: fs/bfs: integer overflow leads to heap OOB read
    - CVE-2024-45779
  * SECURITY UPDATE: fs/tar: Integer overflow leads to heap OOB write
    - CVE-2024-45780
  * SECURITY UPDATE: fs/ufs: `strcpy` use leading to heap OOB write
    - CVE-2024-45781
  * SECURITY UPDATE: fs/hfs: `strcpy` use leading to potential heap OOB write
    - CVE-2024-45782
  * SECURITY UPDATE: fs/hfsplus: incorrect refcount handling leading to UAF
    - CVE-2024-45783
  * SECURITY UPDATE: command/gpg: Use-after-free due to hooks not being removed on module unload
    - CVE-2025-0622
  * SECURITY UPDATE: net: Out-of-bounds write in grub_net_search_config_file()
    - CVE-2025-0624
  * SECURITY UPDATE: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks
    - CVE-2025-0677
  * SECURITY UPDATE: squash4: Integer overflow may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0678
  * SECURITY UPDATE: reiserfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0684
  * SECURITY UODATE: jfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0685
  * SECURITY UPDATE: romfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0686
  * SECURITY UPDATE: udf: Heap based buffer overflow  in grub_udf_read_block() may lead to arbitrary code execution
    - CVE-2025-0689
  * SECURITY UPDATE: read: Integer overflow may lead to out-of-bounds write
    - CVE-2025-0690
  * SECURITY UPDATE: commands/dump: The dump command is not in lockdown when secure boot is enabled
    - CVE-2025-1118
  * SECURITY UPDATE: fs/hfs: Integer overflow may lead to heap based out-of-bounds write
    - CVE-2025-1125
  * SECURITY UPDATE: insmod: incorrect refcount handling leading to UAF [LP: #2055835]

 -- Mate Kukri <mate.kukri@canonical.com>  Sat, 15 Feb 2025 17:17:14 +0000

grub2 (2.12-5ubuntu12) questing; urgency=medium

  * Rebuild against latest fuse3

 -- Jeremy Bícha <jbicha@ubuntu.com>  Fri, 02 May 2025 09:11:09 -0400

grub2 (2.12-5ubuntu11) plucky; urgency=medium

  * Replace 4GB memory allocation limit fix (LP: #2106728)

 -- Tobias Heider <tobias.heider@canonical.com>  Thu, 10 Apr 2025 15:23:50 +0200

grub2 (2.12-5ubuntu10) plucky; urgency=medium

  * Limit 4GB memory allocation to arm64 (LP: #2103864)

 -- Mate Kukri <mate.kukri@canonical.com>  Sat, 22 Mar 2025 16:09:04 +0000

grub2 (2.12-5ubuntu9) plucky; urgency=medium

  * Drop NTFS patches that seem to be causing regressions

 -- Mate Kukri <mate.kukri@canonical.com>  Mon, 17 Mar 2025 11:37:37 +0000

grub2 (2.12-5ubuntu8) plucky; urgency=medium

  * Cherry-pick upstream vulnerability fixes
  * Cherry-pick extfs regression patch
  * Cherry-pick xfs regression patches
  * Bump SBAT level to grub,5
  * {arm64,loongarch64,riscv64}: Limit memory allocations to 4GB
  * SECURITY UPDATE: video/readers/jpeg: Do not permit duplicate SOF0 markers in JPEG
    - CVE-2024-45774
  * SECURITY UPDATE: commands/extcmd: Missing check for failed allocation
    - CVE-2024-45775
  * SECURITY UPDATE: gettext: Integer overflow leads to heap OOB write or read
    - CVE-2024-45776
  * SECURITY UPDATE: gettext: Integer overflow leads to heap OOB write
    - CVE-2024-45777
  * SECURITY UPDATE: fs/bfs: Integer overflow
    - CVE-2024-45778
  * SECURITY UPDATE: fs/bfs: integer overflow leads to heap OOB read
    - CVE-2024-45779
  * SECURITY UPDATE: fs/tar: Integer overflow leads to heap OOB write
    - CVE-2024-45780
  * SECURITY UPDATE: fs/ufs: `strcpy` use leading to heap OOB write
    - CVE-2024-45781
  * SECURITY UPDATE: fs/hfs: `strcpy` use leading to potential heap OOB write
    - CVE-2024-45782
  * SECURITY UPDATE: fs/hfsplus: incorrect refcount handling leading to UAF
    - CVE-2024-45783
  * SECURITY UPDATE: command/gpg: Use-after-free due to hooks not being removed on module unload
    - CVE-2025-0622
  * SECURITY UPDATE: net: Out-of-bounds write in grub_net_search_config_file()
    - CVE-2025-0624
  * SECURITY UPDATE: UFS: Integer overflow may lead to heap based out-of-bounds write when handling symlinks
    - CVE-2025-0677
  * SECURITY UPDATE: squash4: Integer overflow may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0678
  * SECURITY UPDATE: reiserfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0684
  * SECURITY UODATE: jfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0685
  * SECURITY UPDATE: romfs: Integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data
    - CVE-2025-0686
  * SECURITY UPDATE: udf: Heap based buffer overflow  in grub_udf_read_block() may lead to arbitrary code execution
    - CVE-2025-0689
  * SECURITY UPDATE: read: Integer overflow may lead to out-of-bounds write
    - CVE-2025-0690
  * SECURITY UPDATE: commands/dump: The dump command is not in lockdown when secure boot is enabled
    - CVE-2025-1118
  * SECURITY UPDATE: fs/hfs: Integer overflow may lead to heap based out-of-bounds write
    - CVE-2025-1125
  * SECURITY UPDATE: insmod: incorrect refcount handling leading to UAF [LP: #2055835]

 -- Mate Kukri <mate.kukri@canonical.com>  Mon, 13 Jan 2025 10:51:59 +0000

grub2 (2.12-5ubuntu7) plucky; urgency=medium

  * Provide pre-built BIOS and IEEE1275 El-Torito images (LP: #2086841)

 -- Mate Kukri <mate.kukri@canonical.com>  Thu, 07 Nov 2024 11:53:40 +0000

grub2 (2.12-5ubuntu5.1) oracular; urgency=medium

  * riscv: use time register in grub_efi_get_time_ms() (LP: #2076651)
  * Defer NX policy enforcement to shim (LP: #2084104)

 -- Mate Kukri <mate.kukri@canonical.com>  Fri, 11 Oct 2024 10:03:49 +0100

grub2 (2.12-5ubuntu5) oracular; urgency=medium

  * peimage: Fixup grub_error -> grub_dprintf
  * peimage: Fixup section consistency checks (LP: #2078307)

 -- Mate Kukri <mate.kukri@canonical.com>  Fri, 30 Aug 2024 16:11:07 +0100

grub2 (2.12-5ubuntu4) oracular; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - Add Ubuntu sbat data
    - build-efi-images: do not produce -installer.efi.signed. LP #1863994
    - grub-common: Install canonical-uefi-ca.crt
    - Check signatures
    - Support installing to multiple ESP (LP #1871821)
    - Split out unsigned artefacts into grub2-unsigned
    - Vcs-Git: Point to ubuntu packaging branch
    - Relax dependencies on grub-common and grub2-common
    - UBUNTU: Do not link grub-efi-*-unsigned docs to grub-common
    - UBUNTU: Default timeout changes
    - UBUNTU: Replace grub-install-extra-removable
    - UBUNTU: Revert "Add jfs module to signed UEFI images. Closes: #950959"
    - UBUNTU: Revert "Add f2fs module to signed UEFI images"
    - UBUNTU: Drop luks2
    - Install grub-initrd-fallback.service again
    - Build using -O1 on s390x to avoid misoptimization
    - grub-check-signatures: Support gzip compressed kernels
    - forward port fix for LP #1926748
    - Forward port the fix for LP #1930742 and make it conditional (xenial/bionic only)
    - Build grub2-unsigned packages with xz compression
    - Drop i386 from grub-efi-amd64*
    - Turn depends on grub-efi-amd64/arm64 unversioned
    - Revert "Have -bin packages Break pre-2.12 -signed packages"
    - Install grub-sort-version
    - rules: Add DPKG_BUILDPACKAGE_OPTIONS to generate-grub2-unsigned
    - d/postinst.in: Make empty "grub-pc/install_devices" non-fatal in "noninteractive" mode
    - Add debconf options "grub-{efi,pc}/cloud_style_installation"
    - grub-common.service: Add After/Requires=boot-complete.target (LP #1992643)
    - d/postinst.in: Remove upgrade check for GRUB version we can no longer upgrade from
    - Removed patches:
      + install-signed.patch with
      + grub-install-extra-removable.patch
      + grub-install-removable-shim.patch
    - Added patches:
      + ubuntu-install-signed.patch
      + ubuntu-grub-install-extra-removable.patch
      + ubuntu-zfs-enhance-support.patch
      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
      + ubuntu-zfs-mkconfig-signed-kernel.patch
      + ubuntu-zfs-gfxpayload-keep-default.patch
      + ubuntu-zfs-gfxpayload-dynamic.patch
      + ubuntu-zfs-vt-handoff.patch
      + ubuntu-zfs-mkconfig-recovery-title.patch
      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
      + ubuntu-support-initrd-less-boot.patch
      + ubuntu-shorter-version-info.patch
      + ubuntu-add-initrd-less-boot-fallback.patch
      + ubuntu-mkconfig-leave-breadcrumbs.patch
      + ubuntu-fix-lzma-decompressor-objcopy.patch
      + ubuntu-add-devicetree-command-support.patch
      + ubuntu-boot-from-multipath-dependent-symlink.patch
      + ubuntu-resilient-boot-ignore-alternative-esps.patch
      + ubuntu-resilient-boot-boot-order.patch
      + ubuntu-speed-zsys-history.patch
      + ubuntu-dont-verify-loopback-images.patch
      + ubuntu-recovery-dis_ucode_ldr.patch
      + ubuntu-add-initrd-less-boot-messages.patch
      + rhboot-f34-make-exit-take-a-return-code.patch
      + rhboot-f34-dont-use-int-for-efi-status.patch
      + suse-grub.texi-add-net_bootp6-document.patch
      + ubuntu-verifiers-last.patch
      + ubuntu-os-prober-auto.patch
      + grub-sort-version.patch
      + Revert-kern-ieee1275-init-ppc64-Display-upper_mem_limit-w.patch
      + Revert-kern-ieee1275-init-ppc64-Fix-a-comment.patch
      + Revert-kern-ieee1275-ieee1275-Display-successful-memory-c.patch
      + Revert-loader-powerpc-ieee1275-Use-new-allocation-functio.patch
      + Revert-kern-ieee1275-cmain-ppc64-Introduce-flags-to-ident.patch
      + Revert-kern-ieee1275-init-ppc64-Rename-regions_claim-to-g.patch
      + Revert-kern-ieee1275-init-ppc64-Add-support-for-alignment.patch
      + Revert-kern-ieee1275-init-ppc64-Return-allocated-address-.patch
      + Revert-kern-ieee1275-init-ppc64-Decide-by-request-whether.patch
      + Revert-kern-ieee1275-init-ppc64-Introduce-a-request-for-r.patch
      + grub-install-efi-title.patch
      + kern-efi-mm-Change-grub_efi_mm_add_regions-to-keep-track-.patch
      + kern-efi-mm-Change-grub_efi_allocate_pages_real-to-call-s.patch
      + kern-efi-mm-Detect-calls-to-grub_efi_drop_alloc-with-wron.patch
      + nx/modules-strip-.llvm_addrsig-sections-and-similar.patch
      + nx/modules-Don-t-allocate-space-for-non-allocable-sections.patch
      + nx/modules-load-module-sections-at-page-aligned-addresses.patch
      + nx/nx-add-memory-attribute-get-set-API.patch
      + nx/nx-set-page-permissions-for-loaded-modules.patch
      + nx/nx-set-the-nx-compatible-flag-in-EFI-grub-images.patch
      + nx/efi-Disallow-fallback-to-legacy-Linux-loader-when-shim-sa.patch
      + nx/peimage-Add-memory-attribute-support.patch
      + commands-efi-tpm-Re-enable-measurements-on-confidential-c.patch
      + loader-efi-fdt-Add-fdtdump-command-to-access-device-tree.patch
  * Rebase d/legacy/update-grub.ubuntu.patch
  * Move -unsigned binaries to the -unsigned sources
  * efi/chainloader: Do not print device path (LP: #2073634)
  * Disable ELF metadata injection

 -- Mate Kukri <mate.kukri@canonical.com>  Mon, 22 Jul 2024 10:55:04 +0100

grub2 (2.12-5) unstable; urgency=medium

  * Build-Depend on pkgconf instead of pkg-config.
  * Update legacy/update-grub to correctly check for grub2 core.img
  * Correct Breaks+Replaces on grub-efi-arm64-unsigned for grub-efi-arm64-bin.
    (Closes: #1076235)

 -- Felix Zielcke <fzielcke@z-51.de>  Mon, 15 Jul 2024 17:05:20 +0200

grub2 (2.12-4) unstable; urgency=medium

  [ Mate Kukri ]
  * Determine GRUB_DISTRIBUTOR from os-release and fall back to build-time dpkg vendor

  [ Felix Zielcke ]
  * Ship gdb_helper.py in dbg packages. (Closes: #1072164)
  * Update README.source to mention that we're now using gbp-pq instead of git-dpm.
  * Add grub-pc+grub2-common Breaks: against grub-legacy (<< 0.97-83~).
  * Upload to unstable.

 -- Felix Zielcke <fzielcke@z-51.de>  Wed, 10 Jul 2024 09:18:01 +0200

grub2 (2.12-3) experimental; urgency=medium

  [ Colin Watson ]
  * Update signing-template Uploaders to match main package.

  [ Mate Kukri ]
  * d/p/mkconfig-ubuntu-recovery.patch: Use "recovery" instead of "single recovery" for recovery mode bootparams
  * d/p/revert-term-ns8250-spcr.patch: Revert ACPI SPCR table support (#1062073)
  * d/p/efidisk-breakup-large-reads.patch: efidisk: Breakup large reads into batches
  * Revert "d/p/efidisk-breakup-large-reads.patch: efidisk: Breakup large reads into batches"

  [ Jiajie Chen ]
  * Enable building for LoongArch64

  [ Heinrich Schuchardt ]
  * d/rules: build monolithic images for all EFI architectures

  [ Julian Andres Klode ]
  * Introduce new -unsigned packages to house the pre-built .efi binaries
  * signing: Use the -unsigned packages as signed build-depends

  [ Jiajie Chen ]
  * d/p/sb/efi-use-peimage-shim.patch: add loong64 suppport

  [ Felix Zielcke ]
  * Update Breaks/Replaces -efi-{ia32,amd64}-bin to << 2.12-3~ at -unsigned packages.

  [ Pascal Hambourg ]
  * 05_debian_theme: cache background picture if not in /boot/grub filesystem
  * debian/default/grub: Replace 'vbeinfo' with 'videoinfo'
  * debian/default/grub: Document /etc/default/grub.d/*.cfg

  [ Tianyu Chen ]
  * Make grub-common Breaks grub-efi-*-signed (<< 1+2.12~rc1)

 -- Julian Andres Klode <juliank@ubuntu.com>  Thu, 25 Apr 2024 16:52:04 +0200

grub2 (2.12-2) unstable; urgency=medium

  [ Mate Kukri ]
  * Revert peimage to re-use GRUB's image handle (LP: #2057679) (LP: #2054127)
  * d/build-efi-images: Make sure downstream didn't remove peimage SBAT
    entry
  * SECURITY UPDATE: Use-after-free in peimage module [LP: #2054127]
    - CVE-2024-2312

  [ Julian Andres Klode ]
  * Bump SBAT level to `grub.peimage,2`; and also bump `grub.debian,5` to
    make sure we can revoke any downstream users of peimage that forgot to
    include the grub.peimage component if that should become necessary.

 -- Julian Andres Klode <jak@debian.org>  Fri, 05 Apr 2024 20:45:55 +0200

grub2 (2.12-1ubuntu9) oracular; urgency=medium

  * Cherry-pick upstream efi mm patches to avoid crashing at exit on Mu
  * peimage: Improve section consistency checks, use grub_dprintf for errors
  * peimage: Make sure partially loaded images are unloaded on error
  * Implement support for UEFI NX mitigation
  * Cherry-pick missing TDX measurements fix (LP: #2069232)
  * grub-common.service: Add After/Requires=boot-complete.target (LP: #1992643)
  * d/postinst.in: Remove upgrade check for GRUB version we can no longer upgrade from
  * Cherry-pick fdtdump patch

 -- Mate Kukri <mate.kukri@canonical.com>  Wed, 19 Jun 2024 11:47:16 +0100

grub2 (2.12-1ubuntu7) noble; urgency=medium

  * d/p/grub-sort-version.patch: Also patch grub-mkconfig to export GRUB_FLAVOUR_ORDER
  * d/grub-sort-version: Update regex to correctly match kernel flavour
  * d/grub-sort-version: Append `-0` to abi strings before passing to python-apt (Fixes LP: #2041827)
  * debian/: Add tests for grub-sort-version
  * Revert peimage to re-use GRUB's image handle (LP: #2057679) (LP: #2054127)
  * Increase SBAT level to "grub.ubuntu,2" and "grub.peimage,2"
  * d/build-efi-images: Make sure downstream didn't remove peimage SBAT entry
  * SECURITY UPDATE: Use-after-free in peimage module [LP: #2054127]
    - CVE-2024-2312

 -- Mate Kukri <mate.kukri@canonical.com>  Thu, 04 Apr 2024 11:12:35 +0100

grub2 (2.12-1ubuntu6) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 08:54:41 +0000

grub2 (2.12-1ubuntu5) noble; urgency=medium

  * No-change rebuild for libefivar1t64 on riscv64.

 -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 07 Mar 2024 09:18:17 +0000

grub2 (2.12-1ubuntu4) noble; urgency=medium

  * d/grub-multi-install: Treat missing `cloud_style_installation` debconf as
    false (LP: #2055294)

 -- Mate Kukri <mate.kukri@canonical.com>  Wed, 28 Feb 2024 15:55:10 +0000

grub2 (2.12-1ubuntu3) noble; urgency=medium

  * Improve GRUB reinstallation in cloud images (LP: #2054103):
    - Add debconf options "grub-{efi,pc}/cloud_style_installation"
    - d/postinst.in: Make empty "grub-pc/install_devices" non-fatal in
      noninteractive mode
  * Determine GRUB_DISTRIBUTOR from os-release and fall back to build-time
    dpkg vendor (LP: #2034253)
  * d/p/grub-install-efi-title.patch: Use case-sensitive GRUB distributor as
    EFI option title (LP: #2026310)
  * Unreleased changes from Debian:
    - d/p/revert-term-ns8250-spcr.patch: Revert ACPI SPCR table support
      (#1062073)

 -- Mate Kukri <mate.kukri@canonical.com>  Tue, 27 Feb 2024 10:54:26 +0000

grub2 (2.12-1ubuntu2) noble; urgency=medium

  * Revert patchset "ppc64: Restrict memory allocations" (LP: #2053117)

 -- Mate Kukri <mate.kukri@canonical.com>  Wed, 14 Feb 2024 09:19:35 +0000

grub2 (2.12-1ubuntu1) noble; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - Add Ubuntu sbat data
    - build-efi-images: do not produce -installer.efi.signed. LP: 1863994
    - grub-common: Install canonical-uefi-ca.crt
    - Check signatures
    - Support installing to multiple ESP (LP: 1871821)
    - Disable various bits on i386
    - Split out unsigned artefacts into grub2-unsigned
    - Vcs-Git: Point to ubuntu packaging branch
    - Relax dependencies on grub-common and grub2-common
    - grub-pc: Avoid the possibility of breaking grub on SRU update due
      to ABI change
    - UBUNTU: Default timeout changes
    - Revert "Add jfs module to signed UEFI images. Closes: #950959"
    - Revert "Add f2fs module to signed UEFI images"
    - Install grub-initrd-fallback.service again
    - Build using -O1 on s390x to avoid misoptimization
    - grub-check-signatures: Support gzip compressed kernels (LP: #1954683)
    - grub-multi-install: Reset partition type between partitions (LP: #1997795)
    - Drop i386 from grub-efi-amd64* (LP: #2020907)
    - Turn depends on grub-efi-amd64/arm64 unversioned
    - forward port fix for LP: #1926748
    - Make the grub2/no_efi_extra_removable setting work correctly
    - Forward port the fix for LP: #1930742 and make it conditional (xenial/bionic only)
    - Build grub2-unsigned packages with xz compression
    - Revert: "Have -bin packages Break pre-2.12 -signed packages.", this is not
      compatible with our versioning schemes.
    - Install a /usr/lib/grub/grub-sort-version and use that to sort versions as
      it respects GRUB_FLAVOUR_ORDER. Depend on python3 to do so.
    - rules: Add DPKG_BUILDPACKAGE_OPTIONS to generate-grub2-unsigned
    - Drop luks2
    - d/control: Add python3-apt to Depends of grub-common (LP: #2048953)
    - Replaced patches:
      - install-signed.patche
      - grub-install-extra-removable.patch
      - grub-install-removable-shim.patch
    - Added patches:
      + rhboot-f34-dont-use-int-for-efi-status.patch
      + rhboot-f34-make-exit-take-a-return-code.patch
      + suse-grub.texi-add-net_bootp6-document.patch
      + ubuntu-add-devicetree-command-support.patch
      + ubuntu-add-initrd-less-boot-fallback.patch
      + ubuntu-add-initrd-less-boot-messages.patch
      + ubuntu-boot-from-multipath-dependent-symlink.patch
      + ubuntu-dont-verify-loopback-images.patch
      + ubuntu-fix-lzma-decompressor-objcopy.patch
      + ubuntu-grub-install-extra-removable.patch
      + ubuntu-install-signed.patch
      + ubuntu-mkconfig-leave-breadcrumbs.patch
      + ubuntu-os-prober-auto.patch
      + ubuntu-recovery-dis_ucode_ldr.patch
      + ubuntu-resilient-boot-boot-order.patch
      + ubuntu-resilient-boot-ignore-alternative-esps.patch
      + ubuntu-shorter-version-info.patch
      + ubuntu-speed-zsys-history.patch
      + ubuntu-support-initrd-less-boot.patch
      + ubuntu-verifiers-last.patch
      + ubuntu-zfs-enhance-support.patch
      + ubuntu-zfs-gfxpayload-dynamic.patch
      + ubuntu-zfs-gfxpayload-keep-default.patch
      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
      + ubuntu-zfs-mkconfig-recovery-title.patch
      + ubuntu-zfs-mkconfig-signed-kernel.patch
      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
      + ubuntu-zfs-vt-handoff.patch
  * Unreleased changes from Debian:
    - Update signing-template Uploaders to match main package.
    - d/p/mkconfig-ubuntu-recovery.patch: Use "recovery" instead of "single recovery"
      for recovery mode bootparams (LP: #2041245)

 -- Mate Kukri <mate.kukri@canonical.com>  Mon, 29 Jan 2024 11:06:12 +0000

grub2 (2.12-1) unstable; urgency=medium

  [ Mate Kukri ]
  * New upstream version, 2.12
  * d/patches: Rebase on `upstream/2.12` and drop superseded patches:
    - Dropping patches now included upstream:
      + d/p/ntfs-cve-fixes/*: Fixes for NTFS OOB CVE
      + d/p/upstream/xfs-*: XFS parsing fixes
      + d/p/upstream/unmerged-usr-shebang.patch
    - Dropping patch replaced with configure option:
      + d/p/dejavu-font-path.patch
  * d/rules: Pass configure option '--enable-grub-themes'
  * d/rules: Provide Debian specific DejaVu path via configure
  * d/{control,rules}: Use default gcc version
  * d/p/extra_deps_lst.patch:
    Checkout "extra_deps.lst" from upstream/master
  * d/p/sb/revert-efi-fallback-to-legacy.patch:
    Also revert newer fallback patch

  [ Julian Andres Klode ]
  * Add Mate to Uploaders

 -- Mate Kukri <mate.kukri@canonical.com>  Mon, 15 Jan 2024 09:54:55 +0000

grub2 (2.12~rc1-13) unstable; urgency=medium

  * No-change rebuild to retrigger signing following binNMU breakage

 -- Julian Andres Klode <jak@debian.org>  Fri, 12 Jan 2024 19:00:41 +0100

grub2 (2.12~rc1-12ubuntu5) noble; urgency=medium

  * d/control: Add python3-apt to Depends of grub-common (LP: #2048953)

 -- Mate Kukri <mate.kukri@canonical.com>  Fri, 09 Feb 2024 13:23:36 +0000

grub2 (2.12~rc1-12ubuntu4) noble; urgency=medium

  * d/p/delay-copying-to-grubdir.patch: Move platdir path canonicalisation
    after files were copied to grubdir. (LP: #2045944)

 -- Mate Kukri <mate.kukri@canonical.com>  Fri, 08 Dec 2023 09:22:22 +0000

grub2 (2.12~rc1-12ubuntu3) noble; urgency=medium

  * d/p/delay-copying-to-grubdir.patch: Improve grub-install robustness by
    delaying the update of /boot after install device validation
  * Remove workaround for LP: 1889556 (LP: #2043995)
    - Was not needed since /boot rollback was introduced upstream
    - Patch above ensures that this will not reoccur even if rollback fails

 -- Mate Kukri <mate.kukri@canonical.com>  Tue, 21 Nov 2023 15:35:55 +0000

grub2 (2.12~rc1-12ubuntu2) noble; urgency=medium

  * Merge from Debian unstable; remaining changes:
    - Add Ubuntu sbat data
    - build-efi-images: do not produce -installer.efi.signed. LP: 1863994
    - grub-common: Install canonical-uefi-ca.crt
    - Check signatures
    - Support installing to multiple ESP (LP: 1871821)
    - Disable various bits on i386
    - Split out unsigned artefacts into grub2-unsigned
    - Vcs-Git: Point to ubuntu packaging branch
    - Relax dependencies on grub-common and grub2-common
    - grub-pc: Avoid the possibility of breaking grub on SRU update due
      to ABI change
    - UBUNTU: Default timeout changes
    - Revert "Add jfs module to signed UEFI images. Closes: #950959"
    - Revert "Add f2fs module to signed UEFI images"
    - Install grub-initrd-fallback.service again
    - Build using -O1 on s390x to avoid misoptimization
    - grub-check-signatures: Support gzip compressed kernels (LP: #1954683)
    - grub-multi-install: Reset partition type between partitions (LP: #1997795)
    - Drop i386 from grub-efi-amd64* (LP: #2020907)
    - Turn depends on grub-efi-amd64/arm64 unversioned
    - forward port fix for LP: #1926748
    - Make the grub2/no_efi_extra_removable setting work correctly
    - Forward port the fix for LP: #1930742 and make it conditional (xenial/bionic only)
    - Build grub2-unsigned packages with xz compression
    - Revert: "Have -bin packages Break pre-2.12 -signed packages.", this is not
      compatible with our versioning schemes.
    - Install a /usr/lib/grub/grub-sort-version and use that to sort versions as
      it respects GRUB_FLAVOUR_ORDER. Depend on python3 to do so.
    - rules: Add DPKG_BUILDPACKAGE_OPTIONS to generate-grub2-unsigned
    - Replaced patches:
      - installe-signed.patched
      - grub-install-extra-removable.patch
      - grub-install-removable-shim.patch
    - Added patches:
      + rhboot-f34-dont-use-int-for-efi-status.patch
      + rhboot-f34-make-exit-take-a-return-code.patch
      + suse-grub.texi-add-net_bootp6-document.patch
      + ubuntu-add-devicetree-command-support.patch
      + ubuntu-add-initrd-less-boot-fallback.patch
      + ubuntu-add-initrd-less-boot-messages.patch
      + ubuntu-boot-from-multipath-dependent-symlink.patch
      + ubuntu-dont-verify-loopback-images.patch
      + ubuntu-fix-lzma-decompressor-objcopy.patch
      + ubuntu-grub-install-extra-removable.patch
      + ubuntu-install-signed.patch
      + ubuntu-mkconfig-leave-breadcrumbs.patch
      + ubuntu-os-prober-auto.patch
      + ubuntu-recovery-dis_ucode_ldr.patch
      + ubuntu-resilient-boot-boot-order.patch
      + ubuntu-resilient-boot-ignore-alternative-esps.patch
      + ubuntu-shorter-version-info.patch
      + ubuntu-speed-zsys-history.patch
      + ubuntu-support-initrd-less-boot.patch
      + ubuntu-verifiers-last.patch
      + ubuntu-zfs-enhance-support.patch
      + ubuntu-zfs-gfxpayload-dynamic.patch
      + ubuntu-zfs-gfxpayload-keep-default.patch
      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
      + ubuntu-zfs-mkconfig-recovery-title.patch
      + ubuntu-zfs-mkconfig-signed-kernel.patch
      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
      + ubuntu-zfs-vt-handoff.patch
  * Removed luks2 from signed EFI binaries (LP: #2043101)

 -- Mate Kukri <mate.kukri@canonical.com>  Thu, 09 Nov 2023 16:16:56 +0200

grub2 (2.12~rc1-12) unstable; urgency=medium

  [ Mate Kukri ]
  * Port UEFI based network stack to 2.12 (LP: #2039081)
  * efi: Correct image unloading behavior
  * Prevent the incorrect use of `UnloadImage()` by binaries loaded by peimage
  * efinet: HTTP_MESSAGE fix field size (LP: #2043084)

  [ Abe Wieland ]
  * Maintain administrator value for os-prober

  [ Julian Andres Klode ]
  * Cherry-pick upstream XFS directory extent parsing fixes (Closes: #1051543)
    (LP: #2039172)

 -- Julian Andres Klode <jak@debian.org>  Thu, 09 Nov 2023 14:13:44 +0200

grub2 (2.12~rc1-11) unstable; urgency=medium

  [ Mate Kukri ]
  * SECURITY UPDATE: Crafted file system images can cause out-of-bounds write
    and may leak sensitive information into the GRUB pager.
    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-
      label.patch:
      fs/ntfs: Fix an OOB read when parsing a volume label
    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-parsing-bs-for-
      index-at.patch:
      fs/ntfs: Fix an OOB read when parsing bitmaps for index attributes
    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-parsing-dory-
      entries-fr.patch:
      fs/ntfs: Fix an OOB read when parsing directory entries from resident and
      non-resident index attributes
    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-reading-data-fhe-
      reside.patch:
      fs/ntfs: Fix an OOB read when reading data from the resident $DATA +
      attribute
    - CVE-2023-4693
  * SECURITY UPDATE: Crafted file system images can cause heap-based buffer
    overflow and may allow arbitrary code execution and secure boot bypass.
    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-write-when-parsing-the-
      ATTRIBUTE_LIST-.patch:
      fs/ntfs: Fix an OOB write when parsing the $ATTRIBUTE_LIST attribute for
      the $MFT file
    - d/patches/ntfs-cve-fixes/fs-ntfs-Make-code-more-readable.patch
      fs/ntfs: Make code more readable
    - CVE-2023-4692
  * efi: Cleanup peimage.c

  [ Julian Andres Klode ]
  * Bump SBAT to grub,4

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 02 Oct 2023 15:55:25 +0200

grub2 (2.12~rc1-10ubuntu4) mantic; urgency=high

  * SECURITY UPDATE: Crafted file system images can cause out-of-bounds write
    and may leak sensitive information into the GRUB pager.
    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-
      label.patch:
      fs/ntfs: Fix an OOB read when parsing a volume label
    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-parsing-bs-for-
      index-at.patch:
      fs/ntfs: Fix an OOB read when parsing bitmaps for index attributes
    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-parsing-dory-
      entries-fr.patch:
      fs/ntfs: Fix an OOB read when parsing directory entries from resident and
      non-resident index attributes
    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-read-when-reading-data-fhe-
      reside.patch:
      fs/ntfs: Fix an OOB read when reading data from the resident $DATA +
      attribute
    - CVE-2023-4693
  * SECURITY UPDATE: Crafted file system images can cause heap-based buffer
    overflow and may allow arbitrary code execution and secure boot bypass.
    - d/patches/ntfs-cve-fixes/fs-ntfs-Fix-an-OOB-write-when-parsing-the-
      ATTRIBUTE_LIST-.patch:
      fs/ntfs: Fix an OOB write when parsing the $ATTRIBUTE_LIST attribute for
      the $MFT file
    - d/patches/ntfs-cve-fixes/fs-ntfs-Make-code-more-readable.patch
      fs/ntfs: Make code more readable
    - CVE-2023-4692

 -- Mate Kukri <mate.kukri@canonical.com>  Mon, 02 Oct 2023 15:23:58 +0100

grub2 (2.12~rc1-10ubuntu2) mantic; urgency=medium

  * Merge from Debian unstable to pick up fixes (LP: #2028947); remaining changes:
    - Add Ubuntu sbat data
    - build-efi-images: do not produce -installer.efi.signed. LP: 1863994
    - grub-common: Install canonical-uefi-ca.crt
    - Check signatures
    - Support installing to multiple ESP (LP: 1871821)
    - Disable various bits on i386
    - Split out unsigned artefacts into grub2-unsigned
    - Vcs-Git: Point to ubuntu packaging branch
    - Relax dependencies on grub-common and grub2-common
    - grub-pc: Avoid the possibility of breaking grub on SRU update due
      to ABI change
    - UBUNTU: Default timeout changes
    - Revert "Add jfs module to signed UEFI images. Closes: #950959"
    - Revert "Add f2fs module to signed UEFI images"
    - Install grub-initrd-fallback.service again
    - Build using -O1 on s390x to avoid misoptimization
    - grub-check-signatures: Support gzip compressed kernels (LP: #1954683)
    - grub-multi-install: Reset partition type between partitions (LP: #1997795)
    - Drop i386 from grub-efi-amd64* (LP: #2020907)
    - Turn depends on grub-efi-amd64/arm64 unversioned
    - forward port fix for LP: #1926748
    - Make the grub2/no_efi_extra_removable setting work correctly
    - Forward port the fix for LP: #1930742 and make it conditional (xenial/bionic only)
    - Build grub2-unsigned packages with xz compression
    - Replaced patches:
      - installe-signed.patched
      - grub-install-extra-removable.patch
      - grub-install-removable-shim.patch
    - Added patches:
      + rhboot-f34-dont-use-int-for-efi-status.patch
      + rhboot-f34-make-exit-take-a-return-code.patch
      + suse-grub.texi-add-net_bootp6-document.patch
      + ubuntu-add-devicetree-command-support.patch
      + ubuntu-add-initrd-less-boot-fallback.patch
      + ubuntu-add-initrd-less-boot-messages.patch
      + ubuntu-boot-from-multipath-dependent-symlink.patch
      + ubuntu-dont-verify-loopback-images.patch
      + ubuntu-fix-lzma-decompressor-objcopy.patch
      + ubuntu-grub-install-extra-removable.patch
      + ubuntu-install-signed.patch
      + ubuntu-mkconfig-leave-breadcrumbs.patch
      + ubuntu-os-prober-auto.patch
      + ubuntu-recovery-dis_ucode_ldr.patch
      + ubuntu-resilient-boot-boot-order.patch
      + ubuntu-resilient-boot-ignore-alternative-esps.patch
      + ubuntu-shorter-version-info.patch
      + ubuntu-speed-zsys-history.patch
      + ubuntu-support-initrd-less-boot.patch
      + ubuntu-verifiers-last.patch
      + ubuntu-zfs-enhance-support.patch
      + ubuntu-zfs-gfxpayload-dynamic.patch
      + ubuntu-zfs-gfxpayload-keep-default.patch
      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
      + ubuntu-zfs-mkconfig-recovery-title.patch
      + ubuntu-zfs-mkconfig-signed-kernel.patch
      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
      + ubuntu-zfs-vt-handoff.patch
  * Dropped Ubuntu changes:
    - Temporarily rmmod peimage for os-prober chainloader entries (LP: #2030810)
  * Revert: "Have -bin packages Break pre-2.12 -signed packages.", this is not
    compatible with our versioning schemes.
  * Install a /usr/lib/grub/grub-sort-version and use that to sort versions as
    it respects GRUB_FLAVOUR_ORDER. Depend on python3 to do so.
  * rules: Add DPKG_BUILDPACKAGE_OPTIONS to generate-grub2-unsigned

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 25 Sep 2023 17:31:09 +0200

grub2 (2.12~rc1-10) unstable; urgency=medium

  [ Julian Andres Klode ]
  * Cherry pick fix for unmerged usr shebang (Closes: #1051251)
  * grub-common.dirs: Install empty /etc/default/grub.d (Closes: #1051412)

  [ Mate Kukri ]
  * efi: Eliminate globals from the `peimage.c` chainloader

 -- Julian Andres Klode <jak@debian.org>  Mon, 18 Sep 2023 12:23:29 +0200

grub2 (2.12~rc1-9) unstable; urgency=medium

  * Correct the Breaks to include the ~rc1 bit of the version

 -- Julian Andres Klode <jak@debian.org>  Tue, 05 Sep 2023 19:13:30 +0200

grub2 (2.12~rc1-8) unstable; urgency=medium

  * Have -bin packages Break pre-2.12 -signed packages.
    On insecurely booted systems, upgrading the -bin packages with
    the modules before the -signed packages caused the signed binaries
    to crash when loading additional modules. (Closes: #1051271)
  * Revert "In the signed packages, change the version dependency"
    This reverts commit 680bb22c3308b7ccd0a7eb7923c7d68067b626f9. The
    signed package needs the modules to be at the same version during
    boot on insecure systems or it may crash trying to load further
    modules.
  * Set Protected: yes for -signed packages so they cannot easily be removed.
    This ensures that the = depends in grub-efi-amd64-signed does not
    cause it to be removed when it is out of sync with src:grub2

 -- Julian Andres Klode <jak@debian.org>  Tue, 05 Sep 2023 19:06:05 +0200

grub2 (2.12~rc1-7) unstable; urgency=medium

  * Upload to unstable

 -- Julian Andres Klode <jak@debian.org>  Mon, 04 Sep 2023 20:03:09 +0200

grub2 (2.12~rc1-6) experimental; urgency=medium

  * Use rm_conffile instead of remove-on-upgrade.
    This works with ftp-master's old lintian version and allows
    easy backports

 -- Julian Andres Klode <jak@debian.org>  Mon, 04 Sep 2023 16:57:55 +0200

grub2 (2.12~rc1-5) experimental; urgency=medium

  [ Felix Zielcke ]
  * Add salsa-ci.yml and disable blhc and reprotest pipelines.
  * remove on upgrades /etc/default/grub.d/init-select.cfg. (Closes: #1042707)

  [ Julian Andres Klode ]
  * peimage: Set file_path for loaded image (LP: #2030810, #2032294)
  * Hack up the lintian overrides for stable lintian on ftp-master

 -- Julian Andres Klode <jak@debian.org>  Mon, 04 Sep 2023 14:16:12 +0200

grub2 (2.12~rc1-4ubuntu3) mantic; urgency=medium

  * zfs: Drop `set -u`, incompatible with undefined variables in library
    (LP: #2033256)

 -- Julian Andres Klode <juliank@ubuntu.com>  Tue, 29 Aug 2023 16:03:49 +0200

grub2 (2.12~rc1-4ubuntu2) mantic; urgency=medium

  * ubuntu-zfs-enhance-support.patch: Adjustments for 2.12 library
    (LP: #2029260)
  * zfs: on_exit: Unmount ${MNTDIR}/boot before ${MNTDIR} (LP: #2031042)
  * Temporarily rmmod peimage for os-prober chainloader entries (LP: #2030810)

 -- Julian Andres Klode <juliank@ubuntu.com>  Mon, 21 Aug 2023 14:26:07 +0200

grub2 (2.12~rc1-4ubuntu1) mantic; urgency=medium

  * Merge from Debian unstable (LP: #2028947); remaining changes:
    - Add Ubuntu sbat data
    - build-efi-images: do not produce -installer.efi.signed. LP: 1863994
    - grub-common: Install canonical-uefi-ca.crt
    - Check signatures
    - Support installing to multiple ESP (LP: 1871821)
    - Disable various bits on i386
    - Split out unsigned artefacts into grub2-unsigned
    - Vcs-Git: Point to ubuntu packaging branch
    - Relax dependencies on grub-common and grub2-common
    - grub-pc: Avoid the possibility of breaking grub on SRU update due
      to ABI change
    - UBUNTU: Default timeout changes
    - Revert "Add jfs module to signed UEFI images. Closes: #950959"
    - Revert "Add f2fs module to signed UEFI images"
    - Install grub-initrd-fallback.service again
    - Build using -O1 on s390x to avoid misoptimization
    - grub-check-signatures: Support gzip compressed kernels (LP: #1954683)
    - grub-multi-install: Reset partition type between partitions (LP: #1997795)
    - Drop i386 from grub-efi-amd64* (LP: #2020907)
    - Turn depends on grub-efi-amd64/arm64 unversioned
    - forward port fix for LP: #1926748
    - Make the grub2/no_efi_extra_removable setting work correctly
    - Forward port the fix for LP: #1930742 and make it conditional (xenial/bionic only)
    - Build grub2-unsigned packages with xz compression
    - Replaced patches:
      - installe-signed.patched
      - grub-install-extra-removable.patch
      - grub-install-removable-shim.patch
    - Added patches:
      + rhboot-f34-dont-use-int-for-efi-status.patch
      + rhboot-f34-make-exit-take-a-return-code.patch
      + suse-grub.texi-add-net_bootp6-document.patch
      + ubuntu-add-devicetree-command-support.patch
      + ubuntu-add-initrd-less-boot-fallback.patch
      + ubuntu-add-initrd-less-boot-messages.patch
      + ubuntu-boot-from-multipath-dependent-symlink.patch
      + ubuntu-dont-verify-loopback-images.patch
      + ubuntu-fix-lzma-decompressor-objcopy.patch
      + ubuntu-grub-install-extra-removable.patch
      + ubuntu-install-signed.patch
      + ubuntu-mkconfig-leave-breadcrumbs.patch
      + ubuntu-os-prober-auto.patch
      + ubuntu-recovery-dis_ucode_ldr.patch
      + ubuntu-resilient-boot-boot-order.patch
      + ubuntu-resilient-boot-ignore-alternative-esps.patch
      + ubuntu-shorter-version-info.patch
      + ubuntu-speed-zsys-history.patch
      + ubuntu-support-initrd-less-boot.patch
      + ubuntu-verifiers-last.patch
      + ubuntu-zfs-enhance-support.patch
      + ubuntu-zfs-gfxpayload-dynamic.patch
      + ubuntu-zfs-gfxpayload-keep-default.patch
      + ubuntu-zfs-insmod-xzio-and-lzopio-on-xen.patch
      + ubuntu-zfs-mkconfig-recovery-title.patch
      + ubuntu-zfs-mkconfig-signed-kernel.patch
      + ubuntu-zfs-mkconfig-ubuntu-distributor.patch
      + ubuntu-zfs-mkconfig-ubuntu-recovery.patch
      + ubuntu-zfs-vt-handoff.patch
  * Dropped Ubuntu changes:
    - All the rhboot loader patches
    - Temporarily, support for GRUB_FLAVOUR_ORDER
    - RISC-V patches, applied upstream:
      + efi-add-definition-of-LoadFile2-protocol.patch
      + efi-correct-struct-grub_efi_boot_services.patch
      + efi-implemented-LoadFile2-initrd-loading-protocol-fo.patch
      + efi-implement-grub_efi_run_image.patch
      + RISC-V-Update-image-header.patch
      + RISC-V-Use-common-linux-loader.patch
      + riscv-adjust-march-flags-for-binutils-2.38.patch
      + upstream/riscv-handle-r-riscv-call-plt-reloc.patch
      + loader-drop-argv-argument-in-grub_initrd_load.patch
      + loader-Move-arm64-linux-loader-to-common-code.patch
    - Networking patches (rebasing still WIP):
      + cherrypick-efi-grub_efi_close_protocol.patch
      + cherrypick-efinet-correct-closing-snp-protocol.patch
      + efinet-uefi-ipv6-pxe-support.patch
      + suse-add-support-for-UEFI-network-protocols.patch
      + suse-AUDIT-0-http-boot-tracker-bug.patch
    - Red Hat boot loader, replaced by upstream:
      + linuxefi-do-not-validate-kernels-twice.patch
      + linuxefi-Invalidate-i-cache-before-starting-the-kern.patch
      + rhboot-bounce-buffers.patch
      + rhboot-efi-allocate-in-kernel-bounds.patch
      + rhboot-efi-allocate-kernel-as-code-for-real.patch
      + rhboot-efi-allocate-kernel-as-code.patch
      + rhboot-efi-enumerated-array-for-allocation-choice.patch
      + rhboot-efi-fix-incorrect-array-size.patch
      + rhboot-efi-initrd-above-4gb.patch
      + rhboot-efi-kernel-allocator.patch
      + rhboot-efi-rearrange-grub-cmd-linux.patch
      + rhboot-efi-split-allocation-policy.patch
      + rhboot-f34-efinet-also-use-the-firmware-acceleration-for-http.patch
      + rhboot-f34-make-pmtimer-tsc-calibration-fast.patch
      + rhboot-try-to-pick-better-locations-for-kernel-and-initrd.patch
      + ubuntu-linuxefi-arm64.patch
      + ubuntu-linuxefi-arm64-set-base-addr.patch
      + ubuntu-linuxefi.patch
      + ubuntu-rhboot-cast-fixups.patch
      + ubuntu-efi-allow-loopmount-chainload.patch
      + ubuntu-efi-loader-code.patch
    - Security patches, applied upstream:
      + {0076...0161} security patches, applied upstream
      + font-*.patchi - security patches applied upstream
      + commands-efi-tpm-Use-grub_strcpy-instead-of-grub_memcpy.patch
      + fbutil-Fix-integer-overflow.patch
      + kern-efi-sb-Enforce-verification-of-font-files.patch
      + normal-charset-Fix-an-integer-overflow-in-grub_unicode_ag.patch
    - Misc patches, merged in Debian:
      + efi-EFI-Device-Tree-Fixup-Protocol.patch
      + efivar-check-that-efivarfs-is-writeable.patch
      + fat-fix-listing-the-root-directory.patch
      + fdt-add-debug-output-to-devicetree-command.patch
      + zstd-require-8-byte-buffer.patch
      + 0241-Call-hwmatch-only-on-the-grub-pc-platform.patch
    - Misc patches applied upstream:
      + 2.12-mm/* - applied upstream
      + ubuntu-fuse3.patch
      + xfs-fix-v4-superblock.patch
      + tpm-unknown-error-non-fatal.patch
      + commands-efi-tpm-Refine-the-status-of-log-event.patch
      + efi-tpm-Add-EFI_CC_MEASUREMENT_PROTOCOL-support.patch
      + linux_xen-Properly-load-multiple-initrd-files.patch
      + linux_xen-Properly-order-multiple-initrd-files.patch
      + linux-ignore-FDT-unless-we-need-to-modify-it.patch
      + mkrescue-efi-modules.patch
      + tests-ahci-update-qemu-device-name.patch
    - No longer relevant:
      + ubuntu-disable-LOAD-FILE2-protocol-for-initrd-on-ARM.patch
      + ubuntu-temp-keep-auto-nvram.patch: was temporary in 2019 lol
      + ubuntu-skip-disk-by-id-lvm-pvm-uuid-entries.patch
      + no-devicetree-if-secure-boot.patch
      + no-insmod-on-sb.patch
    - To be rewritten later in this cycle:
      + ubuntu-flavour-order.patch
    - Coalesced into some other patches:
      + ubuntu-zfs-maybe-quiet.patch
      + ubuntu-zfs-quick-boot.patch

 -- Julian Andres Klode <juliank@ubuntu.com>  Fri, 28 Jul 2023 15:34:32 +0200

grub2 (2.12~rc1-4) experimental; urgency=medium

  [ Julian Andres Klode ]
  * Fix quiet boot feature
  * Drop fs-tester-time-fail.patch, upstream
  * postinst: look at /boot/grub/$target/core.efi to determine if we ran already
  * Cherry-pick additional Ubuntu patches
    - zstd-require-8-byte-buffer.patch: Fix for buffer size in zstd
    - recovery-dis_ucode_ldr.patch: Pass dis_ucode_ldr to kernel for
      recovery mode
    - hwmatch-only-on-grub-pc-platform.patch: Only call hwmatch on grub-pc
      (Closes: #990836)
    - fdt-add-debug-output-to-devicetree-command.patch: Debugging output
      for the devicetree command
    - fdt-device-tree-fixup-protocol.patch: Support for u-boot device tree
      fixup protocol
    - fat-fix-listing-the-root-directory.patch: Fix listing of files with
      0 timestamps in FAT
    - efivar-check-that-efivarfs-is-writeable.patch: Do not hard error
      if we cannot write the EFI variables. Some implementations, like
      u-boot do not support writing them.
  * Only build peimage on supported architectures
  * debian/po: Refresh templates

  [ Felix Zielcke ]
  * Update mkconfig-ubuntu-recovery.patch to respect
    GRUB_CMDLINE_LINUX_RECOVERY from /etc/default/grub.
    (Closes: #766530, #922425)
  * Strip grub-emu binary.

 -- Julian Andres Klode <jak@debian.org>  Fri, 28 Jul 2023 14:54:14 +0200

grub2 (2.12~rc1-3) experimental; urgency=medium

  * Build peimage as a module and insert into signed images
  * peimage: Copy the image header and ensure it's not clobbered
  * Drop grub.cfg-400.patch, world-readable boot config violates several guidelines unfortunately
  * Drop mkconfig-other-inits.patch (alternative init boot options)
  * Order patches not used by Ubuntu last to simplify maintenance
  * Drop mkconfig-signed-kernel.patch, .signed kernels are no longer used

 -- Julian Andres Klode <jak@debian.org>  Tue, 25 Jul 2023 16:44:12 +0200

grub2 (2.12~rc1-2) experimental; urgency=medium

  [ Julian Andres Klode ]
  * Build-Depend on libsdl2-dev instead of libsdl1.2-dev (Closes: #1038035)
  * Link peimage into arm_efi target, fixes armhf/armel FTBFS
  * peimage: Add chainloader support

  [ Heinrich Schuchardt ]
  * Enable building for RISC-V (LP: #1876620) (Closes: #995718)

 -- Julian Andres Klode <jak@debian.org>  Fri, 21 Jul 2023 18:02:28 +0200

grub2 (2.12~rc1-1) experimental; urgency=medium

  [ Julian Andres Klode ]
  * New upstream version, 2.12~rc1
  * build-efi-images: Drop linuxefi, using new loaders now
  * Do not try to install gmodule.pl, it was rewritten in Python
  * Rebase patches
    - Temporarily drop -dpkg-version-comparison.patch, needs to be adjusted
      for switch from comparison to sort -V
    - Drop -linuxefi.patch, fix-lockdown.patch, arm64-handover-to-kernel-if-sb-enabled.patch;
      we will be using the upstream loader now, with an additional compat
      layer for shim tbd
    - Apply new network patch set from mailing list (no additional patches yet)
    - Drop ton of patches applied upstream
  * Implement an alternative approach to secure boot, using the upstream EFI
    loader, and temporarily emulating load_image() and friends using Ubuntu's
    peimage file while a image protocol is being added to shim.
  * Build-Depend on gawk, it fails to compile with mawk
  * Fix lzo test and xfail tests requiring root
  * Fix lintian overrides
  * Add grub,debian13,1 and grub.peimage,1 SBAT levels, this allows
    individually revoking the parts affecting only trixie or the new
    shared peimage loader.

  [ Dimitri John Ledkov ]
  * Include fdt modules in arm64 EFI images, tpm in all archs (LP: #2008950)

 -- Julian Andres Klode <jak@debian.org>  Wed, 19 Jul 2023 19:21:17 +0200

grub2 (2.06-14) experimental; urgency=medium

  [ Julian Andres Klode ]
  * "Upstreaming" Ubuntu changes, part 1.
  * Fixup filename for debian/patches/gcc12_build_dangling_pointer.patch
  * Disable os-prober for ppc64el on the PowerNV platform (for Petitboot)
  * Build with FUSE3 (LP: #1935659)
  * build-efi-images: Add http to netboot images
  * Bundle unicode.pf2 in a squashfs memdisk attached to the signed EFI binary
  * Automatic patch queue rebase

  [ Dimitri John Ledkov ]
  * minilzo: built using the distribution's minilzo
  * dirs.in: create var/lib/grub/ucf in grub-efi-amd64 (and similar)
  * grub-common.service: port init.d script to systemd unit. Add warning
    message, when initrdless boot fails triggering fallback. LP: #1901553
  * Make prebuilt netboot image look for grub.cfg-$deb_arch
  * Link grub-efi-{amd64,arm64}-bin docs directory

  [ Jeffery To ]
  * Add hibernation resumption support to grub-common.service

 -- Julian Andres Klode <jak@debian.org>  Mon, 19 Jun 2023 17:26:49 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog grub-rescue-pc`.
