Rocky 9 aarch64 deployment fails because of "grub2-install: error: This utility should not be used for EFI platforms because it does not support UEFI Secure Boot."

Users
1

I created Rocky 9 aarch64 image by Packer-maas and deployed it to an arm64 machine, but deployment failed with the following error.

Command: ['unshare', '--fork', '--pid', '--', 'chroot', '/tmp/tmpy7xf6hka/target', 'grub2-install', '--target=arm64-efi', '--efi-directory=/boot/efi', '--bootloader-id=rocky', '--recheck']
Exit code: 1
Reason: -
Stdout: ''
Stderr: Installing for arm64-efi platform.
        grub2-install: error: This utility should not be used for EFI platforms because it does not support UEFI Secure Boot. If you really wish to proceed, invoke the --force option.
        Make sure Secure Boot is disabled before proceeding.

I found a couple of posts and articles about a way to fix this error in rescue mode(see below), but I don’t know what to do with Maas or Packer-Maas to solve this issue.

# rm /boot/efi/EFI/rocky/grub.cfg
# rm /boot/grub2/grub.cfg
# dnf reinstall shim-* grub2-efi-* grub2-common

Could someone help me figure out the necessary steps to resolve this problem?

2

Just based on the error, have you checked the BIOS to see if secure boot is enabled?

3

Yes, I have before creating this thread.

Although English isn’t my native language, if you read the message carefully, it seems that grub2-install is designed to fail on any EFI platforms unless you add the --force option. The message states, “This utility should not be used for EFI platforms because it does not support UEFI Secure Boot. If you really wish to proceed, invoke the --force option. Make sure Secure Boot is disabled before proceeding.”

To me, the error message indirectly says, “grub2-install isn’t aware of whether or not Secure Boot is enabled. It’s up to you to proceed, but you must add the --force option if you really want to,” which is puzzling to me…

On the other hand, the custom Rocky 9 amd64(not arm64) image that I’ve created by packer-maas works fine on amd64 machines with efi. So the problem seems like a bug of grub2-install being used with “–target=arm64-efi” option, but I’m not so sure…

Is there a way to add “–force” in Curtin or a way to add these three commands before Curtin executes “grub2-install”?

# rm /boot/efi/EFI/rocky/grub.cfg
# rm /boot/grub2/grub.cfg
# dnf reinstall shim-* grub2-efi-* grub2-common
4

can you please share the packer template/scripts you used to build aarch64 image for MAAS?

you can overwrite curtin template with a custom one but im not expert what you will need to change

sudo cp /var/snap/maas/current/preseeds/curtin_userdata_centos.sample /var/snap/maas/current/preseeds/curtin_userdata_rocky_amd64_generic_9

5

Thanks, @noama, for the comment here. I had actually posted a question for you on the GitHub issue a few weeks ago as I was investigating this. Please visit this link on Github to find out the changes I made.