Merge xenial-grub-add-signed into ubuntu/xenial [a=powersj] [r=rcj]

amd64: always install grub-efi-amd64-signed

shim-signed does not depend on grub-efi-amd64-signed in Xenial.
Historically, Xenial did not always ship with signatures. This is
different than LTSes after Xenial where this is the case. A future SRU
for grub should change this, but for now ensure to install the signed
package so that secure boot systems can actually boot.

MP: https://code.launchpad.net/~powersj/livecd-rootfs/+git/livecd-rootfs-1/+merge/394769

debian/changelog

@@ -1,3 +1,10 @@
+livecd-rootfs (2.408.64) xenial; urgency=medium
+
+  [ Joshua Powers ]
+  * amd64: always install grub-efi-amd64-signed (LP: #1901906)
+
+ -- Robert C Jennings <robert.jennings@canonical.com>  Wed, 02 Dec 2020 13:11:27 -0600
+
 livecd-rootfs (2.408.63) xenial; urgency=medium
 
   [ John Chittum ]

live-build/auto/config

@@ -503,6 +503,7 @@ case $PROJECT in
 				amd64)
 					add_package install grub-pc
 					add_package install shim-signed
+					add_package install grub-efi-amd64-signed
 					;;
 				armhf)
 					add_package install flash-kernel u-boot-tools

live-build/ubuntu-cpc/hooks.d/base/disk-image-uefi.binary

@@ -86,7 +86,7 @@ install_grub() {
             efi_target=arm64-efi
             ;;
         amd64)
-            chroot mountpoint apt-get install -qqy grub-pc shim-signed
+            chroot mountpoint apt-get install -qqy grub-pc shim-signed grub-efi-amd64-signed
             grub_modules="multiboot serial usb usb_keyboard"
             efi_target=x86_64-efi
             ;;