secboot: update to rev 457b03a - allow proceeding without hardware root of trust

[ernestl]

Allow the preinstall checks to proceed when no hardware root of trust is available, using the existing preinstall action mechanics on the snapd side. The change of interest is: canonical/secboot#551.

This is required as part of the content going into snapd 2.76.2 that will go into the 26.04.1 install image.

Jira: https://warthogs.atlassian.net/browse/SNAPDENG-37118

[andrewphelpsj]

Thanks!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.17%. Comparing base (6b97ba1) to head (403053d).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #17265      +/-   ##
==========================================
- Coverage   79.18%   79.17%   -0.01%     
==========================================
  Files        1381     1378       -3     
  Lines      193759   193722      -37     
  Branches     2466     2466              
==========================================
- Hits       153421   153389      -32     
+ Misses      31155    31134      -21     
- Partials     9183     9199      +16     

Flag	Coverage Δ
unittests	79.17% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

Thu Jun 25 02:13:54 UTC 2026
The following results are from: https://github.com/canonical/snapd/actions/runs/28118807489

Failures:

Preparing:

• openstack-arm-ext:ubuntu-24.04-arm-64:tests/nested/manual/optee-fde:optee
• openstack-arm-ext:ubuntu-24.04-arm-64:tests/nested/manual/optee-fde:hooks
• openstack-arm-ext:ubuntu-24.04-arm-64:tests/nested/core/core20-basic
• openstack:opensuse-tumbleweed-selinux-64:
• openstack:opensuse-tumbleweed-selinux-64:
• openstack:opensuse-tumbleweed-selinux-64:
• openstack:opensuse-tumbleweed-selinux-64:
• openstack:opensuse-tumbleweed-selinux-64:
• openstack:opensuse-tumbleweed-selinux-64:
• openstack:opensuse-tumbleweed-64:
• openstack:opensuse-tumbleweed-64:
• openstack:opensuse-tumbleweed-64:
• openstack:opensuse-tumbleweed-64:
• openstack:opensuse-tumbleweed-64:
• openstack:opensuse-tumbleweed-64:

Restoring:

• openstack:opensuse-tumbleweed-selinux-64:
• openstack:opensuse-tumbleweed-selinux-64:
• openstack:opensuse-tumbleweed-selinux-64:
• openstack:opensuse-tumbleweed-selinux-64:
• openstack:opensuse-tumbleweed-64:
• openstack:opensuse-tumbleweed-64:
• openstack:opensuse-tumbleweed-64:
• openstack:opensuse-tumbleweed-64:
• openstack:opensuse-tumbleweed-selinux-64:
• openstack:opensuse-tumbleweed-64:
• openstack:opensuse-tumbleweed-64:

Skipped tests from snapd-testing-skip

If you wish to have any of the below tests run in your PR, in your PR description, add 'unskip:' followed by a copy-and-pasted list of the below tests you wish to run (unskip plus test list must be valid yaml)

• garden:ubuntu-25.10-64:tests/main/apparmor-prompting-support
• openstack-arm:ubuntu-24.04-arm-64:tests/main/i18n
• openstack-arm:ubuntu-core-24-arm-64:tests/main/i18n
• openstack:debian-sid-64:tests/main/interfaces-network-status-classic
• openstack:debian-sid-64:tests/main/interfaces-xdg-portal-permission-store
• openstack:ubuntu-24.04-64:tests/main/i18n
• openstack:ubuntu-25.10-64:tests/main/apparmor-prompting-flag-restart
• openstack:ubuntu-25.10-64:tests/main/apparmor-prompting-integration-tests
• openstack:ubuntu-25.10-64:tests/main/apparmor-prompting-prompt-restoration
• openstack:ubuntu-25.10-64:tests/main/apparmor-prompting-smoke
• openstack:ubuntu-25.10-64:tests/main/apparmor-prompting-snapd-startup
• openstack:ubuntu-25.10-64:tests/main/apparmor-prompting-support
• openstack:ubuntu-25.10-64:tests/main/interfaces-requests-activates-handlers
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-flag-restart
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-integration-tests
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-prompt-restoration
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-smoke
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-snapd-startup
• openstack:ubuntu-26.04-64:tests/main/apparmor-prompting-support
• openstack:ubuntu-26.04-64:tests/main/i18n
• openstack:ubuntu-26.04-64:tests/main/interfaces-requests-activates-handlers

[ernestl]

Failure Analysis:

(1) spread opensuse / run-spread

This is a known issue related to expired key, NOT related to the secboot bump: "package bpftool-7.7.0-1.14.x86_64 does not verify: Header V3 RSA/SHA512 Signature, key ID 29b700a4: NOTTRUSTED"

(2) spread nested-ubuntu-24.04-arm64 / run-spread

Known issue not related to the secboot update. e.g. another occurrence in difference PR: https://github.com/canonical/snapd/actions/runs/28111878585/job/83328890581?pr=17252

Conclusion: None of the failures related to these changes, and there are no blockers.