efi-boot-shim.git/Makefile, branch 0.5

Bump version to 0.5

2013-10-04T21:04:21+00:00

Signed-off-by: Peter Jones

Add ident-like blobs to shim.efi for version checking.

2013-10-03T15:11:09+00:00

I feel dirty.

Remove "shim.cer" on "make clean".

2013-10-02T14:48:41+00:00

If we don't do this, an old key winds up being reused and MokManager.efi.signed is signed with a different key than shim_cert reflects. Signed-off-by: Peter Jones

Conditionalize overriding the security policy.

2013-10-01T18:03:16+00:00

Make OVERRIDE_SECURITY_POLICY a build option. Signed-off-by: Peter Jones

Merge console_control.h and console.h

2013-10-01T18:03:16+00:00

Since these are topically the same thing, they can live together. Signed-off-by: Peter Jones

Make verbose stuff use console_notify

2013-10-01T18:03:16+00:00

Signed-off-by: Peter Jones

Harden shim against non-participating bootloaders.

2013-10-01T18:03:16+00:00

It works like this: during startup of shim, we hook into the system's ExitBootServices() and StartImage(). If the system's StartImage() is called, we automatically unhook, because we're chainloading to something the system can verify. When shim's verify is called, we record what kind of certificate the image was verified against. If the call /succeeds/, we remove our hooks. If ExitBootServices() is called, we check how the bootloader verified whatever it is loading. If it was verified by its hash, we unhook everything and call the system's EBS(). If it was verified by certificate, we check if it has called shim_verify(). If it has, we unhook everything and call the system's EBS() If the bootloader has not verified anything, and is itself verified by a certificate, we display a security violation warning and halt the machine.

Make vendor_cert/vendor_dbx actually replaceable by an external tool.

2013-10-01T18:03:16+00:00

This moves them both to be computed at runtime from a pointer+offset rather than just a pointer, so that their real address can be entirely derived from the section they're in. This means you can replace the whole .vendor_cert section with a new one with certs that don't have the same size.

Clean up tarballs in "make clean"

2013-09-26T15:58:02+00:00

Signed-off-by: Peter Jones

Merge signature.h into efiauthenticated.h and guid.h

2013-09-26T15:58:02+00:00

Conflicts: shim.c