summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-09-27debian/control: add Breaks: for the previous shim-signed builds given that ↵Mathieu Trudel-Lapierre
shim will now build and ship BOOT.CSV by itself.
2017-09-27Ignore unused-variable errors.Mathieu Trudel-Lapierre
2017-09-27New upstream snapshot: 13~git1505328971.0780644aMathieu Trudel-Lapierre
2017-09-26Use iconv for UCS-2 encoding.Peter Jones
Cyphermox discovered that when you run this: ( printf "\xff\x00\xfe\x00" ; echo "shimx64.efi,foo,,This is the boot entry for foo" ) | sed -z 's/./&\x00/g' on some debian machines, printf(1) doesn't interpret the \x.. characters, and that results in this being the encoded text: 00000000 5c 78 66 66 5c 78 66 65 73 00 68 00 69 00 6d 00 |\xff\xfes.h.i.m.| 00000010 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 2c 00 |x.6.4...e.f.i.,.| 00000020 66 00 6f 00 6f 00 2c 00 2c 00 54 00 68 00 69 00 |f.o.o.,.,.T.h.i.| which... yeah, that's wrong. So instead, use iconv instead of printf+sed to encode it in UCS-2. Unfortunately, that means we don't get endian markers, because for some reason iconv(1) doesn't have any way to say it should include them. But that's okay; fallback already handles not having them and just assumes the second byte being \x00 means UCS-2LE. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-19Fix an LDFLAGS issue on arm and aarch64Peter Jones
Commit 1e71734992 inadvertantly switched ARM's LDFLAGS+=--defsym=EFI_SUBSYSTEM=$(SUBSYSTEM) to be before LDFLAGS is set, and so it got clobbered away. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-19Try to do a slightly better job at 'make clean'Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-14New upstream version 13~git1505328971.0780644aupstream/13_git1505328971.0780644aMathieu Trudel-Lapierre
2017-09-14Updated version 13~git1505328971.0780644a from ↵Mathieu Trudel-Lapierre
'upstream/13_git1505328971.0780644a' with Debian dir 8d0dcc2dc48e0c1bf2e174c33432be6f73754e7a
2017-09-14Don't build shim_cert.h in parallel with other targets.Mathieu Trudel-Lapierre
shim_cert.h is required by other pieces (such as netboot.o, cert.o) and might not be built by the time these targets are reached. In that case the build would fail as it can't find a required header. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-14Clean up after BOOT$(ARCH).CSV.Mathieu Trudel-Lapierre
It should not be left around after clean since it's a generated file. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-13try to show errors more usefully.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13Add some debugging data to the last malformed binary check...Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13New upstream snapshot: 13~git1505328970.9c1c35c5Mathieu Trudel-Lapierre
2017-09-13Drop PHONY fix patch; merged upstream.Mathieu Trudel-Lapierre
2017-09-13New upstream version 13~git1505328970.9c1c35c5upstream/13_git1505328970.9c1c35c5Mathieu Trudel-Lapierre
2017-09-13Updated version 13~git1505328970.9c1c35c5 from ↵Mathieu Trudel-Lapierre
'upstream/13_git1505328970.9c1c35c5' with Debian dir 676fec75f526e6b8072deb5302628d27abfc7449
2017-09-13Add some defaults and a syntastic file so vim helps more.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Work around some annoying compiler grievancesPeter Jones
I'm still having some trouble with the offsetof() definition, so just nerf it to what stddef.h would say anyway. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Some things went weird with the openssl revert...Peter Jones
I think this works around most of them. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Cryptlib: remove DESGary Lin
Disable DES completely since it's already old and insecure. This makes MokManager not support the DES based password hash but probably no one is using it. Signed-off-by: Gary Lin <glin@suse.com>
2017-09-08Cryptlib: Remove MD4Gary Lin
MD4 is known to be insecure and shim never uses it. Signed-off-by: Gary Lin <glin@suse.com>
2017-09-08Cryptlib: amend the headers and fix signnessGary Lin
- Declare some functions in the proper headers + We missed them for a long time... - Cast offsetof to UINTN + The original casting triggers the gcc warning since int can not present the offset for the 64bit machines. - Cast the "char" array to "CHAR8 *" to avoid the gcc warnings - Implement atoi correctly Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31changelog: ~test3 wasn't released; prepare for another test upload.Mathieu Trudel-Lapierre
Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-08-31debian/rules, debian/shim.install: make sure the 'make install' step does ↵Mathieu Trudel-Lapierre
what it's meant to do by upstream: we can easily make use of the end result to have the files we need.
2017-08-31debian/patches/buildid_write_return.patch: workaround our strict compile ↵Mathieu Trudel-Lapierre
rules failing the build: make sure write calls check the return value.
2017-08-31debian/control: add a Build-Depends on libelf-dev.Mathieu Trudel-Lapierre
2017-08-31Fix build with ENABLE_SHIM_CERT and ENABLE_SBSIGN: shim.key is created by ↵Mathieu Trudel-Lapierre
the shim.crt target Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-08-31Cryptlib: implement strcmp() and strcasecmp()Gary Lin
strcmp() and strcasecmp() are widely used in openssl. Implement those two functions to eliminate the gcc warnings and the potential crash. Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Cryptlib: Include stddef.h in CrtLibSupport.hGary Lin
The changes in the openssl headers cause the inclusion of CrtLibSupport.h eariler than the inclusion of stddef.h, so "offsetof" was defined twice and this caused the followling build error: In file included from Cryptlib/Include/openssl/buffer.h:23:0, from Cryptlib/Include/openssl/x509.h:22, from shim.c:56: /usr/lib64/gcc/x86_64-suse-linux/6/include/stddef.h:417:0: error: "offsetof" redefined [-Werror] #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) In file included from Cryptlib/Include/limits.h:15:0, from Cryptlib/Include/openssl/ossl_typ.h:13, from Cryptlib/Include/openssl/x509.h:20, from shim.c:56: Cryptlib/Include/CrtLibSupport.h:192:0: note: this is the location of the previous definition #define offsetof(type, member) ( (int) & ((type*)0) -> member ) We can lower the priority of the gcc include path or just remove the path, but this might cause problem since the path was introduced on purpose(*). Instead, including stddef.h first is more feasible. (*) https://github.com/rhinstaller/shim/commit/d51739a416400ad348d8a1c7e3886abce11fff1b Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Revert lots of Cryptlib updates.Peter Jones
OpenSSL changes quite a bit of the key validation, and most of the keys I can find in the wild aren't marked as trusted by the new checker. Intel noticed this too: https://github.com/vathpela/edk2/commit/f536d7c3ed but instead of fixing the compatibility error, they switched their test data to match the bug. So that's pretty broken. For now, I'm reverting OpenSSL 1.1.0e, because we need those certs in the wild to work. This reverts commit 513cbe2aea689bf968f171f894f3d4cdb43524d5. This reverts commit e9cc33d6f2b7f35c6f5e349fd83fb9ae0bc66226. This reverts commit 80d49f758ead0180bfe6161931838e0578248303. This reverts commit 9bc647e2b23bcfd69a0077c0717fbc454c919a57. This reverts commit ae75df6232ad30f3e8736e9449692d58a7439260. This reverts commit e883479f35644d17db7efed710657c8543cfcb68. This reverts commit 97469449fda5ba933a64280917e776487301a127. This reverts commit e39692647f78e13d757ddbfdd36f440d5f526050. This reverts commit 0f3dfc01e2d5e7df882c963dd8dc4a0dfbfc96ad. This reverts commit 4da6ac819510c7cc4ba21d7a735d69b45daa5873. This reverts commit d064bd7eef201f26cb926450a76260b5187ac689. This reverts commit 9bc86cfd6f9387f0da9d5c0102b6aa5627e91c91. This reverts commit ab9a05a10f16b33f7ee1e9da360c7801eebdb9d2. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Drain the OpenSSL error stack and report crypto verification errorsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Init openssl so we can use its debug facilities.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Add a mechanism to print openssl errorsPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Fix a missing OpenSSL error message pointPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-31Make msleep() be a thingPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-29debian/shim.install: update paths in light of using shim's upstream install ↵Mathieu Trudel-Lapierre
target.
2017-08-29Set EFIDIR=ubuntu for dh_auto_install; that will let files be installed in ↵Mathieu Trudel-Lapierre
the "right" final directories, and makes boot.csv for us.
2017-08-29Update dh_auto_build/dh_auto_clean/dh_auto_install for new upstream options: ↵Mathieu Trudel-Lapierre
set MAKELEVEL.
2017-08-29debian/rules: clean up after *.signed files.Mathieu Trudel-Lapierre
2017-08-29debian/patches/fix_makefile_phony.patch: fix a makefile bug causing shim to ↵Mathieu Trudel-Lapierre
fail to build, because it gets confused about the .signed efi files.
2017-08-29Set ENABLE_SBSIGN, to use sbsign instead of pesign for signing fallback and ↵Mathieu Trudel-Lapierre
MokManager. Also drop debian/patches/sbsigntool-no-pesign: with this change from upstream it is no longer needed..
2017-08-29Set ENABLE_SHIM_CERT, to keep using ephemeral self-signed certs built at ↵Mathieu Trudel-Lapierre
compile-time for MokManager and fallback.
2017-08-29debian/patches/second-stage-path: dropped; the default loader path now ↵Mathieu Trudel-Lapierre
includes an arch suffix.
2017-08-29New upstream snapshot: 12+1503074702.5202f80.Mathieu Trudel-Lapierre
2017-08-29Updated version 12+1503074702.5202f80 from 'upstream/12+1503074702.5202f80'Mathieu Trudel-Lapierre
with Debian dir 08243b332bab8ddbadb7a33b4929c3a66682e2c4
2017-08-29New upstream version 12+1503074702.5202f80Mathieu Trudel-Lapierre
2017-08-18Rework looping in enter_mok_menu(), to allow multiple MOK changesMathieu Trudel-Lapierre
Rather than looping once through the possible actions (MokNew, MokDel, etc.), revise the logic so that instead of rebooting immediately we get back to the main menu setting a flag to replace "Continue booting" with a proper reboot. Getting back to the menu means we can go make other changes before rebooting. For instance, you might want to enable validation, but beforehand you also need to enroll a MOK. You can already do so from userland; except the requests were cleared as soon as one of them was processed. This involves some extra cleanup of the states to avoid running the same request more than once, removing the option from the menu once it's done, and changing prompting functions to return an EFI_STATUS so we can better track whether the process has succeeded. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-08-11Add ENABLE_SHIM_HASH and make install-as-data know how to install it.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Update TODO with some stuffPeter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11Make better debuginfo and install it reasonably.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-31 15:45:37 +0000