efi-boot-shim.git - (mirror of https://github.com/vyos/efi-boot-shim.git)

Age	Commit message (Collapse)	Author
2018-08-21	Add mm/fb hashing to TODO, put that and related things under 'Reproducible ↵	Mathieu Trudel-Lapierre
	builds'
2018-08-01	Add fallback boot loop detection to TODO	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2018-04-13	Add some more TODO tasks.	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2018-04-12	Add another unfortunate TODO entry.	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2018-04-10	Add some more TODOs for shim 16	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2018-04-04	Add another TODO for shim-16	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2018-03-23	Add some TODO items for shim-16	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2017-08-11	Update TODO with some stuff	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-02	Update for Josh's changes.	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2013-10-01	Include shim's vendor_cert in MokListRT	Peter Jones
	There needs to be some way to communicate to the kernel that it's a trusted key, and since this mechanism already exists, it's by far the easiest.
2013-10-01	Harden shim against non-participating bootloaders.	Peter Jones
	It works like this: during startup of shim, we hook into the system's ExitBootServices() and StartImage(). If the system's StartImage() is called, we automatically unhook, because we're chainloading to something the system can verify. When shim's verify is called, we record what kind of certificate the image was verified against. If the call /succeeds/, we remove our hooks. If ExitBootServices() is called, we check how the bootloader verified whatever it is loading. If it was verified by its hash, we unhook everything and call the system's EBS(). If it was verified by certificate, we check if it has called shim_verify(). If it has, we unhook everything and call the system's EBS() If the bootloader has not verified anything, and is itself verified by a certificate, we display a security violation warning and halt the machine.
2013-10-01	Remove TODO items fixed by merging lf_merge and lcp/lf-security-override.	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-23	Add MokListRT option rom entry.	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-23	Update TODO with missing description.	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2013-09-23	Made TODO represent the present.	Peter Jones
	Signed-off-by: Peter Jones <pjones@redhat.com>
2012-07-09	Update TODO	Matthew Garrett

2012-06-18	Attempt to start image using LoadImage/StartImage first	Matthew Garrett

2012-06-18	Check that platform is in user mode before doing any validation	Matthew Garrett

2012-05-30	Add a brief TODO	Matthew Garrett