| Age | Commit message (Collapse) | Author |
|---|
|
so they'll get an empty dbs list rather than breaking the build
|
|
It wouldn't hurt to keep a record of them.
|
|
While it maybe convenient for a developer to be able to do a build
w/o any dbx hashes, it prevents the $(DBX_LIST) target from having
a proper dependency on the $(DBX_HASHES) file. If a developer were
to add a new hash in a built tree, make would not detect that on
a subsequent build and would not update the $(DBX_LIST) file.
Continue to support a NULL $(DBX_LIST) build by touching the
$(DBX_LIST) file in case no efisiglist commands ran. Developers
can now create an empty $(DBX_HASHES) file to get that.
|
|
|
|
Without this we would silently ignore an efisiglist command error.
|
|
|
|
Changes:
crash fixes
generate dbx file at runtime
|
|
signed arm64 grub binaries that allow use of the devicetree command,
as found in
grub-efi-arm64-signed_1+2.02+dfsg1+16_arm64.deb
grub-efi-arm64-signed_1+2.02+dfsg1+17_arm64.deb
|
|
|
|
This allow us to block executing binaries with specific
checksums. Generate the dbx list at runtime from a simple list of
sha256 hashes, so we can update this easily. If we need to also
blacklist a cert later, we'll need to update this code to add that
option too.
Add a build-dep on pesign to get the needed efisiglist program.
|
|
To get better control of reproducibility during the lifetime of
Buster
|
|
|
|
Cherry-picked fix from upstream MR at
https://github.com/rhboot/shim/pull/174/commits/3a9e237b1baddf0d3192755406befb3e9fa5ca80
From: https://github.com/openssl/openssl/commit/f13615c5b828aeb8e3d9bf2545c803633d1c684f
Apply an upstream patch from OpenSSL to tolerate a NULL sn. This
avoids a NULL pointer reference in shim.c:verify_eku(). This was
discovered because it causes a crash on ARM where, unlike x86, it does
not necessarily have memory mapped at 0x0.
Fixes: 6c180c6004ac ("shim: verify Extended Key Usage flags")
Signed-off-by: dann frazier <dann.frazier@canonical.com>
|
|
Backport of upstream fix:
VLogError() calculates the size of format strings by using calls to
SPrint and VSPrint with a StrSize of 0 and NULL for an output
buffer. Unfortunately, this is an incorrect usage of (V)Sprint. A
StrSize of "0" is special-cased to mean "there is no limit". So, we
end up writing our string to address 0x0. This was discovered because
it causes a crash on ARM where, unlike x86, it does not necessarily
have memory mapped at 0x0.
Avoid the (V)Sprint calls altogether by using (V)PoolPrint, which
handles the size calculation and allocation for us.
Signed-off-by: Peter Jones <pjones@redhat.com>
Fixes: 25f6fd08cd26 ("try to show errors more usefully.")
[dannf: commit message ]
Signed-off-by: dann frazier <dann.frazier@canonical.com>
|
|
|
|
|
|
|
|
to fix clashes with the old shim-signed package for fbx64.efi.signed
and mmx64.efi.signed. Closes: #924619
|
|
|
|
We manually install things owned by root. There might be better ways
to do this, but this will do for now.
|
|
|
|
|
|
Force a no-change rebuild on all arches with a source-only upload
|
|
|
|
Move all the data under a new top-level "packages" key
Add an empty "trusted_certs" key - the helper binaries do not do any
further verification with an embedded key.
|
|
Remove potential confusion with shim-signed. We will now end up with
shim-helpers-$arch-signed to make it clear that they just contain the
helper binaries (fb.efi and mm.efi)
|
|
Add me and vorlon to the Uploaders list
|
|
|
|
Signed-off-by: Luca Boccassi <bluca@debian.org>
|
|
|
|
Lintian parses the shebang in the rules files of the templates packages
and complains that there is no dependency on make. But they are special
packages, so override it.
|
|
for getting the MOK-manager and fall-back binary to be signed by Debians
singing service instead of using an ephemeral key.
Closes: #922228
|
|
as all EFI binaries are now unsigned. They are useless to any normal
user as
- shim is useless without being signed by an external UEFI CA.
- mm and fb won't be loaded by shim as they are now no longer linked to
corresponding shim by the ephemeral key any longer.
|
|
shim creates an ephemeral key, which gets embedded into shim and is used
to sign the corresponding mok-manager (mm*.efi) and fall-back-manager
(fb*.efi).
This makes the build unreproducible.
For Debian we will get those two binaries signed by our Debian-UEFI-CA,
which is the primary (and only) key embedded in shim.
|
|
as Makefiles used "install -m 0644" by now.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
- debian/patches/second-stage-path: dropped; the default loader path now
includes an arch suffix.
- debian/patches/sbsigntool-no-pesign: dropped; no longer needed.
* Drop remaining patches that were not being applied.
* Sync packaging from Ubuntu:
- debian/copyright: Update upstream source location.
- debian/control: add a Build-Depends on libelf-dev.
- Enable arm64 build.
- debian/patches/fixup_git.patch: don't run git in clean; we're not
really in a git tree.
- debian/rules, debian/shim.install: use the upstream install target as
intended, and move files to the target directory using dh_install.
- define RELEASE and COMMIT_ID for the snapshot.
- Set ENABLE_HTTPBOOT to enable the HTTP Boot feature.
- Update dh_auto_build/dh_auto_clean/dh_auto_install for new upstream
options: set MAKELEVEL.
- Define an EFI_ARCH variable, and use that for paths to shim. This
makes it possible to build a shim for other architectures than amd64.
- Set EFIDIR=$distro for dh_auto_install; that will let files be installed
in the "right" final directories, and makes boot.csv for us.
- Set ENABLE_SHIM_CERT, to keep using ephemeral self-signed certs built
at compile-time for MokManager and fallback.
- Set ENABLE_SBSIGN, to use sbsign instead of pesign for signing fallback
and MokManager.
|
|
|
|
|
|
|
|
|
|
a git tree.
|
|
- define RELEASE and COMMIT_ID for the snapshot.
- Set ENABLE_HTTPBOOT to enable the HTTP Boot feature.
|
