shim-signed.git/debian/changelog, branch rollingVyOS code for the shim-signed package (mirror of https://github.com/vyos/shim-signed.git)
https://git.amelek.net/vyos/shim-signed.git/atom?h=rolling2026-06-01T18:24:12+00:00Add signed SHIM binary including the VyOS Networks CA certificate2026-06-01T18:24:12+00:00Christian Breunigchristian@breunig.cc2026-06-01T18:23:20+00:00urn:sha1:dc02d90e677b796bb4814e069f1cfb0856d95147Fix up stupid omission in the previous package upload2026-05-19T22:45:00+00:00Steve McIntyresteve@einval.com2026-05-19T22:45:00+00:00urn:sha1:d94c2b0f2abfe9873e0ebad99a43f9b160397df3
the changes in 1.49 did not take into account the "SecureBoot enabled"
case when adding a default error trap. Closes: #1137098, #1137101.
Make mokutil parsing more robust. Closes: #11370632026-05-19T08:43:36+00:00Steve McIntyresteve@einval.com2026-05-19T08:43:36+00:00urn:sha1:1c4e702c99a185924a847ba464cd2205796ecce2
Cope with "Platform is in Setup Mode" message
If we get any other unexpected output, print what we got for debugging.
Make sure we remove shim-signed.preinst during clean2026-05-18T13:35:25+00:00Steve McIntyresteve@einval.com2026-05-18T13:32:43+00:00urn:sha1:df6d46ce5a1bd5f7548daca14884905074383e4fUpdate changelog and release 1.482026-05-18T13:12:28+00:00Steve McIntyresteve@einval.com2026-05-18T13:12:28+00:00urn:sha1:409da09ec16bd2a28041db9608661a7f8fc7ec37Update changelog2026-05-17T21:49:28+00:00Steve McIntyresteve@einval.com2026-05-17T21:46:17+00:00urn:sha1:5bf524a5960e24df055123cb491d52fe8f265c94Update changelog2026-05-13T22:08:09+00:00Steve McIntyresteve@einval.com2026-05-13T22:08:09+00:00urn:sha1:46b1703f38382efebc0526e1c7f98609d6d2f5f0Add support for verifying and then combining signatures2026-04-28T16:35:25+00:00Steve McIntyresteve@einval.com2026-04-28T13:01:32+00:00urn:sha1:e2a56d673c66989136c41a6f1c997ff1aad10097
from multiple signed shims.
* Move the verification logic out into a new helper script
verify_combine_sigs - see comments there for how it works.
* Rename the existing shim binaries and CA cert to match
* Include some extra certs and binaries for testing with
update-secureboot-policy: do better checking around DKMS2025-07-29T17:41:55+00:00Steve McIntyresteve@einval.com2025-07-29T17:12:19+00:00urn:sha1:d51bfcf945e1070a551cf8ec5d94b91b213991e1
If we have DKMS modules installed:
+ Check to see if a DKMS MOK key has been created and enrolled;
+ Check that all the DKMS modules are signed with that key;
If successful, don't tell users to disable Secure Boot.
Closes: #1108278.
Add dependencies on openssl and kmod for shim-signed-common,
needed for implementing these check.
No-change rebuild to upload source-only.2025-06-23T10:56:16+00:00Steve McIntyresteve@einval.com2025-06-23T10:56:16+00:00urn:sha1:644e18fd2a66209405f379fb7b8ed863b5ae2aaa