shim-signed.git/debian/control, branch debian/1.48 VyOS code for the shim-signed package (mirror of https://github.com/vyos/shim-signed.git) https://git.amelek.net/vyos/shim-signed.git/atom?h=debian%2F1.48 2026-05-17T23:56:13+00:00 Switch to using debconf to display signature errors 2026-05-17T23:56:13+00:00 Steve McIntyre steve@einval.com 2026-05-17T23:52:29+00:00 urn:sha1:04a3449adcd413433c45774ac7b150ededaa1c4e Check that we can boot on the current system 2026-05-14T15:33:23+00:00 Steve McIntyre steve@einval.com 2026-05-14T15:33:23+00:00 urn:sha1:be5e1a1dd8e69d54bd52ff55f801028af6b83767 If SecureBoot is enabled, check that our shim binary is signed by at least one of the certificates enrolled in firmware. Update build-deps for 16.1-2 2026-05-13T22:22:53+00:00 Steve McIntyre steve@einval.com 2026-05-13T22:22:53+00:00 urn:sha1:8ed0e53daa6a62a42ddc07ba3f223fc33fc8714a Add support for verifying and then combining signatures 2026-04-28T16:35:25+00:00 Steve McIntyre steve@einval.com 2026-04-28T13:01:32+00:00 urn:sha1:e2a56d673c66989136c41a6f1c997ff1aad10097 from multiple signed shims. * Move the verification logic out into a new helper script verify_combine_sigs - see comments there for how it works. * Rename the existing shim binaries and CA cert to match * Include some extra certs and binaries for testing with update-secureboot-policy: do better checking around DKMS 2025-07-29T17:41:55+00:00 Steve McIntyre steve@einval.com 2025-07-29T17:12:19+00:00 urn:sha1:d51bfcf945e1070a551cf8ec5d94b91b213991e1 If we have DKMS modules installed: + Check to see if a DKMS MOK key has been created and enrolled; + Check that all the DKMS modules are signed with that key; If successful, don't tell users to disable Secure Boot. Closes: #1108278. Add dependencies on openssl and kmod for shim-signed-common, needed for implementing these check. Add alternative dependencies on systemd-boot 2025-05-26T16:43:24+00:00 Luca Boccassi bluca@debian.org 2025-05-26T16:43:24+00:00 urn:sha1:19edb3723b71c1251405b72f29be2b3f5c4e3fc9 ensure shim-helpers is installed in build environment 2024-07-01T07:06:39+00:00 Fabian Grünbichler f.gruenbichler@proxmox.com 2024-07-01T07:01:53+00:00 urn:sha1:eae47c67a6f2e43f78b5bd924104fbd05682667c else the dpkg-query doesn't work. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com> Tweak versioning in runtime dependencies 2024-06-27T23:43:32+00:00 Steve McIntyre steve@einval.com 2024-06-27T23:40:46+00:00 urn:sha1:1a4394567776ee75cf32fb645b348a464a1b2121 using substvars to make things more automatic in future. Switch from debian/compat to build-dep on debhelper-compat (= 13) 2024-06-26T20:57:43+00:00 Steve McIntyre steve@einval.com 2024-06-26T20:57:09+00:00 urn:sha1:83ca439fd0c848513ddfb5243c2522edaa8b1042 New signed binaries corresponding to 15.8-1 2024-06-26T20:54:35+00:00 Steve McIntyre steve@einval.com 2024-06-26T20:44:14+00:00 urn:sha1:af6228fb12758b4d71fd5c03631aa5615c5149e5 Update build-dep on shim-unsigned to use 15.8-1. Update SBAT to revoke grub binaries with sbat < 4. Stop building for i386.