shim-signed.git/debian/shim-signed.postinst, branch rolling VyOS code for the shim-signed package (mirror of https://github.com/vyos/shim-signed.git) https://git.amelek.net/vyos/shim-signed.git/atom?h=rolling 2026-05-17T21:40:01+00:00 Move shim signature checks to preinst 2026-05-17T21:40:01+00:00 Steve McIntyre steve@einval.com 2026-05-17T21:34:26+00:00 urn:sha1:32c23f8e7c8dace4677a5393a86cb91857630ff0 It's safer to do it here before a new shim is installed. As we don't have any files installed at this point, we can't look up knowwn signatures from a file. Instead, we now substitute the signature fingerprints directly into shim-signed.preinst at package build time. Put the postinst back to where it was before the signature checks were added. Tweak the boot check logic further: DBX sigs are fatal 2026-05-17T21:39:45+00:00 Steve McIntyre steve@einval.com 2026-05-17T20:43:08+00:00 urn:sha1:ccec529c3644e56a9889f013438d09a4c5d349d6 If we have a sig from a key listed in DBX, don't just ignore it. Firmware should refuse to boot things in a revoked chain so we should fail here too. Tweak the output too - switch from using a boolean $SAFE value to using an error string in $SB_BOOT_ERROR so we can have more specific errors printed. Update to boot check: ignore keys listed in DBX 2026-05-14T15:53:15+00:00 Steve McIntyre steve@einval.com 2026-05-14T15:53:15+00:00 urn:sha1:0140b59d00318019177364b0a56f180052394868 Check that we can boot on the current system 2026-05-14T15:33:23+00:00 Steve McIntyre steve@einval.com 2026-05-14T15:33:23+00:00 urn:sha1:be5e1a1dd8e69d54bd52ff55f801028af6b83767 If SecureBoot is enabled, check that our shim binary is signed by at least one of the certificates enrolled in firmware. postinst/postrm: make config_item() more robust 2023-02-23T22:50:36+00:00 Steve McIntyre steve@einval.com 2023-02-23T22:43:04+00:00 urn:sha1:3d8d2c2219f82999e4c2f918f3ead16750ce4445 Tweak how we call grub-install; don't abort on error 2021-07-12T11:48:44+00:00 Steve McIntyre steve@einval.com 2021-07-12T11:48:44+00:00 urn:sha1:da0843e7d444c7c2c3d939d39b1a921a3092b2d5 Not ideal behaviour either, but don't break upgrades. Copy the behaviour from the grub packages here. Closes: #990984 Add defensive code around calls to db_get 2021-05-05T23:52:51+00:00 Steve McIntyre steve@einval.com 2021-05-05T23:52:51+00:00 urn:sha1:73769cac915948b2bbe46ffe5edc318fcd8ed8f1 Don't fail if they return errors. Closes: #988114 Fix the old doc links for shim-signed. Closes: #988057 2021-05-04T17:47:13+00:00 Steve McIntyre steve@einval.com 2021-05-04T16:38:45+00:00 urn:sha1:70da2cb6c9014606000d805015eda2c3cd24d1ef If we're not running on an EFI system then exit cleanly 2021-05-04T16:37:50+00:00 Steve McIntyre steve@einval.com 2021-05-04T16:37:50+00:00 urn:sha1:52ef752276b5d62613ecbfcfb97c3f3ee2f84220 in postinst and postrm. We have nothing to do here. Closes: #988059 Only run grub-install if we're actually running on an EFI system 2021-05-03T15:03:14+00:00 Steve McIntyre steve@einval.com 2021-05-03T14:54:46+00:00 urn:sha1:5f3cdb4f68753cb44cec980b862320f6a0397e2a Try to avoid errors if people are doing weird things