shim-signed.git/debian, branch debian/1.48VyOS code for the shim-signed package (mirror of https://github.com/vyos/shim-signed.git)
https://git.amelek.net/vyos/shim-signed.git/atom?h=debian%2F1.482026-05-18T13:12:28+00:00Update changelog and release 1.482026-05-18T13:12:28+00:00Steve McIntyresteve@einval.com2026-05-18T13:12:28+00:00urn:sha1:409da09ec16bd2a28041db9608661a7f8fc7ec37Tweak the URI linked for CA updates2026-05-18T13:06:58+00:00Steve McIntyresteve@einval.com2026-05-18T13:06:58+00:00urn:sha1:0f5a44c8169294fd1362ee6d018f93a76f0d1f05Switch to using debconf to display signature errors2026-05-17T23:56:13+00:00Steve McIntyresteve@einval.com2026-05-17T23:52:29+00:00urn:sha1:04a3449adcd413433c45774ac7b150ededaa1c4eUpdate changelog2026-05-17T21:49:28+00:00Steve McIntyresteve@einval.com2026-05-17T21:46:17+00:00urn:sha1:5bf524a5960e24df055123cb491d52fe8f265c94Add more text to the failure messsage2026-05-17T21:45:41+00:00Steve McIntyresteve@einval.com2026-05-17T21:45:41+00:00urn:sha1:ca8556f025821178897986b431bf1bfdc38abb09
And link to a wiki page for more info. Need to write that page!
Move shim signature checks to preinst2026-05-17T21:40:01+00:00Steve McIntyresteve@einval.com2026-05-17T21:34:26+00:00urn:sha1:32c23f8e7c8dace4677a5393a86cb91857630ff0
It's safer to do it here before a new shim is installed.
As we don't have any files installed at this point, we can't look up
knowwn signatures from a file. Instead, we now substitute the
signature fingerprints directly into shim-signed.preinst at package
build time.
Put the postinst back to where it was before the signature checks were
added.
Tweak the boot check logic further: DBX sigs are fatal2026-05-17T21:39:45+00:00Steve McIntyresteve@einval.com2026-05-17T20:43:08+00:00urn:sha1:ccec529c3644e56a9889f013438d09a4c5d349d6
If we have a sig from a key listed in DBX, don't just ignore
it. Firmware should refuse to boot things in a revoked chain so we
should fail here too.
Tweak the output too - switch from using a boolean $SAFE value to
using an error string in $SB_BOOT_ERROR so we can have more specific
errors printed.
Update to boot check: ignore keys listed in DBX2026-05-14T15:53:15+00:00Steve McIntyresteve@einval.com2026-05-14T15:53:15+00:00urn:sha1:0140b59d00318019177364b0a56f180052394868Check that we can boot on the current system2026-05-14T15:33:23+00:00Steve McIntyresteve@einval.com2026-05-14T15:33:23+00:00urn:sha1:be5e1a1dd8e69d54bd52ff55f801028af6b83767
If SecureBoot is enabled, check that our shim binary is signed by at
least one of the certificates enrolled in firmware.
Grab the sha1 fingerprint of each used cert as we match them2026-05-14T05:38:14+00:00Steve McIntyresteve@einval.com2026-05-13T23:18:16+00:00urn:sha1:51d7291fc779e9c961c942fb503ffa2d02205b3c
Later, install that data alongside the shim binaries in the package.
We can then use this data to check that we can boot the signed shim
we're installing.