shim-signed.git/debian, branch debian/1.49VyOS code for the shim-signed package (mirror of https://github.com/vyos/shim-signed.git)
https://git.amelek.net/vyos/shim-signed.git/atom?h=debian%2F1.492026-05-19T08:43:36+00:00Make mokutil parsing more robust. Closes: #11370632026-05-19T08:43:36+00:00Steve McIntyresteve@einval.com2026-05-19T08:43:36+00:00urn:sha1:1c4e702c99a185924a847ba464cd2205796ecce2
Cope with "Platform is in Setup Mode" message
If we get any other unexpected output, print what we got for debugging.
Make sure we remove shim-signed.preinst during clean2026-05-18T13:35:25+00:00Steve McIntyresteve@einval.com2026-05-18T13:32:43+00:00urn:sha1:df6d46ce5a1bd5f7548daca14884905074383e4fUpdate changelog and release 1.482026-05-18T13:12:28+00:00Steve McIntyresteve@einval.com2026-05-18T13:12:28+00:00urn:sha1:409da09ec16bd2a28041db9608661a7f8fc7ec37Tweak the URI linked for CA updates2026-05-18T13:06:58+00:00Steve McIntyresteve@einval.com2026-05-18T13:06:58+00:00urn:sha1:0f5a44c8169294fd1362ee6d018f93a76f0d1f05Switch to using debconf to display signature errors2026-05-17T23:56:13+00:00Steve McIntyresteve@einval.com2026-05-17T23:52:29+00:00urn:sha1:04a3449adcd413433c45774ac7b150ededaa1c4eUpdate changelog2026-05-17T21:49:28+00:00Steve McIntyresteve@einval.com2026-05-17T21:46:17+00:00urn:sha1:5bf524a5960e24df055123cb491d52fe8f265c94Add more text to the failure messsage2026-05-17T21:45:41+00:00Steve McIntyresteve@einval.com2026-05-17T21:45:41+00:00urn:sha1:ca8556f025821178897986b431bf1bfdc38abb09
And link to a wiki page for more info. Need to write that page!
Move shim signature checks to preinst2026-05-17T21:40:01+00:00Steve McIntyresteve@einval.com2026-05-17T21:34:26+00:00urn:sha1:32c23f8e7c8dace4677a5393a86cb91857630ff0
It's safer to do it here before a new shim is installed.
As we don't have any files installed at this point, we can't look up
knowwn signatures from a file. Instead, we now substitute the
signature fingerprints directly into shim-signed.preinst at package
build time.
Put the postinst back to where it was before the signature checks were
added.
Tweak the boot check logic further: DBX sigs are fatal2026-05-17T21:39:45+00:00Steve McIntyresteve@einval.com2026-05-17T20:43:08+00:00urn:sha1:ccec529c3644e56a9889f013438d09a4c5d349d6
If we have a sig from a key listed in DBX, don't just ignore
it. Firmware should refuse to boot things in a revoked chain so we
should fail here too.
Tweak the output too - switch from using a boolean $SAFE value to
using an error string in $SB_BOOT_ERROR so we can have more specific
errors printed.
Update to boot check: ignore keys listed in DBX2026-05-14T15:53:15+00:00Steve McIntyresteve@einval.com2026-05-14T15:53:15+00:00urn:sha1:0140b59d00318019177364b0a56f180052394868