shim-signed.git/verify_combine_sigs, branch rolling VyOS code for the shim-signed package (mirror of https://github.com/vyos/shim-signed.git) https://git.amelek.net/vyos/shim-signed.git/atom?h=rolling 2026-05-14T05:38:14+00:00 Grab the sha1 fingerprint of each used cert as we match them 2026-05-14T05:38:14+00:00 Steve McIntyre steve@einval.com 2026-05-13T23:18:16+00:00 urn:sha1:51d7291fc779e9c961c942fb503ffa2d02205b3c Later, install that data alongside the shim binaries in the package. We can then use this data to check that we can boot the signed shim we're installing. Fix up cert filenames and explicitly sort them before use 2026-05-13T22:06:06+00:00 Steve McIntyre steve@einval.com 2026-05-06T22:58:34+00:00 urn:sha1:d26ca79bcb7a6e2c59f7b6f9292c28b7189d431a Add support for verifying and then combining signatures 2026-04-28T16:35:25+00:00 Steve McIntyre steve@einval.com 2026-04-28T13:01:32+00:00 urn:sha1:e2a56d673c66989136c41a6f1c997ff1aad10097 from multiple signed shims. * Move the verification logic out into a new helper script verify_combine_sigs - see comments there for how it works. * Rename the existing shim binaries and CA cert to match * Include some extra certs and binaries for testing with