Move shim signature checks to preinst

It's safer to do it here before a new shim is installed.

As we don't have any files installed at this point, we can't look up
knowwn signatures from a file. Instead, we now substitute the
signature fingerprints directly into shim-signed.preinst at package
build time.

Put the postinst back to where it was before the signature checks were
added.

6 files changed, 112 insertions, 88 deletions

diff --git a/debian/generate_preinst b/debian/generate_preinst
new file mode 100755
index 0000000..eef722b
--- /dev/null
+++ b/debian/generate_preinst
@@ -0,0 +1,11 @@
+#!/bin/sh
+#
+# Embed the signatures for the shim binary in preinst, so we have them
+# before any files are installed.
+
+KNOWN_SIGS=""
+for entry in $(cat build/*-signatures); do
+    KNOWN_SIGS="$KNOWN_SIGS $entry"
+done
+
+sed "s,@@SHIM_SIGNATURES@@,${KNOWN_SIGS}," debian/shim-signed.preinst.in > debian/shim-signed.preinst
diff --git a/debian/rules b/debian/rules
index d5c87e6..6649988 100755
--- a/debian/rules
+++ b/debian/rules
@@ -30,6 +30,8 @@ ifeq ($(VENDOR),Debian)
 	# Remove apport files from Debian builds, they're not useful
 	find debian/shim-signed-common -name '*apport*' | xargs rm -rvf
 endif
+	# Generate preinst from preinst.in
+	debian/generate_preinst
 	dh_installdeb
 
 override_dh_gencontrol:
diff --git a/debian/shim-signed.install b/debian/shim-signed.install
index b4a9565..d2a8083 100644
--- a/debian/shim-signed.install
+++ b/debian/shim-signed.install
@@ -1 +1 @@
-build/shim*.efi.signed* /usr/lib/shim
+build/shim*.efi.signed /usr/lib/shim
diff --git a/debian/shim-signed.postinst b/debian/shim-signed.postinst
index 488a1a7..d459f3a 100755
--- a/debian/shim-signed.postinst
+++ b/debian/shim-signed.postinst
@@ -14,7 +14,7 @@ fi
 # Select the right target architecture for grub-install
 ARCH=$(dpkg --print-architecture)
 case ${ARCH} in
-    amd64)
+    i386|amd64)
 	FW_SIZE=$(cat /sys/firmware/efi/fw_platform_size)
 	if [ "$FW_SIZE"x = "32"x ]; then
 	    GRUB_EFI_TARGET="i386-efi"
@@ -24,23 +24,9 @@ case ${ARCH} in
 	    echo "Unable to read a valid value from fw_platform_size, ABORT"
 	    exit 1
 	fi
-	EFI_ARCH="x64"
-	;;
-    i386)
-	FW_SIZE=$(cat /sys/firmware/efi/fw_platform_size)
-	if [ "$FW_SIZE"x = "32"x ]; then
-	    GRUB_EFI_TARGET="i386-efi"
-	elif [ "$FW_SIZE"x = "64"x ]; then
-	    GRUB_EFI_TARGET="x86_64-efi"
-	else
-	    echo "Unable to read a valid value from fw_platform_size, ABORT"
-	    exit 1
-	fi
-	EFI_ARCH="ia32"
 	;;
     arm64)
 	GRUB_EFI_TARGET="arm64-efi"
-	EFI_ARCH="aa64"
 	;;
     *)
 	echo "Unsupported dpkg architecture ${ARCH} in $0. ABORT"
@@ -48,13 +34,6 @@ case ${ARCH} in
 	;;
 esac
 
-SHIM="/usr/lib/shim/shim${EFI_ARCH}.efi.signed"
-if [ ! -f "$SHIM" ]; then
-    echo "No signed shim ($SHIM) included for arch $ARCH. Exit."
-    exit 0
-fi
-SHIM_SIGS="/usr/lib/shim/shim${EFI_ARCH}.efi.signed-signatures"
-
 # Pull out a config value from /etc/default/grub
 config_item ()
 {
@@ -88,64 +67,6 @@ case $1 in
 	    kubuntu) bootloader_id=ubuntu ;;
 	esac
 
-	# Set the default error message
-	SB_BOOT_ERROR="Secure Boot is enabled and we don't have a valid signature on $SHIM"
-
-	echo "shim-signed: checking if we can safely install $SHIM"
-
-	if ! type mokutil > /dev/null 2>&1; then
-	    echo "  Mokutil is not installed, assuming things will be OK."
-	    SB_BOOT_ERROR=""
-	else
-	    # Check that we can safely boot this shim.
-	    SB_STATE=$(mokutil --sb-state 2>&1 || true)
-	    # If SB is not enabled (etc.) then this shim is fine
-	    case $SB_STATE in
-		"SecureBoot disabled"|"This system doesn't support Secure Boot")
-		    echo "  $SB_STATE; shim installation is safe."
-		    SB_BOOT_ERROR=""
-		    ;;
-		"EFI variables are not supported on this system")
-		    echo "  $SB_STATE; assuming shim installation is safe."
-		    SB_BOOT_ERROR=""
-		    ;;
-	    esac
-	fi
-
-	if [ "$SB_BOOT_ERROR"x != ""x ]; then
-	    echo "Checking shim signatures on $SHIM:"
-
-	    # Secure Boot is enabled - we need to check that our shim
-	    # is signed by a key in the DB list.
-
-	    # Check against all the keys in the DB list
-	    for dbkey in $(mokutil --db | awk '/^SHA1 Fingerprint:/ {print $3}'); do
-		if grep -q "$dbkey" $SHIM_SIGS; then
-		    echo "- signed by DB key $dbkey, should boot OK"
-		    SB_BOOT_ERROR=""
-		fi
-	    done
-
-	    # Also check against the blacklisted keys in DBX - any
-	    # blacklisted sig will block boot of a shim signed with
-	    # that sig.
-	    for dbxkey in $(mokutil --dbx | awk '/^SHA1 Fingerprint:/ {print $3}'); do
-		if grep -q "$dbxkey" $SHIM_SIGS; then
-		    echo "- signed by DBX key $dbxkey, will be blocked from booting"
-		    echo "SecureBoot is enabled and $SHIM is blocked due to revocation of $dbxkey,"
-		fi
-	    done
-	fi
-
-	if [ "$SB_BOOT_ERROR"x != ""x ]; then
-	    # SB is enabled but we can't boot this shim
-	    echo "***********************************************************"
-	    echo "$SB_BOOT_ERROR"
-	    echo "ABORT - this system will not boot with this shim installed."
-	    echo "***********************************************************"
-	    exit 1
-	fi
-
 	# Call grub-install to make sure we're added to the ESP as
 	# needed
 	if [ "$bootloader_id" ] && \
diff --git a/debian/shim-signed.preinst b/debian/shim-signed.preinst
deleted file mode 100644
index 68cb8a4..0000000
--- a/debian/shim-signed.preinst
+++ /dev/null
@@ -1,7 +0,0 @@
-#! /bin/sh
-
-set -e
-
-#DEBHELPER#
-
-exit 0
diff --git a/debian/shim-signed.preinst.in b/debian/shim-signed.preinst.in
new file mode 100644
index 0000000..32c8a09
--- /dev/null
+++ b/debian/shim-signed.preinst.in
@@ -0,0 +1,97 @@
+#! /bin/sh
+
+set -e
+
+# Select the right target architecture for grub-install
+ARCH=$(dpkg --print-architecture)
+case ${ARCH} in
+    amd64)
+	EFI_ARCH="x64";;
+    i386)
+	EFI_ARCH="ia32";;
+    arm64)
+	EFI_ARCH="aa64";;
+    *)
+	echo "Unsupported dpkg architecture ${ARCH} in $0. ABORT"
+	exit 1
+	;;
+esac
+
+SHIM="/usr/lib/shim/shim${EFI_ARCH}.efi.signed"
+if [ ! -f "$SHIM" ]; then
+    echo "No signed shim ($SHIM) included for arch $ARCH. Exit."
+    exit 0
+fi
+SHIM_SIGS="@@SHIM_SIGNATURES@@"
+
+# Set the default error message
+SB_BOOT_ERROR="Secure Boot is enabled and we don't have a valid signature on $SHIM"
+
+case "$1" in
+    install|upgrade)
+
+	echo "shim-signed: checking if we can safely install $SHIM"
+
+	if ! type mokutil > /dev/null 2>&1; then
+	    echo "  Mokutil is not installed, assuming things will be OK."
+	    SB_BOOT_ERROR=""
+	else
+	    # Check that we can safely boot this shim.
+	    SB_STATE=$(mokutil --sb-state 2>&1 || true)
+	    # If SB is not enabled (etc.) then this shim is fine
+	    case $SB_STATE in
+		"SecureBoot disabled"|"This system doesn't support Secure Boot")
+		    echo "  $SB_STATE; shim installation is safe."
+		    SB_BOOT_ERROR=""
+		    ;;
+		"EFI variables are not supported on this system")
+		    echo "  $SB_STATE; assuming shim installation is safe."
+		    SB_BOOT_ERROR=""
+		    ;;
+	    esac
+	fi
+
+	if [ "$SB_BOOT_ERROR"x != ""x ]; then
+	    echo "Checking shim signatures on $SHIM:"
+
+	    # Secure Boot is enabled - we need to check that our shim
+	    # is signed by a key in the DB list.
+
+	    # Check against all the keys in the DB list
+	    for dbkey in $(mokutil --db | awk '/^SHA1 Fingerprint:/ {print $3}'); do
+		for sig in ${SHIM_SIGS}; do
+		    if [ "$dbkey" = "$sig" ]; then
+			echo "- signed by DB key $dbkey, should boot OK"
+			SB_BOOT_ERROR=""
+		    fi
+		done
+	    done
+
+	    # Also check against the blacklisted keys in DBX - any
+	    # blacklisted sig will block boot of a shim signed with
+	    # that sig.
+	    for dbxkey in $(mokutil --dbx | awk '/^SHA1 Fingerprint:/ {print $3}'); do
+		for sig in ${SHIM_SIGS}; do
+		    if [ "$dbxkey" = "$sig" ]; then
+			echo "- signed by DBX key $dbxkey, will be blocked from booting"
+			echo "SecureBoot is enabled and $SHIM is blocked due to revocation of $dbxkey,"
+		    fi
+		done
+	    done
+	fi
+
+	if [ "$SB_BOOT_ERROR"x != ""x ]; then
+	    # SB is enabled but we can't boot this shim
+	    echo "***********************************************************"
+	    echo "$SB_BOOT_ERROR"
+	    echo "ABORT - this system will not boot with this shim installed."
+	    echo "***********************************************************"
+	    exit 1
+	fi
+
+	;;
+esac
+
+#DEBHELPER#
+
+exit 0