diff options
| author | Steve McIntyre <steve@einval.com> | 2025-07-29 18:12:19 +0100 |
|---|---|---|
| committer | Steve McIntyre <steve@einval.com> | 2025-07-29 18:41:55 +0100 |
| commit | d51bfcf945e1070a551cf8ec5d94b91b213991e1 (patch) | |
| tree | f5472ff937ddf92f16d0217e61018aad3d6cf4ef /debian | |
| parent | 644e18fd2a66209405f379fb7b8ed863b5ae2aaa (diff) | |
| download | shim-signed-debian/1.47.tar.gz shim-signed-debian/1.47.zip | |
update-secureboot-policy: do better checking around DKMSdebian/1.47
If we have DKMS modules installed:
+ Check to see if a DKMS MOK key has been created and enrolled;
+ Check that all the DKMS modules are signed with that key;
If successful, don't tell users to disable Secure Boot.
Closes: #1108278.
Add dependencies on openssl and kmod for shim-signed-common,
needed for implementing these check.
Diffstat (limited to 'debian')
| -rw-r--r-- | debian/changelog | 13 | ||||
| -rw-r--r-- | debian/control | 2 |
2 files changed, 14 insertions, 1 deletions
diff --git a/debian/changelog b/debian/changelog index 445c312..a040b2a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,16 @@ +shim-signed (1.47) unstable; urgency=medium + + * update-secureboot-policy: do better checking around DKMS + If we have DKMS modules installed: + + Check to see if a DKMS MOK key has been created and enrolled; + + Check that all the DKMS modules are signed with that key; + If successful, don't tell users to disable Secure Boot. + Closes: #1108278. + Add dependencies on openssl and kmod for shim-signed-common, + needed for implementing these check. + + -- Steve McIntyre <93sam@debian.org> Tue, 29 Jul 2025 18:40:14 +0100 + shim-signed (1.46) unstable; urgency=medium * No-change rebuild to upload source-only. Argh. :-/ diff --git a/debian/control b/debian/control index aa726e8..8357ba8 100644 --- a/debian/control +++ b/debian/control @@ -40,7 +40,7 @@ Description: Secure Boot chain-loading bootloader (Microsoft-signed binary) Package: shim-signed-common Multi-Arch: foreign Architecture: all -Depends: ${misc:Depends}, mokutil +Depends: ${misc:Depends}, mokutil, openssl, kmod Replaces: shim-signed (<< 1.32+15+1533136590.3beb971-5) Breaks: shim-signed (<< 1.32+15+1533136590.3beb971-5) Description: Secure Boot chain-loading bootloader (common helper scripts) |