summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-05-19Make mokutil parsing more robust. Closes: #1137063debian/1.49Steve McIntyre
Cope with "Platform is in Setup Mode" message If we get any other unexpected output, print what we got for debugging.
2026-05-18Make sure we remove shim-signed.preinst during cleanSteve McIntyre
2026-05-18Update changelog and release 1.48debian/1.48Steve McIntyre
2026-05-18Tweak the URI linked for CA updatesSteve McIntyre
2026-05-18Switch to using debconf to display signature errorsSteve McIntyre
2026-05-18.gitignore: ignore the generated preinst fileSteve McIntyre
2026-05-17Update changelogSteve McIntyre
2026-05-17Add more text to the failure messsageSteve McIntyre
And link to a wiki page for more info. Need to write that page!
2026-05-17Move shim signature checks to preinstSteve McIntyre
It's safer to do it here before a new shim is installed. As we don't have any files installed at this point, we can't look up knowwn signatures from a file. Instead, we now substitute the signature fingerprints directly into shim-signed.preinst at package build time. Put the postinst back to where it was before the signature checks were added.
2026-05-17Tweak the boot check logic further: DBX sigs are fatalSteve McIntyre
If we have a sig from a key listed in DBX, don't just ignore it. Firmware should refuse to boot things in a revoked chain so we should fail here too. Tweak the output too - switch from using a boolean $SAFE value to using an error string in $SB_BOOT_ERROR so we can have more specific errors printed.
2026-05-14Update to boot check: ignore keys listed in DBXSteve McIntyre
2026-05-14Check that we can boot on the current systemSteve McIntyre
If SecureBoot is enabled, check that our shim binary is signed by at least one of the certificates enrolled in firmware.
2026-05-14Grab the sha1 fingerprint of each used cert as we match themSteve McIntyre
Later, install that data alongside the shim binaries in the package. We can then use this data to check that we can boot the signed shim we're installing.
2026-05-14Makefile: add clean ruleSteve McIntyre
2026-05-13Update lintian source overridesSteve McIntyre
2026-05-13Update build-deps for 16.1-2Steve McIntyre
2026-05-13Add the new 16.1-2 binaries signed by MicrosoftSteve McIntyre
2026-05-13Update changelogSteve McIntyre
2026-05-13Fix up cert filenames and explicitly sort them before useSteve McIntyre
2026-05-06Add the "new" Microsoft 2023 UEFI CA keySteve McIntyre
Found at https://github.com/microsoft/secureboot_objects/blob/main/PreSignedObjects/DB/Certificates/microsoft%20uefi%20ca%202023.der and copied here in PEM format, ready to use.
2026-05-06Shuffle test certificatesSteve McIntyre
2026-04-28Add support for verifying and then combining signaturesSteve McIntyre
from multiple signed shims. * Move the verification logic out into a new helper script verify_combine_sigs - see comments there for how it works. * Rename the existing shim binaries and CA cert to match * Include some extra certs and binaries for testing with
2025-07-29update-secureboot-policy: do better checking around DKMSdebian/1.47Steve McIntyre
If we have DKMS modules installed: + Check to see if a DKMS MOK key has been created and enrolled; + Check that all the DKMS modules are signed with that key; If successful, don't tell users to disable Secure Boot. Closes: #1108278. Add dependencies on openssl and kmod for shim-signed-common, needed for implementing these check.
2025-06-23No-change rebuild to upload source-only.debian/1.46Steve McIntyre
2025-06-22Release 1.45debian/1.45Steve McIntyre
Add changelog entries for merged changes
2025-06-22Merge branch 'update-translation-ca' into 'master'Steve McIntyre
Update/add Catalan po-debconf translation See merge request efi-team/shim-signed!4
2025-05-26Merge branch 'sdboot' into 'master'Steve McIntyre
Add alternative dependencies on systemd-boot See merge request efi-team/shim-signed!3
2025-05-26Add alternative dependencies on systemd-bootLuca Boccassi
2025-04-23Added po-debconf Catalan translationCarles Pina i Estany
2024-07-03Release 1.44debian/1.44Steve McIntyre
With helpful fixes from Fabian Grünbichler
2024-07-03Merge branch 'fix-build' into 'master'Steve McIntyre
fix shim-helpers substvar handling See merge request efi-team/shim-signed!2
2024-07-01d/rules: import architecture.mk earlierFabian Grünbichler
else DEB_HOST_ARCH is not potentially not yet set and some invocations might print a spurious warning. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2024-07-01ensure shim-helpers is installed in build environmentFabian Grünbichler
else the dpkg-query doesn't work. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2024-06-29Fix broken usage of dpkg-querydebian/1.43Steve McIntyre
2024-06-28Tweak versioning in runtime dependenciesdebian/1.42Steve McIntyre
using substvars to make things more automatic in future.
2024-06-26Release shim-signed 1.41 for siddebian/1.41Steve McIntyre
2024-06-26Remove obsolete override for shimia32.efi.signedSteve McIntyre
2024-06-26Switch from debian/compat to build-dep on debhelper-compat (= 13)Steve McIntyre
2024-06-26New signed binaries corresponding to 15.8-1Steve McIntyre
Update build-dep on shim-unsigned to use 15.8-1. Update SBAT to revoke grub binaries with sbat < 4. Stop building for i386.
2023-08-04Add Romanian translation for debconf templatesdebian/1.40Steve McIntyre
thanks to Remus-Gabriel Chelu. Closes: #1039090
2023-08-04Stop recommending secureboot-db, we don't have that packageSteve McIntyre
Closes: #1042964, #1041449, #932358
2023-03-09Tweak dependencies between packagesdebian/1.39Steve McIntyre
2023-03-08Add some Closes:, let's kill some bugs! :-)Steve McIntyre
2023-03-08Add pt_BR translation, thanks to Paulo Henrique de Lima SantanaSteve McIntyre
Closes: #1026415
2023-02-23postinst/postrm: make config_item() more robustSteve McIntyre
2023-02-18Update Depends on grub2-commonSteve McIntyre
2023-02-18Tweak changelogSteve McIntyre
2023-02-18Verify on all arches nowSteve McIntyre
2023-02-18Remove the NEWS file, now we have working arm64 shim-signedSteve McIntyre
2023-02-17Fix up lintian overridesSteve McIntyre
generated by cgit v1.2.3 (git 2.39.1) at 2026-08-30 02:03:30 +0000