summaryrefslogtreecommitdiff
path: root/debian
AgeCommit message (Collapse)Author
2026-06-01Add signed SHIM binary including the VyOS Networks CA certificateChristian Breunig
2026-05-19Fix up stupid omission in the previous package uploaddebian/1.50Steve McIntyre
the changes in 1.49 did not take into account the "SecureBoot enabled" case when adding a default error trap. Closes: #1137098, #1137101.
2026-05-19Make mokutil parsing more robust. Closes: #1137063debian/1.49Steve McIntyre
Cope with "Platform is in Setup Mode" message If we get any other unexpected output, print what we got for debugging.
2026-05-18Make sure we remove shim-signed.preinst during cleanSteve McIntyre
2026-05-18Update changelog and release 1.48debian/1.48Steve McIntyre
2026-05-18Tweak the URI linked for CA updatesSteve McIntyre
2026-05-18Switch to using debconf to display signature errorsSteve McIntyre
2026-05-17Update changelogSteve McIntyre
2026-05-17Add more text to the failure messsageSteve McIntyre
And link to a wiki page for more info. Need to write that page!
2026-05-17Move shim signature checks to preinstSteve McIntyre
It's safer to do it here before a new shim is installed. As we don't have any files installed at this point, we can't look up knowwn signatures from a file. Instead, we now substitute the signature fingerprints directly into shim-signed.preinst at package build time. Put the postinst back to where it was before the signature checks were added.
2026-05-17Tweak the boot check logic further: DBX sigs are fatalSteve McIntyre
If we have a sig from a key listed in DBX, don't just ignore it. Firmware should refuse to boot things in a revoked chain so we should fail here too. Tweak the output too - switch from using a boolean $SAFE value to using an error string in $SB_BOOT_ERROR so we can have more specific errors printed.
2026-05-14Update to boot check: ignore keys listed in DBXSteve McIntyre
2026-05-14Check that we can boot on the current systemSteve McIntyre
If SecureBoot is enabled, check that our shim binary is signed by at least one of the certificates enrolled in firmware.
2026-05-14Grab the sha1 fingerprint of each used cert as we match themSteve McIntyre
Later, install that data alongside the shim binaries in the package. We can then use this data to check that we can boot the signed shim we're installing.
2026-05-13Update lintian source overridesSteve McIntyre
2026-05-13Update build-deps for 16.1-2Steve McIntyre
2026-05-13Update changelogSteve McIntyre
2026-04-28Add support for verifying and then combining signaturesSteve McIntyre
from multiple signed shims. * Move the verification logic out into a new helper script verify_combine_sigs - see comments there for how it works. * Rename the existing shim binaries and CA cert to match * Include some extra certs and binaries for testing with
2025-07-29update-secureboot-policy: do better checking around DKMSdebian/1.47Steve McIntyre
If we have DKMS modules installed: + Check to see if a DKMS MOK key has been created and enrolled; + Check that all the DKMS modules are signed with that key; If successful, don't tell users to disable Secure Boot. Closes: #1108278. Add dependencies on openssl and kmod for shim-signed-common, needed for implementing these check.
2025-06-23No-change rebuild to upload source-only.debian/1.46Steve McIntyre
2025-06-22Release 1.45debian/1.45Steve McIntyre
Add changelog entries for merged changes
2025-06-22Merge branch 'update-translation-ca' into 'master'Steve McIntyre
Update/add Catalan po-debconf translation See merge request efi-team/shim-signed!4
2025-05-26Add alternative dependencies on systemd-bootLuca Boccassi
2025-04-23Added po-debconf Catalan translationCarles Pina i Estany
2024-07-03Release 1.44debian/1.44Steve McIntyre
With helpful fixes from Fabian Grünbichler
2024-07-01d/rules: import architecture.mk earlierFabian Grünbichler
else DEB_HOST_ARCH is not potentially not yet set and some invocations might print a spurious warning. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2024-07-01ensure shim-helpers is installed in build environmentFabian Grünbichler
else the dpkg-query doesn't work. Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
2024-06-29Fix broken usage of dpkg-querydebian/1.43Steve McIntyre
2024-06-28Tweak versioning in runtime dependenciesdebian/1.42Steve McIntyre
using substvars to make things more automatic in future.
2024-06-26Release shim-signed 1.41 for siddebian/1.41Steve McIntyre
2024-06-26Remove obsolete override for shimia32.efi.signedSteve McIntyre
2024-06-26Switch from debian/compat to build-dep on debhelper-compat (= 13)Steve McIntyre
2024-06-26New signed binaries corresponding to 15.8-1Steve McIntyre
Update build-dep on shim-unsigned to use 15.8-1. Update SBAT to revoke grub binaries with sbat < 4. Stop building for i386.
2023-08-04Add Romanian translation for debconf templatesdebian/1.40Steve McIntyre
thanks to Remus-Gabriel Chelu. Closes: #1039090
2023-08-04Stop recommending secureboot-db, we don't have that packageSteve McIntyre
Closes: #1042964, #1041449, #932358
2023-03-09Tweak dependencies between packagesdebian/1.39Steve McIntyre
2023-03-08Add some Closes:, let's kill some bugs! :-)Steve McIntyre
2023-03-08Add pt_BR translation, thanks to Paulo Henrique de Lima SantanaSteve McIntyre
Closes: #1026415
2023-02-23postinst/postrm: make config_item() more robustSteve McIntyre
2023-02-18Update Depends on grub2-commonSteve McIntyre
2023-02-18Tweak changelogSteve McIntyre
2023-02-18Remove the NEWS file, now we have working arm64 shim-signedSteve McIntyre
2023-02-17Fix up lintian overridesSteve McIntyre
2023-02-17New signed binaries corresponding to 15.7-1Steve McIntyre
We now have arm64 signed shims again \o/ Closes: #1008942, #992073 Pulls multiple other bugfixes in for the signed version: Make sbat_var.S parse right with buggy gcc/binutils Enable NX support at build time, as required by policy for signing new shim binaries. Update build-dep on shim-unsigned to use 15.7-1 Block Debian grub binaries with sbat < 4 (see #1024617)
2021-07-12Update build-dep on shim-unsigned to use 15.4-7debian/1.38Steve McIntyre
2021-07-12Tweak how we call grub-install; don't abort on errorSteve McIntyre
Not ideal behaviour either, but don't break upgrades. Copy the behaviour from the grub packages here. Closes: #990984
2021-06-29New signed binaries based on shim 15.4-6debian/1.37Steve McIntyre
Pulls multiple bugfixes in for the signed version: * Add arm64 patch to tweak section layout and stop crashing problems. Upstream issue #371. (#990082, #990190) * In insecure mode, don't abort if we can't create the MokListXRT variable. Upstream issue #372. (#989962, #990158) Update build-dep on shim-unsigned to use 15.4-6~deb10u1
2021-05-09Fix duplicated word in the NEWS fileSteve McIntyre
2021-05-06Update build-dep on shim-unsigned to use 15.4-5debian/1.36Steve McIntyre
2021-05-06Add defensive code around calls to db_getSteve McIntyre
Don't fail if they return errors. Closes: #988114
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-15 09:14:46 +0000