diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-10-29 21:20:06 +0100 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-10-29 21:20:06 +0100 |
| commit | f54ae33e49ef3e283906df692ce242367799982f (patch) | |
| tree | f1c20d60e57bfcf38e2b69d070d1b789edc0a287 /python/setup.py | |
| parent | 94fe76e8c74ea08264d3cbf7100fc3579dbf6340 (diff) | |
| download | vyos-1x-f54ae33e49ef3e283906df692ce242367799982f.tar.gz vyos-1x-f54ae33e49ef3e283906df692ce242367799982f.zip | |
op-mode: T9496: verify secure-boot signature when using "add system image"
On a system running with Secure Boot enabled, "add system image" installed
the Linux Kernel of the new image without checking its signature. A Kernel
not signed by an enrolled Machine Owner Key is rejected by shim, so the new
image failed to boot.
The Kernel of the new image is now verified against the enrolled MOK keys
before anything is copied. If verification fails, the installation is
aborted. The existing --force option overrides the check.
Diffstat (limited to 'python/setup.py')
0 files changed, 0 insertions, 0 deletions