diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-10-17 15:07:44 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-10-17 15:07:44 +0200 |
| commit | 53b4043e96469fdf2ea02e8ddb06fe9083e5ab40 (patch) | |
| tree | 13c2204acc20df0f9f93cd2821411e83e618fef3 /data | |
| parent | b5155b113e7b624ca2b89ec6c6c2286624714cbe (diff) | |
| download | vyos-build-53b4043e96469fdf2ea02e8ddb06fe9083e5ab40.tar.gz vyos-build-53b4043e96469fdf2ea02e8ddb06fe9083e5ab40.zip | |
secure-boot: T861: detect all PEM private key types in MOK directory
Every regular file is now scanned for any PEM private key header and the
build still aborts when one is found.
Diffstat (limited to 'data')
| -rwxr-xr-x | data/live-build-config/hooks/live/93-sb-sign-kernel.chroot | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot index 4fe056ef..129ca8f8 100755 --- a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot +++ b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot @@ -67,10 +67,11 @@ done echo "I: Removing Secure Boot signing tooling" apt-get -y purge libengine-pkcs11-openssl yubihsm-pkcs11 libyubihsm2 opensc opensc-pkcs11 libyubihsm-http2 -for cert in $(ls /var/lib/shim-signed/mok/); do - if grep -rq "BEGIN PRIVATE KEY" /var/lib/shim-signed/mok/${cert}; then - echo "Found private key - bailing out" - exit 1 - fi -done +# Fail if any private key found in the image chroot path +KEY_FILES=$(find /var/lib/shim-signed/mok/ -type f \ + -exec grep -lE -e '-----BEGIN ([A-Z0-9]+ )*PRIVATE KEY-----' {} + 2>/dev/null) +if [ -n "${KEY_FILES}" ]; then + echo "Found private key - bailing out: ${KEY_FILES}" + exit 1 +fi |