T861: Finalize VyOS kernel signing for UEFI Secure Boot

3 files changed, 54 insertions, 3 deletions

diff --git a/data/live-build-config/archives/bookworm-backports.pref.chroot b/data/live-build-config/archives/bookworm-backports.pref.chroot
index f48ff10f..f007d178 100644
--- a/data/live-build-config/archives/bookworm-backports.pref.chroot
+++ b/data/live-build-config/archives/bookworm-backports.pref.chroot
@@ -6,6 +6,10 @@ Package: zabbix-agent2
 Pin: release n=bookworm-backports
 Pin-Priority: 600
 
+Package: yubihsm-pkcs11 libyubihsm2 libyubihsm-http2
+Pin: release n=bookworm-backports
+Pin-Priority: 600
+
 Package: *
 Pin: release n=bookworm-backports
 Pin-Priority: -100
diff --git a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
index 8494a5c8..16684d74 100755
--- a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
+++ b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
@@ -2,8 +2,20 @@
 SIGN_FILE=$(find /usr/lib -name sign-file)
 KERNEL_KEY="/var/lib/shim-signed/mok/vyos-dev-2025-linux.key"
 KERNEL_CERT="/var/lib/shim-signed/mok/vyos-dev-2025-linux.pem"
+SB_KERNEL_CERT="/var/lib/shim-signed/mok/vyos-prod-2025-linux.pem"
+SB_OPENSSL_CONF="/etc/ssl/yubihsm-openssl.cnf"
+SB_PKCS11_CONF="/etc/yubihsm_pkcs11.conf"
+PKCS11_KEY_OBJECT="vyos-sb-signer-2025"
 VMLINUZ=$(readlink /boot/vmlinuz)
 
+# Abort HSM signing: drop the partially signed Kernel and the HSM configuration
+hsm_sign_failed() {
+    echo "E: $1"
+    rm -f /boot/${VMLINUZ}.tmp
+    rm -f ${SB_PKCS11_CONF} ${SB_OPENSSL_CONF}
+    exit 1
+}
+
 # All Linux Kernel modules need to be cryptographically signed
 find /lib/modules -type f -name \*.ko | while read MODULE; do
     modinfo ${MODULE} | grep -q "signer:"
@@ -13,15 +25,46 @@ find /lib/modules -type f -name \*.ko | while read MODULE; do
     fi
 done
 
-if [ ! -f ${KERNEL_KEY} ] && [ ! -f ${KERNEL_CERT} ]; then
-    echo "I: Signing key for Linux Kernel not found - Secure Boot not possible"
-else
+if [ -f ${SB_KERNEL_CERT} ] && [ -f ${SB_OPENSSL_CONF} ]; then
+    echo "I: Signing Linux Kernel for Secure Boot using the HSM"
+
+    export OPENSSL_CONF="${SB_OPENSSL_CONF}"
+    export YUBIHSM_PKCS11_CONF="${SB_PKCS11_CONF}"
+
+    sbsign --engine pkcs11 \
+        --key "pkcs11:object=${PKCS11_KEY_OBJECT};type=private" \
+        --cert ${SB_KERNEL_CERT} \
+        /boot/${VMLINUZ} --output /boot/${VMLINUZ}.tmp
+    if [ $? -ne 0 ]; then
+        hsm_sign_failed "Signing of Linux Kernel failed"
+    fi
+
+    sbverify --cert ${SB_KERNEL_CERT} /boot/${VMLINUZ}.tmp
+    if [ $? -ne 0 ]; then
+        hsm_sign_failed "Signature verification failed - keeping the unsigned Linux Kernel"
+    fi
+
+    mv /boot/${VMLINUZ}.tmp /boot/${VMLINUZ}
+    echo "I: Linux Kernel signed and signature verified"
+elif [ -f ${KERNEL_KEY} ] && [ -f ${KERNEL_CERT} ]; then
     echo "I: Signing Linux Kernel for Secure Boot"
     sbsign --key ${KERNEL_KEY} --cert ${KERNEL_CERT} /boot/${VMLINUZ} --output /boot/${VMLINUZ}
     sbverify --list /boot/${VMLINUZ}
     rm -f ${KERNEL_KEY}
+else
+    echo "I: Signing key for Linux Kernel not found - Secure Boot not possible"
 fi
 
+for conf in ${SB_PKCS11_CONF} ${SB_OPENSSL_CONF}; do
+    if [ -f ${conf} ]; then
+        echo "I: Removing ${conf}"
+        rm -f ${conf}
+    fi
+done
+
+echo "I: Removing Secure Boot signing tooling"
+apt-get -y purge libengine-pkcs11-openssl yubihsm-pkcs11 libyubihsm2 opensc opensc-pkcs11 libyubihsm-http2
+
 for cert in $(ls /var/lib/shim-signed/mok/); do
     if grep -rq "BEGIN PRIVATE KEY" /var/lib/shim-signed/mok/${cert}; then
         echo "Found private key - bailing out"
diff --git a/data/live-build-config/package-lists/vyos-secureboot.list.chroot b/data/live-build-config/package-lists/vyos-secureboot.list.chroot
new file mode 100644
index 00000000..80db5009
--- /dev/null
+++ b/data/live-build-config/package-lists/vyos-secureboot.list.chroot
@@ -0,0 +1,4 @@
+sbsigntool
+libengine-pkcs11-openssl
+yubihsm-pkcs11
+opensc