From 53b4043e96469fdf2ea02e8ddb06fe9083e5ab40 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 17 Oct 2026 15:07:44 +0200 Subject: secure-boot: T861: detect all PEM private key types in MOK directory Every regular file is now scanned for any PEM private key header and the build still aborts when one is found. --- data/live-build-config/hooks/live/93-sb-sign-kernel.chroot | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) (limited to 'data') diff --git a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot index 4fe056ef..129ca8f8 100755 --- a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot +++ b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot @@ -67,10 +67,11 @@ done echo "I: Removing Secure Boot signing tooling" apt-get -y purge libengine-pkcs11-openssl yubihsm-pkcs11 libyubihsm2 opensc opensc-pkcs11 libyubihsm-http2 -for cert in $(ls /var/lib/shim-signed/mok/); do - if grep -rq "BEGIN PRIVATE KEY" /var/lib/shim-signed/mok/${cert}; then - echo "Found private key - bailing out" - exit 1 - fi -done +# Fail if any private key found in the image chroot path +KEY_FILES=$(find /var/lib/shim-signed/mok/ -type f \ + -exec grep -lE -e '-----BEGIN ([A-Z0-9]+ )*PRIVATE KEY-----' {} + 2>/dev/null) +if [ -n "${KEY_FILES}" ]; then + echo "Found private key - bailing out: ${KEY_FILES}" + exit 1 +fi -- cgit v1.2.3