From b5155b113e7b624ca2b89ec6c6c2286624714cbe Mon Sep 17 00:00:00 2001
From: Christian Breunig <christian@breunig.cc>
Date: Sat, 17 Oct 2026 14:55:13 +0200
Subject: Testsuite: T861: enroll dev shim certificate using mokutil

The install mok CLI command is gone, so the Secure Boot test now imports
the development shim root certificate shipped in the image with plain
mokutil.

The development certificate names follow the current year instead of a
hardcoded one. The production certificate is left untouched.
---
 data/live-build-config/hooks/live/93-sb-sign-kernel.chroot | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'data')

diff --git a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
index 16684d74..4fe056ef 100755
--- a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
+++ b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
@@ -1,7 +1,9 @@
 #!/bin/sh
+
 SIGN_FILE=$(find /usr/lib -name sign-file)
-KERNEL_KEY="/var/lib/shim-signed/mok/vyos-dev-2025-linux.key"
-KERNEL_CERT="/var/lib/shim-signed/mok/vyos-dev-2025-linux.pem"
+CA_YEAR="$(date +%Y)"
+KERNEL_KEY="/var/lib/shim-signed/mok/vyos-dev-${CA_YEAR}-linux.key"
+KERNEL_CERT="/var/lib/shim-signed/mok/vyos-dev-${CA_YEAR}-linux.pem"
 SB_KERNEL_CERT="/var/lib/shim-signed/mok/vyos-prod-2025-linux.pem"
 SB_OPENSSL_CONF="/etc/ssl/yubihsm-openssl.cnf"
 SB_PKCS11_CONF="/etc/yubihsm_pkcs11.conf"
-- 
cgit v1.2.3


From 53b4043e96469fdf2ea02e8ddb06fe9083e5ab40 Mon Sep 17 00:00:00 2001
From: Christian Breunig <christian@breunig.cc>
Date: Sat, 17 Oct 2026 15:07:44 +0200
Subject: secure-boot: T861: detect all PEM private key types in MOK directory

Every regular file is now scanned for any PEM private key header and the
build still aborts when one is found.
---
 data/live-build-config/hooks/live/93-sb-sign-kernel.chroot | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

(limited to 'data')

diff --git a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
index 4fe056ef..129ca8f8 100755
--- a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
+++ b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
@@ -67,10 +67,11 @@ done
 echo "I: Removing Secure Boot signing tooling"
 apt-get -y purge libengine-pkcs11-openssl yubihsm-pkcs11 libyubihsm2 opensc opensc-pkcs11 libyubihsm-http2
 
-for cert in $(ls /var/lib/shim-signed/mok/); do
-    if grep -rq "BEGIN PRIVATE KEY" /var/lib/shim-signed/mok/${cert}; then
-        echo "Found private key - bailing out"
-        exit 1
-    fi
-done
+# Fail if any private key found in the image chroot path
+KEY_FILES=$(find /var/lib/shim-signed/mok/ -type f \
+    -exec grep -lE -e '-----BEGIN ([A-Z0-9]+ )*PRIVATE KEY-----' {} + 2>/dev/null)
+if [ -n "${KEY_FILES}" ]; then
+    echo "Found private key - bailing out: ${KEY_FILES}"
+    exit 1
+fi
 
-- 
cgit v1.2.3


From e55dff911c837796ef9d0161ecd3c96dcd85333a Mon Sep 17 00:00:00 2001
From: Christian Breunig <christian@breunig.cc>
Date: Sat, 17 Oct 2026 15:12:37 +0200
Subject: secure-boot: T861: verify dev Kernel signature before replacing the
 image

The development signing path signed the Kernel in place and never checked
the result, so a failed sbsign could leave a broken Kernel behind and a bad
signature went unnoticed (sbverify --list only prints signatures).

The Kernel is now signed to a temporary file and verified against the dev
certificate before it replaces the original. On failure the temporary file
and the private key are removed and the build aborts, matching the HSM path.
---
 .../hooks/live/93-sb-sign-kernel.chroot               | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

(limited to 'data')

diff --git a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
index 129ca8f8..1a2ee141 100755
--- a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
+++ b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot
@@ -50,9 +50,24 @@ if [ -f ${SB_KERNEL_CERT} ] && [ -f ${SB_OPENSSL_CONF} ]; then
     echo "I: Linux Kernel signed and signature verified"
 elif [ -f ${KERNEL_KEY} ] && [ -f ${KERNEL_CERT} ]; then
     echo "I: Signing Linux Kernel for Secure Boot"
-    sbsign --key ${KERNEL_KEY} --cert ${KERNEL_CERT} /boot/${VMLINUZ} --output /boot/${VMLINUZ}
-    sbverify --list /boot/${VMLINUZ}
+    sbsign --key ${KERNEL_KEY} --cert ${KERNEL_CERT} \
+        /boot/${VMLINUZ} --output /boot/${VMLINUZ}.tmp
+    if [ $? -ne 0 ]; then
+        rm -f /boot/${VMLINUZ}.tmp ${KERNEL_KEY}
+        echo "E: Signing of Linux Kernel failed"
+        exit 1
+    fi
+
+    sbverify --cert ${KERNEL_CERT} /boot/${VMLINUZ}.tmp
+    if [ $? -ne 0 ]; then
+        rm -f /boot/${VMLINUZ}.tmp ${KERNEL_KEY}
+        echo "E: Signature verification failed - keeping the unsigned Linux Kernel"
+        exit 1
+    fi
+
+    mv /boot/${VMLINUZ}.tmp /boot/${VMLINUZ}
     rm -f ${KERNEL_KEY}
+    echo "I: Linux Kernel signed and signature verified"
 else
     echo "I: Signing key for Linux Kernel not found - Secure Boot not possible"
 fi
-- 
cgit v1.2.3