From b5155b113e7b624ca2b89ec6c6c2286624714cbe Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 17 Oct 2026 14:55:13 +0200 Subject: Testsuite: T861: enroll dev shim certificate using mokutil The install mok CLI command is gone, so the Secure Boot test now imports the development shim root certificate shipped in the image with plain mokutil. The development certificate names follow the current year instead of a hardcoded one. The production certificate is left untouched. --- data/live-build-config/hooks/live/93-sb-sign-kernel.chroot | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'data') diff --git a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot index 16684d74..4fe056ef 100755 --- a/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot +++ b/data/live-build-config/hooks/live/93-sb-sign-kernel.chroot @@ -1,7 +1,9 @@ #!/bin/sh + SIGN_FILE=$(find /usr/lib -name sign-file) -KERNEL_KEY="/var/lib/shim-signed/mok/vyos-dev-2025-linux.key" -KERNEL_CERT="/var/lib/shim-signed/mok/vyos-dev-2025-linux.pem" +CA_YEAR="$(date +%Y)" +KERNEL_KEY="/var/lib/shim-signed/mok/vyos-dev-${CA_YEAR}-linux.key" +KERNEL_CERT="/var/lib/shim-signed/mok/vyos-dev-${CA_YEAR}-linux.pem" SB_KERNEL_CERT="/var/lib/shim-signed/mok/vyos-prod-2025-linux.pem" SB_OPENSSL_CONF="/etc/ssl/yubihsm-openssl.cnf" SB_PKCS11_CONF="/etc/yubihsm_pkcs11.conf" -- cgit v1.2.3