diff --git a/build_library/build_image_util.sh b/build_library/build_image_util.sh index 6d7dbfc165c..a68af31ac4b 100755 --- a/build_library/build_image_util.sh +++ b/build_library/build_image_util.sh @@ -797,7 +797,6 @@ EOF # calculated. Only for unofficial builds as official builds get signed later. if [[ ${COREOS_OFFICIAL:-0} -ne 1 ]]; then do_sbsign --output "${root_fs_dir}/boot/flatcar/vmlinuz-a"{,} - cleanup_sbsign_certs fi if [[ -n "${image_kernel}" ]]; then @@ -904,7 +903,7 @@ sbsign_image() { "${BUILD_LIBRARY_DIR}/disk_util" --disk_layout="${disk_layout}" \ mount "${disk_img}" "${root_fs_dir}" - trap "cleanup_mounts '${root_fs_dir}'; cleanup_sbsign_certs" EXIT + trap "cleanup_mounts '${root_fs_dir}'" EXIT # Sign the kernel with the shim-embedded key. do_sbsign --output "${root_fs_dir}/boot/flatcar/vmlinuz-a"{,} @@ -934,7 +933,6 @@ sbsign_image() { fi cleanup_mounts "${root_fs_dir}" - cleanup_sbsign_certs trap - EXIT if [[ -n "${pcr_policy}" ]]; then diff --git a/build_library/grub_install.sh b/build_library/grub_install.sh index 61e2fc6fb83..03e33d2cfca 100755 --- a/build_library/grub_install.sh +++ b/build_library/grub_install.sh @@ -90,7 +90,6 @@ ESP_DIR= LOOP_DEV= cleanup() { - cleanup_sbsign_certs if [[ -d "${ESP_DIR}" ]]; then if mountpoint -q "${ESP_DIR}"; then sudo umount "${ESP_DIR}" @@ -200,8 +199,8 @@ case "${FLAGS_target}" in # Unofficial build: Sign shim with our development key. sudo sbsign \ - --key /usr/share/sb_keys/DB.key \ - --cert /usr/share/sb_keys/DB.crt \ + --key /usr/share/sb_keys/unofficial/DB.key \ + --cert /usr/share/sb_keys/unofficial/DB.pem \ --output "${ESP_DIR}/EFI/boot/boot${EFI_ARCH}.efi" \ "${BOARD_ROOT}/usr/lib/shim/shim${EFI_ARCH}.efi" else diff --git a/build_library/sbsign_util.sh b/build_library/sbsign_util.sh index 4d7fcf22106..77587dec231 100644 --- a/build_library/sbsign_util.sh +++ b/build_library/sbsign_util.sh @@ -3,44 +3,23 @@ # found in the LICENSE file. if [[ ${COREOS_OFFICIAL:-0} -ne 1 ]]; then - SBSIGN_KEY="/usr/share/sb_keys/shim.key" - SBSIGN_CERT="/usr/share/sb_keys/shim.pem" + SBSIGN_KEY="/usr/share/sb_keys/unofficial/shim.key" + SBSIGN_CERT="/usr/share/sb_keys/unofficial/shim.pem" else SBSIGN_KEY="pkcs11:token=flatcar-sb-dev-hsm-sign-2025" - unset SBSIGN_CERT + SBSIGN_CERT="/usr/share/sb_keys/official/signing.pem" fi -PKCS11_MODULE_PATH="/usr/$(get_sdk_libdir)/pkcs11/azure-keyvault-pkcs11.so" +PKCS11_MODULE_PATH="$(pkg-config p11-kit-1 --variable p11_module_path)/azure-keyvault-pkcs11.so" PKCS11_ENV=( + AZURE_CORE_COLLECT_TELEMETRY=no AZURE_KEYVAULT_URL="https://flatcar-sb-dev-kv.vault.azure.net/" PKCS11_MODULE_PATH="${PKCS11_MODULE_PATH}" AZURE_KEYVAULT_PKCS11_DEBUG=1 ) -get_sbsign_cert() { - if [[ ${SBSIGN_KEY} != pkcs11:* || -s ${SBSIGN_CERT-} ]]; then - return - fi - - SBSIGN_CERT=$(mktemp -t signing-cert.XXXXXXXXXX.pem) - info "Fetching ${SBSIGN_KEY} from Azure" - - # Needs Key Vault Reader role. - env "${PKCS11_ENV[@]}" p11-kit export-object \ - --provider "${PKCS11_MODULE_PATH}" \ - "${SBSIGN_KEY};type=cert" \ - | tee "${SBSIGN_CERT}" -} - -cleanup_sbsign_certs() { - if [[ ${SBSIGN_CERT-} == "${TMPDIR-/tmp}"/* ]]; then - rm -f -- "${SBSIGN_CERT}" - fi -} - do_sbsign() { - get_sbsign_cert info "Signing ${@:$#} with ${SBSIGN_KEY}" if [[ ${SBSIGN_KEY} == pkcs11:* ]]; then diff --git a/build_library/vm_image_util.sh b/build_library/vm_image_util.sh index 1a6950ea2f1..b0fd5879bec 100644 --- a/build_library/vm_image_util.sh +++ b/build_library/vm_image_util.sh @@ -863,7 +863,7 @@ _write_qemu_uefi_secure_conf() { local flash_rw="$(_dst_name "_efi_vars.qcow2")" local flash_ro="$(_dst_name "_efi_code.qcow2")" local script="$(_dst_dir)/$(_dst_name ".sh")" - local owner="00000000-0000-0000-0000-000000000000" + local owner=$("${WORKDIR}/sbat.csv" || die - - # Apparently our environment already has the ARCH variable in - # it, and Makefile picks it up instead of figuring it out - # itself with the compiler -dumpmachine flag. But also it - # expects a different format of the values. It wants x86_64 - # instead of amd64, and aarch64 instead of arm64. - if use amd64; then - emake_args+=( ARCH=x86_64 ) - elif use arm64; then - emake_args+=( ARCH=aarch64 ) - fi - emake_args+=( ENABLE_SBSIGN=1 ) - emake_args+=( SBATPATH="${WORKDIR}/sbat.csv" ) - - if use official; then - if [ -z "${SHIM_SIGNING_CERTIFICATE}" ]; then - die "use production flag needs env SHIM_SIGNING_CERTIFICATE" - fi - emake_args+=( VENDOR_CERT_FILE="${SHIM_SIGNING_CERTIFICATE}" ) - else - emake_args+=( VENDOR_CERT_FILE="/usr/share/sb_keys/shim.der" ) - fi - emake "${emake_args[@]}" || die -} - -src_install() { - local suffix - suffix='' - if use amd64; then - suffix=x64 - elif use arm64; then - suffix=aa64 - fi - insinto /usr/lib/shim - newins "shim${suffix}.efi" "shim${suffix}.efi" - newins "mm${suffix}.efi" "mm${suffix}.efi" -} diff --git a/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-15.8-r3.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-15.8-r3.ebuild new file mode 100644 index 00000000000..daf58253b98 --- /dev/null +++ b/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-15.8-r3.ebuild @@ -0,0 +1,44 @@ +# Copyright 2015 CoreOS, Inc. +# Distributed under the terms of the GNU General Public License v2 + +EAPI=8 + +DESCRIPTION="UEFI Shim loader" +HOMEPAGE="https://github.com/rhboot/shim" +SRC_URI="https://github.com/rhboot/shim/releases/download/${PV}/shim-${PV}.tar.bz2" +KEYWORDS="amd64 arm64" + +LICENSE="BSD" +SLOT="0" +IUSE="official" + +# TODO: Would be ideal to depend on sys-boot/gnu-efi package, but +# currently the shim insists on using the bundled copy. This will need +# to be addressed by patching this check out after making sure that +# our copy of gnu-efi is as usable as the bundled one. +DEPEND=" + dev-libs/openssl +" +BDEPEND=" + coreos-base/coreos-sb-keys +" + +PATCHES=( + "${FILESDIR}/0001-Fix-parallel-build-of-gnu-efi.patch" +) + +src_compile() { + sed -e "s/@@VERSION@@/${PVR}/" "${FILESDIR}"/sbat.csv.in >"${WORKDIR}/sbat.csv" || die + + unset ARCH + emake \ + CROSS_COMPILE="${CHOST}-" \ + ENABLE_SBSIGN=1 \ + SBATPATH="${WORKDIR}"/sbat.csv \ + VENDOR_DB_FILE="${BROOT}"/usr/share/sb_keys/$(usex official official unofficial)/shim.esl +} + +src_install() { + insinto /usr/lib/shim + doins shim?*.efi mm?*.efi +}