Rework handling of the Secure Boot keys and certificates #3044
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| # Copyright (c) 2015 CoreOS Inc. | ||
| # Copyright (c) 2024 The Flatcar Maintainers. | ||
| # Distributed under the terms of the GNU General Public License v2 | ||
|
|
||
| EAPI=8 | ||
|
|
||
| DESCRIPTION="Flatcar Secure Boot keys" | ||
| HOMEPAGE="https://www.flatcar.org/" | ||
| S="${WORKDIR}" | ||
|
|
||
| LICENSE="BSD" | ||
| SLOT="0" | ||
| KEYWORDS="amd64 arm64" | ||
|
|
||
| BDEPEND=" | ||
| app-emulation/virt-firmware | ||
| dev-libs/openssl | ||
| " | ||
|
|
||
| # Arbitrary value created for Flatcar. | ||
| OWNER_GUID="4a974879-bf65-4eb8-b404-ac3a6141121e" | ||
|
|
||
| src_compile() { | ||
| local TYPE | ||
| for TYPE in unofficial official; do | ||
| mkdir "${TYPE}" || die | ||
|
|
||
| # Gather all the shim vendor PEM certs into an array. | ||
| local FILES=( "${FILESDIR}/${TYPE}"/shim-*.pem ) | ||
|
|
||
| # Rewrite the newest shim vendor PEM cert in a consistent PEM format, | ||
| # checking its validity. Only the newest is needed in PEM format for | ||
| # inserting into the kernel to verify the verity root hash at boot time. | ||
| openssl x509 -in "${FILES[-1]}" -inform PEM -out "${TYPE}"/shim.pem || die | ||
|
|
||
| local ARGS=() FILE | ||
| for FILE in "${FILES[@]}"; do | ||
| # Add each shim vendor PEM cert to the DER ESL creation below. | ||
| ARGS+=( --add-cert "${OWNER_GUID}" "${FILE}" ) | ||
| done | ||
|
|
||
| # This ingests shim vendor PEM certs and outputs a combined DER ESL. | ||
| virt-fw-sigdb "${ARGS[@]}" --output "${TYPE}"/shim.esl || die | ||
| done | ||
|
|
||
| # Rewrite the official signing PEM cert in a consistent PEM format, checking | ||
| # its validity. Only the newest is needed in PEM format to sign the | ||
| # bootloader and the kernel image. Unofficial builds are already covered | ||
| # above because the shim vendor cert /is/ the signing cert, not a CA. | ||
| openssl x509 -in "${FILESDIR}"/official/signing.pem -inform PEM -out official/signing.pem || die | ||
|
There was a problem hiding this comment. This certificate is only needed during signing - storing it in the repo means we need to update more places. Fetching it from Keyvault when signing seems like the better choice. |
||
| } | ||
|
|
||
| src_install() { | ||
| insinto /usr/share/sb_keys | ||
| newins - owner.txt <<< "${OWNER_GUID}" | ||
| doins -r unofficial official | ||
|
|
||
| insinto /usr/share/sb_keys/unofficial | ||
| doins "${FILESDIR}"/unofficial/{DB.{key,pem},shim.key} | ||
| } | ||
|
There was a problem hiding this comment.
There was a problem hiding this comment.
There was a problem hiding this comment. Since the current solution was a stop-gap solution, my intention was to keep the name as development. Going foward, I'll post the metadata to be used and once vouched for, I'll proceed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| -----BEGIN CERTIFICATE----- | ||
| MIIDaDCCAlCgAwIBAgIRAINN27bWbE7vq1xOCROIuyMwDQYJKoZIhvcNAQELBQAw | ||
| PTE7MDkGA1UEAxMyRmxhdGNhciBDb250YWluZXIgTGludXggU2VjdXJlIEJvb3Qg | ||
| RGV2ZWxvcG1lbnQgQ0EwHhcNMjQxMTA3MTkwMjIyWhcNMzcwMTE5MDMxNDA3WjA9 | ||
| MTswOQYDVQQDEzJGbGF0Y2FyIENvbnRhaW5lciBMaW51eCBTZWN1cmUgQm9vdCBE | ||
| ZXZlbG9wbWVudCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ5q | ||
| pvNmeh7nGFp5k4WnsOnBct1DtRcgCPbKVNOs6tvmSiygkrnw4l6mR2FJr7JPl5IE | ||
| IDttPQnotGYjKJhhEkYIcLUn91w8UAuq68iKfHcr3RKfD0u3ZzxqXzGrPaIcqbGl | ||
| GQwFxtoFxwf8MOskyM3R1zIKKYKABpEZj8Nq7Y/1tYdqip63KygJ4NGs+qYkaPcX | ||
| TlCh2rSZsc39kiGdASzHn0LsSU4IFFSLUQvNOO3DXwI0RCOrvl4KoyXtPRB33dUN | ||
| H80A/bPXUe67GBhlZyzctJ+YDSXzkPZftlAgMB/+/rtxHCSJXgGFmm5smICW4yRT | ||
| byKpnlp5apcc4x2TbQUCAwEAAaNjMGEwHwYDVR0jBBgwFoAUbfTa4PZ82LTaSzln | ||
| iD0LyFf+h7AwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O | ||
| BBYEFG302uD2fNi02ks5Z4g9C8hX/oewMA0GCSqGSIb3DQEBCwUAA4IBAQBPx4C1 | ||
| z5/eVwMTaDT2zo1qe+pqscMjZ1+TClQ+wK33tkHrvzfHtDnjgPDEM/rpHKucSoeS | ||
| xAdFlXqnJja0MEWdCh4503/KWOxl4quQdQclVFlV6A6/f8kbCB2hzb2k5NMUPE2b | ||
| Vg+wTOd22dm7HSeCsxkvAbtAQPDXLaBJ6dxGS7KEk3akHHIYqBSBbXEuhjgIcdJ2 | ||
| 5mzUCAXJEpZ1J/nqQZsZD+Ugp7iMB3JV9xC01JNWMuMlGoeI1F6orssR6jU3aCjk | ||
| jZjSnyqDINcqddkevpYWg+ffvg3ewQ4lMcFPwjGDxqPOCPZmAw/l7xd6LqFTq//C | ||
| iAQ/ssvyzfqSgqWN | ||
| -----END CERTIFICATE----- |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| -----BEGIN CERTIFICATE----- | ||
| MIIELTCCAxWgAwIBAgICCSkwDQYJKoZIhvcNAQELBQAwPTE7MDkGA1UEAxMyRmxh | ||
| dGNhciBDb250YWluZXIgTGludXggU2VjdXJlIEJvb3QgRGV2ZWxvcG1lbnQgQ0Ew | ||
| HhcNMjUwMzIwMTE0ODIyWhcNMjgwMzIwMTE0ODIyWjBCMUAwPgYDVQQDEzdGbGF0 | ||
| Y2FyIENvbnRhaW5lciBMaW51eCBTZWN1cmUgQm9vdCBEZXZlbG9wbWVudCBTaWdu | ||
| aW5nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAi4DQeJdbATc+6bXu | ||
| fC45iOj+fuA9p/L7WvY0FoT4ohmynoaYgBzUXMV333H7Pzy1qknZ1Kz8A8c8nlp0 | ||
| BQOr0cnvoJhPt2lOP7EofCdylOBOfWPqP9l73pATp2/jJnUi+288eSTHBX6GgLqk | ||
| PYceTjIxQWP6OzjP94ZCOBQnB6Ib4TaMbuylkz7vrog1JMPoGOdrSmZvaWqHebx5 | ||
| GaPwNOQzJAw6d4rFrphqso51r/Q4vxps+fMQZoJAMP4xT1SCIQO1kFt+3Q6MFi3m | ||
| ztte5Y/Q46IvKEZaWU8K5umFnBaOWCDeFelV268TsvyrBBrCBB4Q5ooo2NiZESh4 | ||
| 7fS1lT3Jcr8Unw3b2E91Y/hmGRDwrC+yp+7f51gRC3UIP5AsF1oX/nF+kD+mrhhg | ||
| 3gPtCXdx88ttaJBdOCMfdgoONvY8Yl1WlbjbC5pCEMK3/gV5SGCbvlAaqBkh6gvY | ||
| dsFKMCbSHg/eD6PS3bgRtfcb1jCsIXGrzJRVi/Fgu0u9D9UylNkGkrvHQ0r1ffKM | ||
| O7hlgooo9SLloU+4MLMHCujOQo978XIdsYy2DCiRQdD33LXEgQMGEcZvENIXkmFU | ||
| Iujq32PMKc31P84JPGzyeUN3VkdUPww4HRwEcsfUFJ8b4xEEmAUi/+zqz5XCo3m1 | ||
| nh62zX/ByIyCmY56rgWFWmSON4UCAwEAAaMyMDAwCQYDVR0TBAIwADATBgNVHSUE | ||
| DDAKBggrBgEFBQcDAzAOBgNVHQ8BAf8EBAMCBaAwDQYJKoZIhvcNAQELBQADggEB | ||
| AGKZATREaf6bdjfYmrM0cKwlPcd9Bo95gX/uucRzLmAvgo5KftgFABhqNxQeb6g2 | ||
| mkz9EKCtYt8WPH7j914yXQLLes/nrqARPIV2n0IP5SxRDmDxhSl3jhStp97idGvv | ||
| zS07tM7oHqPycwitfrJl0kbrIYXr5f2PyG2kANjPgoYHcl5KLnffv95XSokNhWFK | ||
| 17asGpHUrtOlOJm1mCgjpmiotYgMIGtKFMiKB8yFQRFRnyMb7uowkq/G9btDjW/7 | ||
| kVJwppmwXXL5qiAAzvFQcbBbWmiIwVXjb8OLO43dsB0znt+IMDf7itUiUCLSOjqQ | ||
| z3S4t9QNWU6jp0RBwEQfI6g= | ||
| -----END CERTIFICATE----- |
Binary file not shown.
File renamed without changes.
File renamed without changes.
File renamed without changes.
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # Copyright 2015 CoreOS, Inc. | ||
| # Distributed under the terms of the GNU General Public License v2 | ||
|
|
||
| EAPI=8 | ||
|
|
||
| DESCRIPTION="UEFI Shim loader" | ||
| HOMEPAGE="https://github.com/rhboot/shim" | ||
| SRC_URI="https://github.com/rhboot/shim/releases/download/${PV}/shim-${PV}.tar.bz2" | ||
| KEYWORDS="amd64 arm64" | ||
|
|
||
| LICENSE="BSD" | ||
| SLOT="0" | ||
| IUSE="official" | ||
|
|
||
| # TODO: Would be ideal to depend on sys-boot/gnu-efi package, but | ||
| # currently the shim insists on using the bundled copy. This will need | ||
| # to be addressed by patching this check out after making sure that | ||
| # our copy of gnu-efi is as usable as the bundled one. | ||
| DEPEND=" | ||
| dev-libs/openssl | ||
| " | ||
| BDEPEND=" | ||
| coreos-base/coreos-sb-keys | ||
| " | ||
|
|
||
| PATCHES=( | ||
| "${FILESDIR}/0001-Fix-parallel-build-of-gnu-efi.patch" | ||
| ) | ||
|
|
||
| src_compile() { | ||
| sed -e "s/@@VERSION@@/${PVR}/" "${FILESDIR}"/sbat.csv.in >"${WORKDIR}/sbat.csv" || die | ||
|
|
||
| unset ARCH | ||
| emake \ | ||
| CROSS_COMPILE="${CHOST}-" \ | ||
| ENABLE_SBSIGN=1 \ | ||
| SBATPATH="${WORKDIR}"/sbat.csv \ | ||
| VENDOR_DB_FILE="${BROOT}"/usr/share/sb_keys/$(usex official official unofficial)/shim.esl | ||
| } | ||
|
|
||
| src_install() { | ||
| insinto /usr/lib/shim | ||
| doins shim?*.efi mm?*.efi | ||
| } |
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since we can fetch it from Keyvault on demand, and this certificate is needed while signing, why store it in the repo. Better keep the way it's done.