-
Notifications
You must be signed in to change notification settings - Fork 125
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
shim 15.8 (64bit and 32bit) for baramundi Management Suite #422
Comments
Identity confirmation (Markus Spier): kiddy demarcation washer reptile Capra Evan weepiest covetous copulate Monteverdi |
@steve-mcintyre Just for info, my colleagues (the other contacts mentiont in the review) are currently on holiday until 10 June. So it will be a while before they reply. |
Understood, thanks for letting us know |
Identity confirmation (Viktor Moor): sprout interspersing promontories locutions Sachs determination spoor |
Identity confirmation (Christian Bonfert): inaccessibility uninstall bazaars swop wanna archivists fanny mindfully nightcap lychees |
I have some questions before doing a full review.
|
Yes.
I assume you are asking this question because we use the
Thanks for the hint. Is setting the NX-flag relevant for passing this review?
You can find the sources here: https://github.com/baramundisoftware/grub2_2024 Description what our module does: In the first step, our module "bblefi" determines the UUID of the system and the MAC address of the network adapter. Then it reads (loads) a configuration file with simple control options from the TFTP server. Afterwards it reads (loads) a menu file with boot options from the TFTP server specified in the configuration file. This menu file is located in a path/folder that contains the system UUID and the MAC of the network adapter. In the next step it offers the boot options in a TUI (Text based User Interface) and waits for selection by the user if F8 has been pressed. Otherwise the configured default option is selected. Finally, the selected option is executed (load file via TFTP, boot from HDD, open GRUB console). The Shim Verifier ensures that files loaded for execution are signed by Microsoft or baramundi and can therefore be trusted. |
Questions:
|
Hi @es-fabricemarie thanks for working on our submission.
No, the old EV Code Signing cert had simply expired. In the meantime, the legal form has also changed (AG => GmbH), so that a new EV Code Signing certificate made sense from our point of view. Unfortunately, a link to the old review-process (from 2015) does not exist.
I would prefer not to set the NX bit, as we are considering (mid/long-term) booting Linux via grub2 in the future. Hopefully I was able to answer your questions. |
Makes sense. Thanks. I suggest you upload your old certificate and your old signed-shim to your current shim review repo since you can't produce the old shim review. This way, everyone will be able to see that the cert has expired. |
Thanks @es-fabricemarie for this hint. The requested files can be found here in our current shim review repo: https://github.com/baramundisoftware/ShimReview_2024/tree/main/OldReviewContent |
I can confirm that your cert expired in 2018 when examining the cert extracted from your old shim: objcopy -j .vendor_cert -O binary shim_old.efi expired_vendor_cert.der
openssl x509 -inform der -in expired_vendor_cert.der -noout -text -fingerprint
[...]
Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA (SHA2)
Validity
Not Before: Mar 11 00:00:00 2015 GMT
Not After : Mar 14 12:00:00 2018 GMT
Subject: businessCategory=Private Organization, jurisdictionC=DE, jurisdictionST=Augsburg, serialNumber=HRB 2064, street=Beim Glaspalast 1, postalCode=86153, C=DE, ST=Bayern, L=Augsburg, O=baramundi software AG, CN=baramundi software AG
SHA1 Fingerprint=11:CB:BF:10:1A:8E:D5:8F:FF:EF:36:CD:9D:DF:9B:7F:FF:4E:7B:16
[...] Just to be thorough: it means that since March 2018 you have no signed shim? |
The old signed shim recently provided in the current shim review was signed by Microsoft with the certificate "Microsoft Corporation UEFI CA 2011", which has not yet been revoked. Therefore, the signing of our old shim is still valid. |
@THS-on Are there any outstanding issues that we can help with to support and drive forward the review process? |
@MarkusSpier as you implement a lot new functionality as a single GRUB2 module, we are currently in discussion how to treat this from a review perspective, as this is closer to a custom bootlaoder than vanilla GRUB2. @steve-mcintyre is there something @MarkusSpier can already do? |
@THS-on Thanks for the quick reply. The only changes are the updates of Grub2 and Shim to the most recent versions to address security issues and the transfer of the UUID. As the previous bootchain (currently signed shim + grub2 with bblefi module) is almost identical to the bootchain described in this review, the functionality is not new in our opinion. |
Confirm the following are included in your repo, checking each box:
What is the link to your tag in a repo cloned from rhboot/shim-review?
https://github.com/baramundisoftware/ShimReview_2024/tree/baramundi_ShimReview_2024_05_24
What is the SHA256 hash of your final SHIM binary?
shimx64.efi: 8caa3da0defbfa7d9fbb33f573a4d0f308712957883de46e21c9f4292cd0ceb9
shimia32.efi: 1fe41f9d836f64d299d790d7b6ba14d7f5c93f73014d08468814f307d86de4a8
What is the link to your previous shim review request (if any, otherwise N/A)?
N/A
If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?
N/A
The text was updated successfully, but these errors were encountered: