shim-15.6 for opsi

[uibmz]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
  https://github.com/opsi-org/shim-review/blob/master/README.md
• shim.efi to be signed
  https://github.com/opsi-org/shim-review/blob/master/shimx64.efi
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
  https://github.com/opsi-org/shim-review/blob/master/opsi-uefi-ca.der
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
  no vendor_db in use
• any extra patches to shim via your own git tree or as files
  https://github.com/opsi-org/shim-review/blob/master/opsi-netboot.patch
• any extra patches to grub via your own git tree or as files
  no grub patches in use
• build logs
  https://github.com/opsi-org/shim-review/blob/master/build.log
• a Dockerfile to reproduce the build of the provided shim EFI binaries
  https://github.com/opsi-org/shim-review/blob/master/dockerfile

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/opsi-org/shim-review/releases/tag/opsi-shim-x86_64-20220624

---

What is the SHA256 hash of your final SHIM binary?

---

03d6dab2afd15b969af65e3d33416032382bec6d03ea952e0fc37f82830ac2ee
˝

[uibmz]

Our previously accepted shim
#29

[frozencemetery]

@cyphermox was contact verification previously carried out for opsi?

[uibmz]

No the contact verification was not carried out @frozencemetery
Our last submission that the "contact verification needed" tag but was closed because of the last CVEs

[frozencemetery]

Thanks, looks like that was #224. I'm sending some words to yinz; please post them here once you receive them.

[uibmz]

The words [email protected] received were

fjernavlese
orddelingsposisjonenes
frihandelsområda
klosterkjerkene
objektivert
formannskapsflertallet
arbeidsmarkedspolitikk
sangkonkurransen
gjennomsnittsøkningens
kildestoffets
eneomsorgen
minstesikringen
klattmalerer

[uibmz]

the words [email protected] received were

frokostserveringer
dispersjons
miljøterapeutiske
svaberg
overdekkende
mammakjole
fagforeningsfløyene
underlivsundersøkelsen
konkursjegeren
forhåndsinnstillinga
sjansefattigere
dekorasjonen
kurse

[frozencemetery]

Those are the correct words; verified for both.

[uibmz]

Anything we can to to aid with the whole process?
Any more information needed?

[steve-mcintyre]

Looking at this, lots of good stuff:

• build reproduces fine
• SBAT entries look ok to me
• embedded CA cert runs to 2032, looks ok
• grub taken from Debian's 2.06-3, which is OK AFAIK!
• trivial shim patch looks ok
• kernels sound ok

Some things to follow up on:

• tell us more about your replacement bootloader please

[uibmz]

For the time being, we still use Grub 2.06.
We are tinkering around with iPXE currently as it has HTTPS support and we would like to ditch TFTP for large files like our bootimage. For now this is just some experimental work. We just wanted to change the name, in case we will change the bootloader. So customers and users won't be annoyed by reading grubx64.efi and seeing another bootloader configs or menus.

[julian-klode]

I can tell you right now that it's very unlikely you'd get a shim signed that can load iPXE.

Many grub vendors (Ubuntu, Fedora, openSUSE) have incorporated the patches from openSUSE to enable UEFI network protocols into grub, which gives you HTTPS support (on UEFI platforms). That's a signable secure boot HTTPS boot path.

I don't think anybody has asked for that in Debian yet, I certainly haven't pushed it there from Ubuntu yet. I guess I could.

I think all grubs support HTTP which is still better than TFTP. Presumably better than HTTPS as it makes it clear where the security boundaries are. With HTTPS it's unclear how much trust is placed in certificates, where they come from, or if they are validated at all.

[uibmz]

Thank you for the info @julian-klode. We will look into this.

As said, For now this is just some tinkering and no final decisions have been made. We are still running with grub2 though.

[steve-mcintyre]

I have to agree with @julian-klode here. Until people have done a full SB review of the ipxe codebase, I'm afraid it's not an option from the shim-review point of view. If you acknowledge that, we can progress here.

Apologies if that sounds harsh, but we're responsible for maintaining the SB security chain for everybody. :-/

[uibmz]

If there is no option, then yes we acknowledge this fact. We can then progress and we will use grub2 only.

We understand that the security chain has to be maintained and secured.

[steve-mcintyre]

ok, then I think you're ready to go