search

bottlerocket-os / twoliter

A build tool for customizing Bottlerocket
Other
24 stars 25 forks source link

imghelper: disable pkix in nss #335

Closed cbgbt closed 4 months ago

cbgbt commented 4 months ago

Description of changes: During image creation, bottlerocket uses the pesigcheck utility to verify secureboot signatures on all signed artifacts. The signature validation is implemented via libnss.

The next Bottlerocket SDK release will move to NSS 3.101.

In NSS 3.101, lib::pkix was enabled as the default X.509 validator. This causes pesigcheck to fail with "Peer's Certificate issuer is not recognized," despite the CA issuer being provided to pesigcheck.

This change sets NSS_DISABLE_PKIX_VERIFY=1, which reverts to the previous default verifier.

I've opened https://github.com/bottlerocket-os/twoliter/issues/334 to root-cause the changes in pkix which cause the issue. We will revert to the previous validator while working to become compatible with pkix.

Testing done:

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

cbgbt commented 4 months ago

We've opted to instead include this fix in the SDK itself in https://github.com/bottlerocket-os/bottlerocket-sdk/pull/194