Closed akodanev closed 1 month ago
Contact verification has been done previously, marking as such
alpaquita-shim-x64-aarch64-20240528
#20 0.249 2b2f2dada7a8e0060dfbd8d6d4ef926b0d57a49edb8560623091eedcc9f205fd /shim-review/shimx64.efi
#20 0.252 2b2f2dada7a8e0060dfbd8d6d4ef926b0d57a49edb8560623091eedcc9f205fd /pkg/x86_64/boot/efi/EFI/alpaquita/shimx64.efi
#20 0.460 f83b753616fab1bffa57a1ea446577c1c20e36d0726885ae6f9da035cf12ef9b /shim-review/shimaa64.efi
#20 0.463 f83b753616fab1bffa57a1ea446577c1c20e36d0726885ae6f9da035cf12ef9b /pkg/aarch64/boot/efi/EFI/alpaquita/shimaa64.efi
Besides those questions LGTM
@THS-on thanks for your review!
Last review was accepted, but not signed by MS
It was returned signed by Microsoft some time after the issue was closed. I should have mentioned this in a comment there.
The latest submission template includes now question on how you contributed to the shim review process
Added. The new tag is https://github.com/akodanev/shim-review/tree/alpaquita-shim-x64-aarch64-20240624.
Are you planning on signing UKIs, systemd-boot or fwupd in the future?
There are no plans to sign UKI or systemd-boot. However, we will most likely make the fwupd component available for review in the next shim update.
@akodanev thanks for the clarifications. LGTM from my side.
Uses upstream 15.8 and source hashes matches original hashes
SBAT entries from shim looks fine
No patches added on top of upstream shim
Vendor SBAT entry is at 1
Binaries are reproducible using the container image
--> da351481bf72
STEP 18/18: RUN for i in x86_64 aarch64; do case $i in x86_64) shim_name=shimx64.efi;; aarch64) shim_name=shimaa64.efi;; esac; sha256sum /shim-review/$shim_name /pkg/$i/boot/efi/EFI/alpaquita/$shim_name; hexdump -Cv /pkg/$i/boot/efi/EFI/alpaquita/$shim_name > build.$i; hexdump -Cv /shim-review/$shim_name > orig.$i; diff -u orig.$i build.$i; done
2b2f2dada7a8e0060dfbd8d6d4ef926b0d57a49edb8560623091eedcc9f205fd /shim-review/shimx64.efi
2b2f2dada7a8e0060dfbd8d6d4ef926b0d57a49edb8560623091eedcc9f205fd /pkg/x86_64/boot/efi/EFI/alpaquita/shimx64.efi
f83b753616fab1bffa57a1ea446577c1c20e36d0726885ae6f9da035cf12ef9b /shim-review/shimaa64.efi
f83b753616fab1bffa57a1ea446577c1c20e36d0726885ae6f9da035cf12ef9b /pkg/aarch64/boot/efi/EFI/alpaquita/shimaa64.efi
NX flag is not set, because the chain is not yet ready
Self signed 2048 bit cert and valid for almost 9 years
grub,4
Other than those few notes, LGTM
For your next submission, make sure to include the patch from here
OK. I am hoping that this will be the next release of the shim so that the patch will already be there.
Regarding grub2 sbat entry, if you are fetching from Alpine, I guess you need to maintain the upstream SBAT entry int your SBAT
There is none upstream. Maybe it's only helpful if there's more than one such shim/grub based on this Alpine version.
Other than those few notes, LGTM
Thank you @SherifNagy!
Regarding grub2 sbat entry, if you are fetching from Alpine, I guess you need to maintain the upstream SBAT entry int your SBAT, @THS-on any thoughts on this?
@SherifNagy as mentioned Alpine does not have one. As the current package is mostly vanilla GRUB2 + peimage patches, I'm fine with not having an Alpine specific one.
marking it as accepted
The signed binaries received. Closing this as completed.
Confirm the following are included in your repo, checking each box:
What is the link to your tag in a repo cloned from rhboot/shim-review?
https://github.com/akodanev/shim-review/tree/alpaquita-shim-x64-aarch64-20240624
What is the SHA256 hash of your final SHIM binary?
What is the link to your previous shim review request (if any, otherwise N/A)?
https://github.com/rhboot/shim-review/issues/325
If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?
https://github.com/rhboot/shim-review/issues/325#issuecomment-1755613348