[Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .
Scott Little
scott.little at windriver.com
Tue Sep 6 17:58:51 UTC 2022
I think you read it backwards. I'll try again (inline below)
Scott
On 2022-07-27 09:57, Kumar, Chandan wrote:
>
> **[Please note: This e-mail is from an EXTERNAL e-mail address]
>
> Hi Scott,
>
> I was going through the procedure that you have shared below. Please
> clarify these two points:
>
> * The rpms need to be unpacked, the relevant binaries signed with
> correct keys, and the rpms reassembled. : The signing server
> unpacks images like BOOTX64, shim, shimx64 to get rpms, then signs
> it using `sbsign` and then repack it as original image. Is this
> understanding correct ?
>
It unpacks RPM: shim*rpm
It looks for files matching:
BOOTX64*, shim*, shimx64*, which it signs with the 'boot' key; and
MokManager*, fallback*, mmx64*, fbx64* , which it signs with the
'shim' key
Note: * above should be one of .efi or .EFI
Finally it repack the shim RPM file.
Repeat per the below table for the other RPMS.
> *
> * shim.crt - Certificated embedded within shim used to validate
> kernel, grub : How is this certificate embedded inside shim image ?
>
> I got review notification for launchpad, I had raised but could not
> find where to add comments so replying to this mail.
>
> Regards,
>
> Chandan Kumar.
>
> *From:* Waines, Greg <Greg.Waines at windriver.com>
> *Sent:* Wednesday, July 13, 2022 8:14 PM
> *To:* StarlingX ML <starlingx-discuss at lists.starlingx.io>
> *Cc:* Kumar, Chandan <Chandan.Kumar at commscope.com>
> *Subject:* FW: [Starlingx-discuss] Incorrect public key for signed
> starlingX 5.0 iso .
>
> Forwarding ….
>
> I think scott meant this for the starlingx discuss list.
>
> Greg.
>
> *From:* Little, Scott <Scott.Little at windriver.com>
> *Sent:* Wednesday, July 6, 2022 2:37 PM
> *To:* Waines, Greg <Greg.Waines at windriver.com>
> *Subject:* Re: [Starlingx-discuss] Incorrect public key for signed
> starlingX 5.0 iso .
>
> I'll attempt to answer this at a high level.
>
> Secure boot signing uses a client/server approach. build-pkgs acts as
> the client. The server holds the signing scripts and the keys used for
> signing.
>
> The client side code was released to open source as part of
> StarlingX. The server side code was not released.
>
> The interface between client and server is currently undocumented.
> I'll try to give an overview as best I can. Basically it is a series
> of ssh/scp calls made into signing server.
>
> 'build-pkgs' requires that the following environment variables be
> defined before it will attempt to request a secure boot signing.
>
> export SIGNING_SERVER=<signing-host>
> export SIGNING_USER=<signing-user>
>
> export SIGNING_SERVER_SCRIPT=<path-to-signing-script>
>
> 'build-pkgs' further requires that "$USER" == "jenkins", and
>
> export FORMAL_BUILD=1
>
> If that is satisfied, it calls into 'sign-secure-boot'
>
> 'sign-secure-boot' contains a fairly good set of comments describing
> what happens next.
>
> The client side call sequence looks like this ...
>
> # Set up the server side directory for files transfers.
> UPLOAD_PATH=`ssh $SIGNING_USER@$SIGNING_SERVER sudo
> $SIGNING_SCRIPT -r`
>
> # upload the original package
> scp -q $FILE $SIGNING_USER@$SIGNING_SERVER:$UPLOAD_PATH <#REDACTED>
>
> # Request that the package be signed
> ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -v -i
> $UPLOAD_PATH/$(basename $FILE) $UNSIGNED_OPTION -t $TYPE > $TMPFILE
>
> # Download the file from the signing server
> DOWNLOAD_FILENAME=$(basename $OUTPUT_FILE)
> scp -q $SIGNING_USER@$SIGNING_SERVER:$OUTPUT_FILE <#REDACTED>
> $(dirname $FILE)
>
> Within the signing server there are two keys used for signing, known
> as the 'boot' key and the 'shim' key. The public half of the 'boot'
> key must manually added to the secure boot keychain in firmware. The
> 'boot' key signs first executable loaded, contained in the 'shim'
> package. The first executable must then install the public half of the
> shim key (automatically) before passing control to grub, and
> ultimately the kernel, both of which are signed by the 'shim' key.
>
> Three packages need to be passed to the signing server. The rpms need
> to be unpacked, the relevant binaries signed with correct keys, and
> the rpms reassembled.
>
> package key files to sign
> ========= ==== ===========================
> shim boot BOOTX64, shim, shimx64
> shim MokManager, fallback, mmx64, fbx64
> grub shim grubx64.efi, gcdx64.efi
> kernel shim vmlinuz
>
> NOTE: shim files to sign might include a '.efi' or '.EFI' suffix.
> Sign those as well.
>
> NOTE: some files may be absent in newer packages. It is probably ok
> if some of the above are missing.
>
> Signing looks like this ...
>
> sbsign --key $KEYPATH/$KEYNAME.key --cert $KEYPATH/$KEYNAME.crt
> --output $SIGNEDFILE $UNSIGNEDFILE
>
> On keys and certs ...
>
> boot.crt - Certificate to boot (to be programmed in firmware)
> boot.key - Private key with which to sign shim
> shim.crt - Certificated embedded within shim used to validate
> kernel, grub
> shim.key - Private key with which to sign kernel/grub
>
> key generation ...
>
> |openssl req -new -x509 -newkey |rsa:2048 <#REDACTED>|-keyout $KEY.key
> -out $KEY.pem -days 3650|
>
> |openssl x509 -in $KEY.pem -out $KEY.crt -outform DER|
>
> Note: boot.crt should be copied to
> cgcs-root/build-tools/certificates/TiBoot.crt for inclusion during
> the 'build-iso' step
>
> Hope this helps
>
> Scott
>
> On 2022-07-05 03:19, Kumar, Chandan wrote:
>
> [Please note: This e-mail is from an EXTERNAL e-mail address]
>
> Hi Greg,
>
> Thanks for acknowledgement.
>
> I have raised starlingx launchpad for document update. Meanwhile
> it would be really great if you can share the steps which has to
> be done to integrate signing of images as part of StarlingX build
> infrastructure.
>
> Regards,
>
> Chandan Kumar.
>
> *From:* Waines, Greg <Greg.Waines at windriver.com>
> <mailto:Greg.Waines at windriver.com>
> *Sent:* Monday, July 4, 2022 6:00 PM
> *To:* starlingx-discuss at lists.starlingx.io
> *Cc:* Little, Scott <Scott.Little at windriver.com>
> <mailto:Scott.Little at windriver.com>
> *Subject:* Re: [Starlingx-discuss] Incorrect public key for signed
> starlingX 5.0 iso .
>
> Hey Chandan,
>
> Thanks for bringing this up.
>
> I chatted with Scott about this.
>
> Currently the StarlingX public builds on CENGN are not building a
> secure boot capable load … i.e. signing the appropriate items to
> enable secure boot. Although the StarlingX build infrastructure
> allows it to be added.
>
> Neither of these points are properly documented in docs.starlingx.io ☹
>
> I can’t remember the details of why we are not doing this.
>
> I am guessing that the thinking was that a user of StarlingX that
> wanted to use UEFI Secure Boot, would want to sign with his own
> private key.
>
> Can you raise a starlingx launchpad (
> https://launchpad.net/starlingx
> <https://urldefense.com/v3/__https:/secure-web.cisco.com/1mVLF-b4c-tBpQaEbNZbIeg5wuI2Sgdw11Kg2fRT9qRF2wo07vvRq040DIA0_Wsi3D4gtikjd41f-NbhgDr0WtPQQBHE441l65nwt6p00kAsBdGTNHMs0SRRp5xooNafH_Whk-Dm4t5akvM7v59ubFU1OqnyVm_DWXmTRsjlP7iavYNBqohwIkDwu5U_0bdpFU4p4YPP0Lf9wDBMltx2noOl9B-SkedaJ-aS-ZXVVTe6xH6VLXYIALMIH-dnrPQ7c4Gq8UZlj5vmUSNdnMlN2-alEns4KcCDiDF4IpogwjWO9-Bzcr272kWadoiBLaMmvU4L7OKnYa3EnFa8xAAyVJA/https*3A*2F*2Flaunchpad.net*2Fstarlingx__;JSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFaFWk0Ya8$>
> ) to address the docs.starlingx.io
> <https://urldefense.com/v3/__http:/docs.starlingx.io__;!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa1r3VAOU$>
> documentation issue, i.e. to indicate that the StarlingX CENGN
> builds are not signed to support uefi secure boot, and describe
> how a starlingx user could add signing to their StarlingX build
> environment in order to sign for uefi secure boot with their own
> private key ?
>
> Greg.
>
> *From:* Scott Little <scott.little at windriver.com>
> *Sent:* Wednesday, June 29, 2022 10:42 AM
> *To:* starlingx-discuss at lists.starlingx.io
> *Subject:* Re: [Starlingx-discuss] Incorrect public key for signed
> starlingX 5.0 iso .
>
> On 2022-06-02 13:12, Kumar, Chandan wrote:
>
> [Please note: This e-mail is from an EXTERNAL e-mail address]
>
> Hi,
>
> I am trying to validate signed starlingX 5.0 iso on a
> secureboot enabled setup against public key(TiBoot.crt)
> embedded inside iso. After rebooting , operating system is not
> coming up with error screen saying “Verification failed:
> (0X1A) Security Violation”.
>
> However, when I signed images with self-generated private key
> and validated against corresponding public key, system is able
> to boot up successfully. Signing is done after flashing the
> iso on a server. Please find attached procedure for signing
> images inside iso.
>
> I believe, the public key provided with iso is not correct.
> Can you please confirm ?
>
> Regards,
>
> Chandan Kumar.
>
> _______________________________________________
>
> Starlingx-discuss mailing list
>
> Starlingx-discuss at lists.starlingx.io
>
> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss <https://urldefense.com/v3/__https:/secure-web.cisco.com/1-KIhdgnDGw2i_w1bSfhcdQdJ0gtuSiGAoU-ggPInTuBelT92KbXPGwz89fztx-5CLsTQfshXKTc3aaqqJ-Mq4BnErMA5jCPj57X8BHou8RtYoI0fF-kIFVYYVX9qbmwnPrfape21hfY5wqnypwaoc7s_IL-RIFlZBKWMVC32JZy9GB4EI2XPFktp20B16JE2vxi4esR5XfNXcqUCBA5HqY3LGwMpw_r-Lz3Kxs5sFgxDJWsJNwol2lbAUfTEnyexbAghOCdz5cQrYRbu4HbMGraGchOZUlVwI22gkKpWT_z874pdrPIYAmShanAKy0bpA3IG3jgV79cAljguedbamQ/https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Flists.starlingx.io*2Fcgi-bin*2Fmailman*2Flistinfo*2Fstarlingx-discuss__*3B*21*21AjveYdw8EvQ*21e8leCxdSWn7CF5mepfpbV18UcLDSxfeu8JA2iW4ux5kQ7-Dya9uodepzEl_9Pj1QzoD5CDyT3LJdh6si3eZDcLl5VHlseg*24__;JSUlJSUlJSUlJSUlJSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa3RUKtLs$>
>
> Thanks for the report. I'll look into it
>
> Scott Little
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20220906/69fb3d05/attachment-0001.htm>
More information about the Starlingx-discuss
mailing list