[Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .

Scott Little scott.little at windriver.com
Tue Sep 6 17:58:51 UTC 2022


I think you read it backwards.   I'll try again (inline below)

Scott


On 2022-07-27 09:57, Kumar, Chandan wrote:
>
> **[Please note: This e-mail is from an EXTERNAL e-mail address]
>
> Hi Scott,
>
> I was going through the procedure that you have shared below. Please 
> clarify these two points:
>
>   * The rpms need to be unpacked, the relevant binaries signed with
>     correct keys, and the rpms reassembled. : The signing server
>     unpacks images like BOOTX64, shim, shimx64 to get rpms, then signs
>     it using `sbsign` and then repack it as original image. Is this
>     understanding correct ?
>

It unpacks RPM: shim*rpm

It looks for files matching:

     BOOTX64*, shim*, shimx64*, which it signs with the 'boot' key; and

     MokManager*, fallback*, mmx64*, fbx64* , which it signs with the 
'shim' key

     Note: * above should be one of .efi or .EFI

Finally it repack the shim RPM file.


Repeat per the below table for the other RPMS.



>  *
>   * shim.crt - Certificated embedded within shim used to validate
>     kernel, grub : How is this certificate embedded inside shim image ?
>
> I got review notification for launchpad, I had raised but could not 
> find where to add comments so replying to this mail.
>
> Regards,
>
> Chandan Kumar.
>
> *From:* Waines, Greg <Greg.Waines at windriver.com>
> *Sent:* Wednesday, July 13, 2022 8:14 PM
> *To:* StarlingX ML <starlingx-discuss at lists.starlingx.io>
> *Cc:* Kumar, Chandan <Chandan.Kumar at commscope.com>
> *Subject:* FW: [Starlingx-discuss] Incorrect public key for signed 
> starlingX 5.0 iso .
>
> Forwarding ….
>
> I think scott meant this for the starlingx discuss list.
>
> Greg.
>
> *From:* Little, Scott <Scott.Little at windriver.com>
> *Sent:* Wednesday, July 6, 2022 2:37 PM
> *To:* Waines, Greg <Greg.Waines at windriver.com>
> *Subject:* Re: [Starlingx-discuss] Incorrect public key for signed 
> starlingX 5.0 iso .
>
> I'll attempt to answer this at a high level.
>
> Secure boot signing uses a client/server approach.  build-pkgs acts as 
> the client. The server holds the signing scripts and the keys used for 
> signing.
>
> The client side code was released to open source as part of 
> StarlingX.  The server side code was not released.
>
> The interface between client and server is currently undocumented.  
> I'll try to give an overview as best I can.  Basically it is a series 
> of ssh/scp calls made into signing server.
>
> 'build-pkgs' requires that the following environment variables be 
> defined before it will attempt to request a secure boot signing.
>
> export SIGNING_SERVER=<signing-host>
> export SIGNING_USER=<signing-user>
>
> export SIGNING_SERVER_SCRIPT=<path-to-signing-script>
>
> 'build-pkgs' further requires that "$USER" == "jenkins", and
>
> export FORMAL_BUILD=1
>
> If that is satisfied, it calls into 'sign-secure-boot'
>
> 'sign-secure-boot' contains a fairly good set of comments describing 
> what happens next.
>
> The client side call sequence looks like this ...
>
>     # Set up the server side directory for files transfers.
>     UPLOAD_PATH=`ssh $SIGNING_USER@$SIGNING_SERVER sudo 
> $SIGNING_SCRIPT -r`
>
>     # upload the original package
>     scp -q $FILE $SIGNING_USER@$SIGNING_SERVER:$UPLOAD_PATH <#REDACTED>
>
>     # Request that the package be signed
>     ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -v -i 
> $UPLOAD_PATH/$(basename $FILE) $UNSIGNED_OPTION -t $TYPE > $TMPFILE
>
>     # Download the file from the signing server
>     DOWNLOAD_FILENAME=$(basename $OUTPUT_FILE)
>     scp -q $SIGNING_USER@$SIGNING_SERVER:$OUTPUT_FILE <#REDACTED> 
> $(dirname $FILE)
>
> Within the signing server there are two keys used for signing, known 
> as the 'boot' key and the 'shim' key.  The public half of the 'boot' 
> key must manually added to the secure boot keychain in firmware.  The 
> 'boot' key signs first executable loaded, contained in the 'shim' 
> package. The first executable must then install the public half of the 
> shim key (automatically) before passing control to grub, and 
> ultimately the kernel, both of which are signed by the 'shim' key.
>
> Three packages need to be passed to the signing server. The rpms need 
> to be unpacked, the relevant binaries signed with correct keys, and 
> the rpms reassembled.
>
> package    key   files to sign
> =========  ====  ===========================
> shim       boot  BOOTX64, shim, shimx64
>             shim  MokManager, fallback, mmx64, fbx64
> grub       shim  grubx64.efi, gcdx64.efi
> kernel     shim  vmlinuz
>
> NOTE: shim files to sign might include a '.efi' or '.EFI' suffix.  
> Sign those as well.
>
> NOTE: some files may be absent in newer packages.  It is probably ok 
> if some of the above are missing.
>
> Signing looks like this ...
>
>     sbsign --key $KEYPATH/$KEYNAME.key --cert $KEYPATH/$KEYNAME.crt  
> --output $SIGNEDFILE $UNSIGNEDFILE
>
> On keys and certs ...
>
>    boot.crt - Certificate to boot (to be programmed in firmware)
>    boot.key - Private key with which to sign shim
>    shim.crt - Certificated embedded within shim used to validate 
> kernel, grub
>    shim.key - Private key with which to sign kernel/grub
>
> key generation ...
>
> |openssl req -new -x509 -newkey |rsa:2048 <#REDACTED>|-keyout $KEY.key 
> -out $KEY.pem -days 3650|
>
> |openssl x509 -in $KEY.pem -out $KEY.crt -outform DER|
>
> Note: boot.crt should be copied to 
> cgcs-root/build-tools/certificates/TiBoot.crt for inclusion during 
> the  'build-iso' step
>
> Hope this helps
>
> Scott
>
> On 2022-07-05 03:19, Kumar, Chandan wrote:
>
>     [Please note: This e-mail is from an EXTERNAL e-mail address]
>
>     Hi Greg,
>
>     Thanks for acknowledgement.
>
>     I have raised starlingx launchpad  for document update. Meanwhile
>     it would be really great if you can share the steps which has to
>     be done to integrate signing of images as part of StarlingX build
>     infrastructure.
>
>     Regards,
>
>     Chandan Kumar.
>
>     *From:* Waines, Greg <Greg.Waines at windriver.com>
>     <mailto:Greg.Waines at windriver.com>
>     *Sent:* Monday, July 4, 2022 6:00 PM
>     *To:* starlingx-discuss at lists.starlingx.io
>     *Cc:* Little, Scott <Scott.Little at windriver.com>
>     <mailto:Scott.Little at windriver.com>
>     *Subject:* Re: [Starlingx-discuss] Incorrect public key for signed
>     starlingX 5.0 iso .
>
>     Hey Chandan,
>
>     Thanks for bringing this up.
>
>     I chatted with Scott about this.
>
>     Currently the StarlingX public builds on CENGN are not building a
>     secure boot capable load … i.e. signing the appropriate items to
>     enable secure boot.  Although the StarlingX build infrastructure
>     allows it to be added.
>
>     Neither of these points are properly documented in docs.starlingx.io ☹
>
>     I can’t remember the details of why we are not doing this.
>
>     I am guessing that the thinking was that a user of StarlingX that
>     wanted to use UEFI Secure Boot, would want to sign with his own
>     private key.
>
>     Can you raise a starlingx launchpad (
>     https://launchpad.net/starlingx
>     <https://urldefense.com/v3/__https:/secure-web.cisco.com/1mVLF-b4c-tBpQaEbNZbIeg5wuI2Sgdw11Kg2fRT9qRF2wo07vvRq040DIA0_Wsi3D4gtikjd41f-NbhgDr0WtPQQBHE441l65nwt6p00kAsBdGTNHMs0SRRp5xooNafH_Whk-Dm4t5akvM7v59ubFU1OqnyVm_DWXmTRsjlP7iavYNBqohwIkDwu5U_0bdpFU4p4YPP0Lf9wDBMltx2noOl9B-SkedaJ-aS-ZXVVTe6xH6VLXYIALMIH-dnrPQ7c4Gq8UZlj5vmUSNdnMlN2-alEns4KcCDiDF4IpogwjWO9-Bzcr272kWadoiBLaMmvU4L7OKnYa3EnFa8xAAyVJA/https*3A*2F*2Flaunchpad.net*2Fstarlingx__;JSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFaFWk0Ya8$>
>     ) to address the docs.starlingx.io
>     <https://urldefense.com/v3/__http:/docs.starlingx.io__;!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa1r3VAOU$>
>     documentation issue, i.e. to indicate that the StarlingX CENGN
>     builds are not signed to support uefi secure boot, and describe
>     how a starlingx user could add signing to their StarlingX build
>     environment in order to sign for uefi secure boot with their own
>     private key ?
>
>     Greg.
>
>     *From:* Scott Little <scott.little at windriver.com>
>     *Sent:* Wednesday, June 29, 2022 10:42 AM
>     *To:* starlingx-discuss at lists.starlingx.io
>     *Subject:* Re: [Starlingx-discuss] Incorrect public key for signed
>     starlingX 5.0 iso .
>
>     On 2022-06-02 13:12, Kumar, Chandan wrote:
>
>         [Please note: This e-mail is from an EXTERNAL e-mail address]
>
>         Hi,
>
>         I am trying to validate signed starlingX 5.0 iso on a
>         secureboot enabled setup against public key(TiBoot.crt)
>         embedded inside iso. After rebooting , operating system is not
>         coming up with error screen saying “Verification failed:
>         (0X1A) Security Violation”.
>
>         However, when I signed images with self-generated private key
>         and validated against corresponding public key, system is able
>         to boot up successfully. Signing is done after flashing the
>         iso on a server. Please find attached procedure for signing
>         images inside iso.
>
>         I believe, the public key provided with iso is not correct.
>         Can you please confirm ?
>
>         Regards,
>
>         Chandan Kumar.
>
>         _______________________________________________
>
>         Starlingx-discuss mailing list
>
>         Starlingx-discuss at lists.starlingx.io
>
>         http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss  <https://urldefense.com/v3/__https:/secure-web.cisco.com/1-KIhdgnDGw2i_w1bSfhcdQdJ0gtuSiGAoU-ggPInTuBelT92KbXPGwz89fztx-5CLsTQfshXKTc3aaqqJ-Mq4BnErMA5jCPj57X8BHou8RtYoI0fF-kIFVYYVX9qbmwnPrfape21hfY5wqnypwaoc7s_IL-RIFlZBKWMVC32JZy9GB4EI2XPFktp20B16JE2vxi4esR5XfNXcqUCBA5HqY3LGwMpw_r-Lz3Kxs5sFgxDJWsJNwol2lbAUfTEnyexbAghOCdz5cQrYRbu4HbMGraGchOZUlVwI22gkKpWT_z874pdrPIYAmShanAKy0bpA3IG3jgV79cAljguedbamQ/https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Flists.starlingx.io*2Fcgi-bin*2Fmailman*2Flistinfo*2Fstarlingx-discuss__*3B*21*21AjveYdw8EvQ*21e8leCxdSWn7CF5mepfpbV18UcLDSxfeu8JA2iW4ux5kQ7-Dya9uodepzEl_9Pj1QzoD5CDyT3LJdh6si3eZDcLl5VHlseg*24__;JSUlJSUlJSUlJSUlJSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa3RUKtLs$>
>
>     Thanks for the report.   I'll look into it
>
>     Scott Little
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20220906/69fb3d05/attachment-0001.htm>


More information about the Starlingx-discuss mailing list