Hey Chandan,

Thanks for bringing this up.

I chatted with Scott about this.

Currently the StarlingX public builds on CENGN are not building a secure boot capable load … i.e. signing the appropriate items to enable secure boot.  Although the StarlingX build infrastructure allows it to be added.

Neither of these points are properly documented in docs.starlingx.io   ☹

I can’t remember the details of why we are not doing this.

I am guessing that the thinking was that a user of StarlingX that wanted to use UEFI Secure Boot, would want to sign with his own private key.

Can you raise a starlingx launchpad ( https://launchpad.net/starlingx ) to address the docs.starlingx.io documentation issue, i.e. to indicate that the StarlingX CENGN builds are not signed to support uefi secure boot, and describe how a starlingx user could add signing to their StarlingX build environment in order to sign for uefi secure boot with their own private key ?

Greg.

From: Scott Little <scott.little@windriver.com>
Sent: Wednesday, June 29, 2022 10:42 AM
To: starlingx-discuss@lists.starlingx.io
Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .

On 2022-06-02 13:12, Kumar, Chandan wrote:

[Please note: This e-mail is from an EXTERNAL e-mail address]

Hi,

I am trying to validate signed starlingX 5.0 iso on a secureboot enabled setup against public key(TiBoot.crt) embedded inside iso. After rebooting , operating system is not coming up with error screen saying “Verification failed: (0X1A) Security Violation”.

However, when I signed images with self-generated private key and validated against corresponding public key, system is able to boot up successfully. Signing is done after flashing the iso on a server. Please find attached procedure for signing images inside iso.

I believe, the public key provided with iso is not correct. Can you please confirm ?

Regards,

Chandan Kumar.    

_______________________________________________
Starlingx-discuss mailing list
Starlingx-discuss@lists.starlingx.io
http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss

Thanks for the report.   I'll look into it

Scott Little