[Starlingx-discuss] FW: Incorrect public key for signed starlingX 5.0 iso .
Forwarding …. I think scott meant this for the starlingx discuss list. Greg. From: Little, Scott <Scott.Little@windriver.com> Sent: Wednesday, July 6, 2022 2:37 PM To: Waines, Greg <Greg.Waines@windriver.com> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . I'll attempt to answer this at a high level. Secure boot signing uses a client/server approach. build-pkgs acts as the client. The server holds the signing scripts and the keys used for signing. The client side code was released to open source as part of StarlingX. The server side code was not released. The interface between client and server is currently undocumented. I'll try to give an overview as best I can. Basically it is a series of ssh/scp calls made into signing server. 'build-pkgs' requires that the following environment variables be defined before it will attempt to request a secure boot signing. export SIGNING_SERVER=<signing-host> export SIGNING_USER=<signing-user> export SIGNING_SERVER_SCRIPT=<path-to-signing-script> 'build-pkgs' further requires that "$USER" == "jenkins", and export FORMAL_BUILD=1 If that is satisfied, it calls into 'sign-secure-boot' 'sign-secure-boot' contains a fairly good set of comments describing what happens next. The client side call sequence looks like this ... # Set up the server side directory for files transfers. UPLOAD_PATH=`ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -r` # upload the original package scp -q $FILE $SIGNING_USER@$SIGNING_SERVER:$UPLOAD_PATH # Request that the package be signed ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -v -i $UPLOAD_PATH/$(basename $FILE) $UNSIGNED_OPTION -t $TYPE > $TMPFILE # Download the file from the signing server DOWNLOAD_FILENAME=$(basename $OUTPUT_FILE) scp -q $SIGNING_USER@$SIGNING_SERVER:$OUTPUT_FILE $(dirname $FILE) Within the signing server there are two keys used for signing, known as the 'boot' key and the 'shim' key. The public half of the 'boot' key must manually added to the secure boot keychain in firmware. The 'boot' key signs first executable loaded, contained in the 'shim' package. The first executable must then install the public half of the shim key (automatically) before passing control to grub, and ultimately the kernel, both of which are signed by the 'shim' key. Three packages need to be passed to the signing server. The rpms need to be unpacked, the relevant binaries signed with correct keys, and the rpms reassembled. package key files to sign ========= ==== =========================== shim boot BOOTX64, shim, shimx64 shim MokManager, fallback, mmx64, fbx64 grub shim grubx64.efi, gcdx64.efi kernel shim vmlinuz NOTE: shim files to sign might include a '.efi' or '.EFI' suffix. Sign those as well. NOTE: some files may be absent in newer packages. It is probably ok if some of the above are missing. Signing looks like this ... sbsign --key $KEYPATH/$KEYNAME.key --cert $KEYPATH/$KEYNAME.crt --output $SIGNEDFILE $UNSIGNEDFILE On keys and certs ... boot.crt - Certificate to boot (to be programmed in firmware) boot.key - Private key with which to sign shim shim.crt - Certificated embedded within shim used to validate kernel, grub shim.key - Private key with which to sign kernel/grub key generation ... openssl req -new -x509 -newkey rsa:2048 -keyout $KEY.key -out $KEY.pem -days 3650 openssl x509 -in $KEY.pem -out $KEY.crt -outform DER Note: boot.crt should be copied to cgcs-root/build-tools/certificates/TiBoot.crt for inclusion during the 'build-iso' step Hope this helps Scott On 2022-07-05 03:19, Kumar, Chandan wrote: [Please note: This e-mail is from an EXTERNAL e-mail address] Hi Greg, Thanks for acknowledgement. I have raised starlingx launchpad for document update. Meanwhile it would be really great if you can share the steps which has to be done to integrate signing of images as part of StarlingX build infrastructure. Regards, Chandan Kumar. From: Waines, Greg <Greg.Waines@windriver.com><mailto:Greg.Waines@windriver.com> Sent: Monday, July 4, 2022 6:00 PM To: starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io> Cc: Little, Scott <Scott.Little@windriver.com><mailto:Scott.Little@windriver.com> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . Hey Chandan, Thanks for bringing this up. I chatted with Scott about this. Currently the StarlingX public builds on CENGN are not building a secure boot capable load … i.e. signing the appropriate items to enable secure boot. Although the StarlingX build infrastructure allows it to be added. Neither of these points are properly documented in docs.starlingx.io ☹ I can’t remember the details of why we are not doing this. I am guessing that the thinking was that a user of StarlingX that wanted to use UEFI Secure Boot, would want to sign with his own private key. Can you raise a starlingx launchpad ( https://launchpad.net/starlingx<https://urldefense.com/v3/__https:/secure-web.cisco.com/1mVLF-b4c-tBpQaEbNZbIeg5wuI2Sgdw11Kg2fRT9qRF2wo07vvRq040DIA0_Wsi3D4gtikjd41f-NbhgDr0WtPQQBHE441l65nwt6p00kAsBdGTNHMs0SRRp5xooNafH_Whk-Dm4t5akvM7v59ubFU1OqnyVm_DWXmTRsjlP7iavYNBqohwIkDwu5U_0bdpFU4p4YPP0Lf9wDBMltx2noOl9B-SkedaJ-aS-ZXVVTe6xH6VLXYIALMIH-dnrPQ7c4Gq8UZlj5vmUSNdnMlN2-alEns4KcCDiDF4IpogwjWO9-Bzcr272kWadoiBLaMmvU4L7OKnYa3EnFa8xAAyVJA/https*3A*2F*2Flaunchpad.net*2Fstarlingx__;JSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFaFWk0Ya8$> ) to address the docs.starlingx.io<https://urldefense.com/v3/__http:/docs.starlingx.io__;!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa1r3VAOU$> documentation issue, i.e. to indicate that the StarlingX CENGN builds are not signed to support uefi secure boot, and describe how a starlingx user could add signing to their StarlingX build environment in order to sign for uefi secure boot with their own private key ? Greg. From: Scott Little <scott.little@windriver.com<mailto:scott.little@windriver.com>> Sent: Wednesday, June 29, 2022 10:42 AM To: starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . On 2022-06-02 13:12, Kumar, Chandan wrote: [Please note: This e-mail is from an EXTERNAL e-mail address] Hi, I am trying to validate signed starlingX 5.0 iso on a secureboot enabled setup against public key(TiBoot.crt) embedded inside iso. After rebooting , operating system is not coming up with error screen saying “Verification failed: (0X1A) Security Violation”. However, when I signed images with self-generated private key and validated against corresponding public key, system is able to boot up successfully. Signing is done after flashing the iso on a server. Please find attached procedure for signing images inside iso. I believe, the public key provided with iso is not correct. Can you please confirm ? Regards, Chandan Kumar. _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io<mailto:Starlingx-discuss@lists.starlingx.io> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss<https://urldefense.com/v3/__https:/secure-web.cisco.com/1-KIhdgnDGw2i_w1bSfhcdQdJ0gtuSiGAoU-ggPInTuBelT92KbXPGwz89fztx-5CLsTQfshXKTc3aaqqJ-Mq4BnErMA5jCPj57X8BHou8RtYoI0fF-kIFVYYVX9qbmwnPrfape21hfY5wqnypwaoc7s_IL-RIFlZBKWMVC32JZy9GB4EI2XPFktp20B16JE2vxi4esR5XfNXcqUCBA5HqY3LGwMpw_r-Lz3Kxs5sFgxDJWsJNwol2lbAUfTEnyexbAghOCdz5cQrYRbu4HbMGraGchOZUlVwI22gkKpWT_z874pdrPIYAmShanAKy0bpA3IG3jgV79cAljguedbamQ/https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Flists.starlingx.io*2Fcgi-bin*2Fmailman*2Flistinfo*2Fstarlingx-discuss__*3B*21*21AjveYdw8EvQ*21e8leCxdSWn7CF5mepfpbV18UcLDSxfeu8JA2iW4ux5kQ7-Dya9uodepzEl_9Pj1QzoD5CDyT3LJdh6si3eZDcLl5VHlseg*24__;JSUlJSUlJSUlJSUlJSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa3RUKtLs$> Thanks for the report. I'll look into it Scott Little
Hi Scott, I was going through the procedure that you have shared below. Please clarify these two points: * The rpms need to be unpacked, the relevant binaries signed with correct keys, and the rpms reassembled. : The signing server unpacks images like BOOTX64, shim, shimx64 to get rpms, then signs it using `sbsign` and then repack it as original image. Is this understanding correct ? * shim.crt - Certificated embedded within shim used to validate kernel, grub : How is this certificate embedded inside shim image ? I got review notification for launchpad, I had raised but could not find where to add comments so replying to this mail. Regards, Chandan Kumar. From: Waines, Greg <Greg.Waines@windriver.com> Sent: Wednesday, July 13, 2022 8:14 PM To: StarlingX ML <starlingx-discuss@lists.starlingx.io> Cc: Kumar, Chandan <Chandan.Kumar@commscope.com> Subject: FW: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . Forwarding …. I think scott meant this for the starlingx discuss list. Greg. External (greg.waines@windriver.com<mailto:greg.waines@windriver.com>) Report This Email<https://protection.inkyphishfence.com/report?id=Y29tbXNjb3BlL2NoYW5kYW4ua3VtYXJAY29tbXNjb3BlLmNvbS84M2NjNTM2YzVmNjYxMDg1MTBmMjQ1MWNhNmEyOGYwYi8xNjU3NzIzNDMyLjQ1#key=342b6109cc945ea1b11d6acfaa1e44f0> FAQ<https://www.inky.com/banner-faq> Protection by INKY<https://www.inky.com/protection-by-inky> Forwarding …. I think scott meant this for the starlingx discuss list. Greg. From: Little, Scott <Scott.Little@windriver.com<mailto:Scott.Little@windriver.com>> Sent: Wednesday, July 6, 2022 2:37 PM To: Waines, Greg <Greg.Waines@windriver.com<mailto:Greg.Waines@windriver.com>> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . I'll attempt to answer this at a high level. Secure boot signing uses a client/server approach. build-pkgs acts as the client. The server holds the signing scripts and the keys used for signing. The client side code was released to open source as part of StarlingX. The server side code was not released. The interface between client and server is currently undocumented. I'll try to give an overview as best I can. Basically it is a series of ssh/scp calls made into signing server. 'build-pkgs' requires that the following environment variables be defined before it will attempt to request a secure boot signing. export SIGNING_SERVER=<signing-host> export SIGNING_USER=<signing-user> export SIGNING_SERVER_SCRIPT=<path-to-signing-script> 'build-pkgs' further requires that "$USER" == "jenkins", and export FORMAL_BUILD=1 If that is satisfied, it calls into 'sign-secure-boot' 'sign-secure-boot' contains a fairly good set of comments describing what happens next. The client side call sequence looks like this ... # Set up the server side directory for files transfers. UPLOAD_PATH=`ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -r` # upload the original package scp -q $FILE $SIGNING_USER@$SIGNING_SERVER:$UPLOAD_PATH # Request that the package be signed ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -v -i $UPLOAD_PATH/$(basename $FILE) $UNSIGNED_OPTION -t $TYPE > $TMPFILE # Download the file from the signing server DOWNLOAD_FILENAME=$(basename $OUTPUT_FILE) scp -q $SIGNING_USER@$SIGNING_SERVER:$OUTPUT_FILE $(dirname $FILE) Within the signing server there are two keys used for signing, known as the 'boot' key and the 'shim' key. The public half of the 'boot' key must manually added to the secure boot keychain in firmware. The 'boot' key signs first executable loaded, contained in the 'shim' package. The first executable must then install the public half of the shim key (automatically) before passing control to grub, and ultimately the kernel, both of which are signed by the 'shim' key. Three packages need to be passed to the signing server. The rpms need to be unpacked, the relevant binaries signed with correct keys, and the rpms reassembled. package key files to sign ========= ==== =========================== shim boot BOOTX64, shim, shimx64 shim MokManager, fallback, mmx64, fbx64 grub shim grubx64.efi, gcdx64.efi kernel shim vmlinuz NOTE: shim files to sign might include a '.efi' or '.EFI' suffix. Sign those as well. NOTE: some files may be absent in newer packages. It is probably ok if some of the above are missing. Signing looks like this ... sbsign --key $KEYPATH/$KEYNAME.key --cert $KEYPATH/$KEYNAME.crt --output $SIGNEDFILE $UNSIGNEDFILE On keys and certs ... boot.crt - Certificate to boot (to be programmed in firmware) boot.key - Private key with which to sign shim shim.crt - Certificated embedded within shim used to validate kernel, grub shim.key - Private key with which to sign kernel/grub key generation ... openssl req -new -x509 -newkey rsa:2048 -keyout $KEY.key -out $KEY.pem -days 3650 openssl x509 -in $KEY.pem -out $KEY.crt -outform DER Note: boot.crt should be copied to cgcs-root/build-tools/certificates/TiBoot.crt for inclusion during the 'build-iso' step Hope this helps Scott On 2022-07-05 03:19, Kumar, Chandan wrote: [Please note: This e-mail is from an EXTERNAL e-mail address] Hi Greg, Thanks for acknowledgement. I have raised starlingx launchpad for document update. Meanwhile it would be really great if you can share the steps which has to be done to integrate signing of images as part of StarlingX build infrastructure. Regards, Chandan Kumar. From: Waines, Greg <Greg.Waines@windriver.com><mailto:Greg.Waines@windriver.com> Sent: Monday, July 4, 2022 6:00 PM To: starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io> Cc: Little, Scott <Scott.Little@windriver.com><mailto:Scott.Little@windriver.com> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . Hey Chandan, Thanks for bringing this up. I chatted with Scott about this. Currently the StarlingX public builds on CENGN are not building a secure boot capable load … i.e. signing the appropriate items to enable secure boot. Although the StarlingX build infrastructure allows it to be added. Neither of these points are properly documented in docs.starlingx.io ☹ I can’t remember the details of why we are not doing this. I am guessing that the thinking was that a user of StarlingX that wanted to use UEFI Secure Boot, would want to sign with his own private key. Can you raise a starlingx launchpad ( https://launchpad.net/starlingx<https://urldefense.com/v3/__https:/secure-web.cisco.com/1mVLF-b4c-tBpQaEbNZbIeg5wuI2Sgdw11Kg2fRT9qRF2wo07vvRq040DIA0_Wsi3D4gtikjd41f-NbhgDr0WtPQQBHE441l65nwt6p00kAsBdGTNHMs0SRRp5xooNafH_Whk-Dm4t5akvM7v59ubFU1OqnyVm_DWXmTRsjlP7iavYNBqohwIkDwu5U_0bdpFU4p4YPP0Lf9wDBMltx2noOl9B-SkedaJ-aS-ZXVVTe6xH6VLXYIALMIH-dnrPQ7c4Gq8UZlj5vmUSNdnMlN2-alEns4KcCDiDF4IpogwjWO9-Bzcr272kWadoiBLaMmvU4L7OKnYa3EnFa8xAAyVJA/https*3A*2F*2Flaunchpad.net*2Fstarlingx__;JSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFaFWk0Ya8$> ) to address the docs.starlingx.io<https://urldefense.com/v3/__http:/docs.starlingx.io__;!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa1r3VAOU$> documentation issue, i.e. to indicate that the StarlingX CENGN builds are not signed to support uefi secure boot, and describe how a starlingx user could add signing to their StarlingX build environment in order to sign for uefi secure boot with their own private key ? Greg. From: Scott Little <scott.little@windriver.com<mailto:scott.little@windriver.com>> Sent: Wednesday, June 29, 2022 10:42 AM To: starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . On 2022-06-02 13:12, Kumar, Chandan wrote: [Please note: This e-mail is from an EXTERNAL e-mail address] Hi, I am trying to validate signed starlingX 5.0 iso on a secureboot enabled setup against public key(TiBoot.crt) embedded inside iso. After rebooting , operating system is not coming up with error screen saying “Verification failed: (0X1A) Security Violation”. However, when I signed images with self-generated private key and validated against corresponding public key, system is able to boot up successfully. Signing is done after flashing the iso on a server. Please find attached procedure for signing images inside iso. I believe, the public key provided with iso is not correct. Can you please confirm ? Regards, Chandan Kumar. _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io<mailto:Starlingx-discuss@lists.starlingx.io> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss<https://urldefense.com/v3/__https:/secure-web.cisco.com/1-KIhdgnDGw2i_w1bSfhcdQdJ0gtuSiGAoU-ggPInTuBelT92KbXPGwz89fztx-5CLsTQfshXKTc3aaqqJ-Mq4BnErMA5jCPj57X8BHou8RtYoI0fF-kIFVYYVX9qbmwnPrfape21hfY5wqnypwaoc7s_IL-RIFlZBKWMVC32JZy9GB4EI2XPFktp20B16JE2vxi4esR5XfNXcqUCBA5HqY3LGwMpw_r-Lz3Kxs5sFgxDJWsJNwol2lbAUfTEnyexbAghOCdz5cQrYRbu4HbMGraGchOZUlVwI22gkKpWT_z874pdrPIYAmShanAKy0bpA3IG3jgV79cAljguedbamQ/https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Flists.starlingx.io*2Fcgi-bin*2Fmailman*2Flistinfo*2Fstarlingx-discuss__*3B*21*21AjveYdw8EvQ*21e8leCxdSWn7CF5mepfpbV18UcLDSxfeu8JA2iW4ux5kQ7-Dya9uodepzEl_9Pj1QzoD5CDyT3LJdh6si3eZDcLl5VHlseg*24__;JSUlJSUlJSUlJSUlJSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa3RUKtLs$> Thanks for the report. I'll look into it Scott Little
+ Elisa FYI Related to Gerrit Review https://review.opendev.org/c/starlingx/docs/+/851084 Thanks Juanita From: Kumar, Chandan <Chandan.Kumar@commscope.com> Sent: July 27, 2022 9:57 AM To: Waines, Greg <Greg.Waines@windriver.com>; StarlingX ML <starlingx-discuss@lists.starlingx.io>; Little, Scott <Scott.Little@windriver.com> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . [Please note: This e-mail is from an EXTERNAL e-mail address] Hi Scott, I was going through the procedure that you have shared below. Please clarify these two points: * The rpms need to be unpacked, the relevant binaries signed with correct keys, and the rpms reassembled. : The signing server unpacks images like BOOTX64, shim, shimx64 to get rpms, then signs it using `sbsign` and then repack it as original image. Is this understanding correct ? * shim.crt - Certificated embedded within shim used to validate kernel, grub : How is this certificate embedded inside shim image ? I got review notification for launchpad, I had raised but could not find where to add comments so replying to this mail. Regards, Chandan Kumar. From: Waines, Greg <Greg.Waines@windriver.com<mailto:Greg.Waines@windriver.com>> Sent: Wednesday, July 13, 2022 8:14 PM To: StarlingX ML <starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io>> Cc: Kumar, Chandan <Chandan.Kumar@commscope.com<mailto:Chandan.Kumar@commscope.com>> Subject: FW: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . Forwarding …. I think scott meant this for the starlingx discuss list. Greg. From: Little, Scott <Scott.Little@windriver.com<mailto:Scott.Little@windriver.com>> Sent: Wednesday, July 6, 2022 2:37 PM To: Waines, Greg <Greg.Waines@windriver.com<mailto:Greg.Waines@windriver.com>> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . I'll attempt to answer this at a high level. Secure boot signing uses a client/server approach. build-pkgs acts as the client. The server holds the signing scripts and the keys used for signing. The client side code was released to open source as part of StarlingX. The server side code was not released. The interface between client and server is currently undocumented. I'll try to give an overview as best I can. Basically it is a series of ssh/scp calls made into signing server. 'build-pkgs' requires that the following environment variables be defined before it will attempt to request a secure boot signing. export SIGNING_SERVER=<signing-host> export SIGNING_USER=<signing-user> export SIGNING_SERVER_SCRIPT=<path-to-signing-script> 'build-pkgs' further requires that "$USER" == "jenkins", and export FORMAL_BUILD=1 If that is satisfied, it calls into 'sign-secure-boot' 'sign-secure-boot' contains a fairly good set of comments describing what happens next. The client side call sequence looks like this ... # Set up the server side directory for files transfers. UPLOAD_PATH=`ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -r` # upload the original package scp -q $FILE $SIGNING_USER@$SIGNING_SERVER:$UPLOAD_PATH # Request that the package be signed ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -v -i $UPLOAD_PATH/$(basename $FILE) $UNSIGNED_OPTION -t $TYPE > $TMPFILE # Download the file from the signing server DOWNLOAD_FILENAME=$(basename $OUTPUT_FILE) scp -q $SIGNING_USER@$SIGNING_SERVER:$OUTPUT_FILE $(dirname $FILE) Within the signing server there are two keys used for signing, known as the 'boot' key and the 'shim' key. The public half of the 'boot' key must manually added to the secure boot keychain in firmware. The 'boot' key signs first executable loaded, contained in the 'shim' package. The first executable must then install the public half of the shim key (automatically) before passing control to grub, and ultimately the kernel, both of which are signed by the 'shim' key. Three packages need to be passed to the signing server. The rpms need to be unpacked, the relevant binaries signed with correct keys, and the rpms reassembled. package key files to sign ========= ==== =========================== shim boot BOOTX64, shim, shimx64 shim MokManager, fallback, mmx64, fbx64 grub shim grubx64.efi, gcdx64.efi kernel shim vmlinuz NOTE: shim files to sign might include a '.efi' or '.EFI' suffix. Sign those as well. NOTE: some files may be absent in newer packages. It is probably ok if some of the above are missing. Signing looks like this ... sbsign --key $KEYPATH/$KEYNAME.key --cert $KEYPATH/$KEYNAME.crt --output $SIGNEDFILE $UNSIGNEDFILE On keys and certs ... boot.crt - Certificate to boot (to be programmed in firmware) boot.key - Private key with which to sign shim shim.crt - Certificated embedded within shim used to validate kernel, grub shim.key - Private key with which to sign kernel/grub key generation ... openssl req -new -x509 -newkey rsa:2048 -keyout $KEY.key -out $KEY.pem -days 3650 openssl x509 -in $KEY.pem -out $KEY.crt -outform DER Note: boot.crt should be copied to cgcs-root/build-tools/certificates/TiBoot.crt for inclusion during the 'build-iso' step Hope this helps Scott On 2022-07-05 03:19, Kumar, Chandan wrote: [Please note: This e-mail is from an EXTERNAL e-mail address] Hi Greg, Thanks for acknowledgement. I have raised starlingx launchpad for document update. Meanwhile it would be really great if you can share the steps which has to be done to integrate signing of images as part of StarlingX build infrastructure. Regards, Chandan Kumar. From: Waines, Greg <Greg.Waines@windriver.com><mailto:Greg.Waines@windriver.com> Sent: Monday, July 4, 2022 6:00 PM To: starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io> Cc: Little, Scott <Scott.Little@windriver.com><mailto:Scott.Little@windriver.com> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . Hey Chandan, Thanks for bringing this up. I chatted with Scott about this. Currently the StarlingX public builds on CENGN are not building a secure boot capable load … i.e. signing the appropriate items to enable secure boot. Although the StarlingX build infrastructure allows it to be added. Neither of these points are properly documented in docs.starlingx.io ☹ I can’t remember the details of why we are not doing this. I am guessing that the thinking was that a user of StarlingX that wanted to use UEFI Secure Boot, would want to sign with his own private key. Can you raise a starlingx launchpad ( https://launchpad.net/starlingx<https://urldefense.com/v3/__https:/secure-web.cisco.com/1mVLF-b4c-tBpQaEbNZbIeg5wuI2Sgdw11Kg2fRT9qRF2wo07vvRq040DIA0_Wsi3D4gtikjd41f-NbhgDr0WtPQQBHE441l65nwt6p00kAsBdGTNHMs0SRRp5xooNafH_Whk-Dm4t5akvM7v59ubFU1OqnyVm_DWXmTRsjlP7iavYNBqohwIkDwu5U_0bdpFU4p4YPP0Lf9wDBMltx2noOl9B-SkedaJ-aS-ZXVVTe6xH6VLXYIALMIH-dnrPQ7c4Gq8UZlj5vmUSNdnMlN2-alEns4KcCDiDF4IpogwjWO9-Bzcr272kWadoiBLaMmvU4L7OKnYa3EnFa8xAAyVJA/https*3A*2F*2Flaunchpad.net*2Fstarlingx__;JSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFaFWk0Ya8$> ) to address the docs.starlingx.io<https://urldefense.com/v3/__http:/docs.starlingx.io__;!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa1r3VAOU$> documentation issue, i.e. to indicate that the StarlingX CENGN builds are not signed to support uefi secure boot, and describe how a starlingx user could add signing to their StarlingX build environment in order to sign for uefi secure boot with their own private key ? Greg. From: Scott Little <scott.little@windriver.com<mailto:scott.little@windriver.com>> Sent: Wednesday, June 29, 2022 10:42 AM To: starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . On 2022-06-02 13:12, Kumar, Chandan wrote: [Please note: This e-mail is from an EXTERNAL e-mail address] Hi, I am trying to validate signed starlingX 5.0 iso on a secureboot enabled setup against public key(TiBoot.crt) embedded inside iso. After rebooting , operating system is not coming up with error screen saying “Verification failed: (0X1A) Security Violation”. However, when I signed images with self-generated private key and validated against corresponding public key, system is able to boot up successfully. Signing is done after flashing the iso on a server. Please find attached procedure for signing images inside iso. I believe, the public key provided with iso is not correct. Can you please confirm ? Regards, Chandan Kumar. _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io<mailto:Starlingx-discuss@lists.starlingx.io> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss<https://urldefense.com/v3/__https:/secure-web.cisco.com/1-KIhdgnDGw2i_w1bSfhcdQdJ0gtuSiGAoU-ggPInTuBelT92KbXPGwz89fztx-5CLsTQfshXKTc3aaqqJ-Mq4BnErMA5jCPj57X8BHou8RtYoI0fF-kIFVYYVX9qbmwnPrfape21hfY5wqnypwaoc7s_IL-RIFlZBKWMVC32JZy9GB4EI2XPFktp20B16JE2vxi4esR5XfNXcqUCBA5HqY3LGwMpw_r-Lz3Kxs5sFgxDJWsJNwol2lbAUfTEnyexbAghOCdz5cQrYRbu4HbMGraGchOZUlVwI22gkKpWT_z874pdrPIYAmShanAKy0bpA3IG3jgV79cAljguedbamQ/https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Flists.starlingx.io*2Fcgi-bin*2Fmailman*2Flistinfo*2Fstarlingx-discuss__*3B*21*21AjveYdw8EvQ*21e8leCxdSWn7CF5mepfpbV18UcLDSxfeu8JA2iW4ux5kQ7-Dya9uodepzEl_9Pj1QzoD5CDyT3LJdh6si3eZDcLl5VHlseg*24__;JSUlJSUlJSUlJSUlJSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa3RUKtLs$> Thanks for the report. I'll look into it Scott Little
Hi Scott, Can you review the update https://review.opendev.org/c/starlingx/docs/+/851084 requested by Chandan Kumar? Chandan has a few questions, so as soon as you review it, I can address those and close the update. Thanks! Elisa. ________________________________ From: Balaraj, Juanita <Juanita.Balaraj@windriver.com> Sent: Wednesday, July 27, 2022 4:43 PM To: Kumar, Chandan <Chandan.Kumar@commscope.com>; Waines, Greg <Greg.Waines@windriver.com>; StarlingX ML <starlingx-discuss@lists.starlingx.io>; Little, Scott <Scott.Little@windriver.com> Cc: Goncalves, Elisamara Aoki <ElisamaraAoki.Goncalves@windriver.com> Subject: RE: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . + Elisa FYI Related to Gerrit Review https://review.opendev.org/c/starlingx/docs/+/851084 Thanks Juanita From: Kumar, Chandan <Chandan.Kumar@commscope.com> Sent: July 27, 2022 9:57 AM To: Waines, Greg <Greg.Waines@windriver.com>; StarlingX ML <starlingx-discuss@lists.starlingx.io>; Little, Scott <Scott.Little@windriver.com> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . [Please note: This e-mail is from an EXTERNAL e-mail address] Hi Scott, I was going through the procedure that you have shared below. Please clarify these two points: * The rpms need to be unpacked, the relevant binaries signed with correct keys, and the rpms reassembled. : The signing server unpacks images like BOOTX64, shim, shimx64 to get rpms, then signs it using `sbsign` and then repack it as original image. Is this understanding correct ? * shim.crt - Certificated embedded within shim used to validate kernel, grub : How is this certificate embedded inside shim image ? I got review notification for launchpad, I had raised but could not find where to add comments so replying to this mail. Regards, Chandan Kumar. From: Waines, Greg <Greg.Waines@windriver.com<mailto:Greg.Waines@windriver.com>> Sent: Wednesday, July 13, 2022 8:14 PM To: StarlingX ML <starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io>> Cc: Kumar, Chandan <Chandan.Kumar@commscope.com<mailto:Chandan.Kumar@commscope.com>> Subject: FW: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . Forwarding …. I think scott meant this for the starlingx discuss list. Greg. From: Little, Scott <Scott.Little@windriver.com<mailto:Scott.Little@windriver.com>> Sent: Wednesday, July 6, 2022 2:37 PM To: Waines, Greg <Greg.Waines@windriver.com<mailto:Greg.Waines@windriver.com>> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . I'll attempt to answer this at a high level. Secure boot signing uses a client/server approach. build-pkgs acts as the client. The server holds the signing scripts and the keys used for signing. The client side code was released to open source as part of StarlingX. The server side code was not released. The interface between client and server is currently undocumented. I'll try to give an overview as best I can. Basically it is a series of ssh/scp calls made into signing server. 'build-pkgs' requires that the following environment variables be defined before it will attempt to request a secure boot signing. export SIGNING_SERVER=<signing-host> export SIGNING_USER=<signing-user> export SIGNING_SERVER_SCRIPT=<path-to-signing-script> 'build-pkgs' further requires that "$USER" == "jenkins", and export FORMAL_BUILD=1 If that is satisfied, it calls into 'sign-secure-boot' 'sign-secure-boot' contains a fairly good set of comments describing what happens next. The client side call sequence looks like this ... # Set up the server side directory for files transfers. UPLOAD_PATH=`ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -r` # upload the original package scp -q $FILE $SIGNING_USER@$SIGNING_SERVER:$UPLOAD_PATH # Request that the package be signed ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -v -i $UPLOAD_PATH/$(basename $FILE) $UNSIGNED_OPTION -t $TYPE > $TMPFILE # Download the file from the signing server DOWNLOAD_FILENAME=$(basename $OUTPUT_FILE) scp -q $SIGNING_USER@$SIGNING_SERVER:$OUTPUT_FILE $(dirname $FILE) Within the signing server there are two keys used for signing, known as the 'boot' key and the 'shim' key. The public half of the 'boot' key must manually added to the secure boot keychain in firmware. The 'boot' key signs first executable loaded, contained in the 'shim' package. The first executable must then install the public half of the shim key (automatically) before passing control to grub, and ultimately the kernel, both of which are signed by the 'shim' key. Three packages need to be passed to the signing server. The rpms need to be unpacked, the relevant binaries signed with correct keys, and the rpms reassembled. package key files to sign ========= ==== =========================== shim boot BOOTX64, shim, shimx64 shim MokManager, fallback, mmx64, fbx64 grub shim grubx64.efi, gcdx64.efi kernel shim vmlinuz NOTE: shim files to sign might include a '.efi' or '.EFI' suffix. Sign those as well. NOTE: some files may be absent in newer packages. It is probably ok if some of the above are missing. Signing looks like this ... sbsign --key $KEYPATH/$KEYNAME.key --cert $KEYPATH/$KEYNAME.crt --output $SIGNEDFILE $UNSIGNEDFILE On keys and certs ... boot.crt - Certificate to boot (to be programmed in firmware) boot.key - Private key with which to sign shim shim.crt - Certificated embedded within shim used to validate kernel, grub shim.key - Private key with which to sign kernel/grub key generation ... openssl req -new -x509 -newkey rsa:2048 -keyout $KEY.key -out $KEY.pem -days 3650 openssl x509 -in $KEY.pem -out $KEY.crt -outform DER Note: boot.crt should be copied to cgcs-root/build-tools/certificates/TiBoot.crt for inclusion during the 'build-iso' step Hope this helps Scott On 2022-07-05 03:19, Kumar, Chandan wrote: [Please note: This e-mail is from an EXTERNAL e-mail address] Hi Greg, Thanks for acknowledgement. I have raised starlingx launchpad for document update. Meanwhile it would be really great if you can share the steps which has to be done to integrate signing of images as part of StarlingX build infrastructure. Regards, Chandan Kumar. From: Waines, Greg <Greg.Waines@windriver.com><mailto:Greg.Waines@windriver.com> Sent: Monday, July 4, 2022 6:00 PM To: starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io> Cc: Little, Scott <Scott.Little@windriver.com><mailto:Scott.Little@windriver.com> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . Hey Chandan, Thanks for bringing this up. I chatted with Scott about this. Currently the StarlingX public builds on CENGN are not building a secure boot capable load … i.e. signing the appropriate items to enable secure boot. Although the StarlingX build infrastructure allows it to be added. Neither of these points are properly documented in docs.starlingx.io ☹ I can’t remember the details of why we are not doing this. I am guessing that the thinking was that a user of StarlingX that wanted to use UEFI Secure Boot, would want to sign with his own private key. Can you raise a starlingx launchpad ( https://launchpad.net/starlingx<https://urldefense.com/v3/__https:/secure-web.cisco.com/1mVLF-b4c-tBpQaEbNZbIeg5wuI2Sgdw11Kg2fRT9qRF2wo07vvRq040DIA0_Wsi3D4gtikjd41f-NbhgDr0WtPQQBHE441l65nwt6p00kAsBdGTNHMs0SRRp5xooNafH_Whk-Dm4t5akvM7v59ubFU1OqnyVm_DWXmTRsjlP7iavYNBqohwIkDwu5U_0bdpFU4p4YPP0Lf9wDBMltx2noOl9B-SkedaJ-aS-ZXVVTe6xH6VLXYIALMIH-dnrPQ7c4Gq8UZlj5vmUSNdnMlN2-alEns4KcCDiDF4IpogwjWO9-Bzcr272kWadoiBLaMmvU4L7OKnYa3EnFa8xAAyVJA/https*3A*2F*2Flaunchpad.net*2Fstarlingx__;JSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFaFWk0Ya8$> ) to address the docs.starlingx.io<https://urldefense.com/v3/__http:/docs.starlingx.io__;!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa1r3VAOU$> documentation issue, i.e. to indicate that the StarlingX CENGN builds are not signed to support uefi secure boot, and describe how a starlingx user could add signing to their StarlingX build environment in order to sign for uefi secure boot with their own private key ? Greg. From: Scott Little <scott.little@windriver.com<mailto:scott.little@windriver.com>> Sent: Wednesday, June 29, 2022 10:42 AM To: starlingx-discuss@lists.starlingx.io<mailto:starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso . On 2022-06-02 13:12, Kumar, Chandan wrote: [Please note: This e-mail is from an EXTERNAL e-mail address] Hi, I am trying to validate signed starlingX 5.0 iso on a secureboot enabled setup against public key(TiBoot.crt) embedded inside iso. After rebooting , operating system is not coming up with error screen saying “Verification failed: (0X1A) Security Violation”. However, when I signed images with self-generated private key and validated against corresponding public key, system is able to boot up successfully. Signing is done after flashing the iso on a server. Please find attached procedure for signing images inside iso. I believe, the public key provided with iso is not correct. Can you please confirm ? Regards, Chandan Kumar. _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io<mailto:Starlingx-discuss@lists.starlingx.io> http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss<https://urldefense.com/v3/__https:/secure-web.cisco.com/1-KIhdgnDGw2i_w1bSfhcdQdJ0gtuSiGAoU-ggPInTuBelT92KbXPGwz89fztx-5CLsTQfshXKTc3aaqqJ-Mq4BnErMA5jCPj57X8BHou8RtYoI0fF-kIFVYYVX9qbmwnPrfape21hfY5wqnypwaoc7s_IL-RIFlZBKWMVC32JZy9GB4EI2XPFktp20B16JE2vxi4esR5XfNXcqUCBA5HqY3LGwMpw_r-Lz3Kxs5sFgxDJWsJNwol2lbAUfTEnyexbAghOCdz5cQrYRbu4HbMGraGchOZUlVwI22gkKpWT_z874pdrPIYAmShanAKy0bpA3IG3jgV79cAljguedbamQ/https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Flists.starlingx.io*2Fcgi-bin*2Fmailman*2Flistinfo*2Fstarlingx-discuss__*3B*21*21AjveYdw8EvQ*21e8leCxdSWn7CF5mepfpbV18UcLDSxfeu8JA2iW4ux5kQ7-Dya9uodepzEl_9Pj1QzoD5CDyT3LJdh6si3eZDcLl5VHlseg*24__;JSUlJSUlJSUlJSUlJSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa3RUKtLs$> Thanks for the report. I'll look into it Scott Little
I think you read it backwards. I'll try again (inline below) Scott On 2022-07-27 09:57, Kumar, Chandan wrote:
**[Please note: This e-mail is from an EXTERNAL e-mail address]
Hi Scott,
I was going through the procedure that you have shared below. Please clarify these two points:
* The rpms need to be unpacked, the relevant binaries signed with correct keys, and the rpms reassembled. : The signing server unpacks images like BOOTX64, shim, shimx64 to get rpms, then signs it using `sbsign` and then repack it as original image. Is this understanding correct ?
It unpacks RPM: shim*rpm It looks for files matching: BOOTX64*, shim*, shimx64*, which it signs with the 'boot' key; and MokManager*, fallback*, mmx64*, fbx64* , which it signs with the 'shim' key Note: * above should be one of .efi or .EFI Finally it repack the shim RPM file. Repeat per the below table for the other RPMS.
* * shim.crt - Certificated embedded within shim used to validate kernel, grub : How is this certificate embedded inside shim image ?
I got review notification for launchpad, I had raised but could not find where to add comments so replying to this mail.
Regards,
Chandan Kumar.
*From:* Waines, Greg <Greg.Waines@windriver.com> *Sent:* Wednesday, July 13, 2022 8:14 PM *To:* StarlingX ML <starlingx-discuss@lists.starlingx.io> *Cc:* Kumar, Chandan <Chandan.Kumar@commscope.com> *Subject:* FW: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .
Forwarding ….
I think scott meant this for the starlingx discuss list.
Greg.
*From:* Little, Scott <Scott.Little@windriver.com> *Sent:* Wednesday, July 6, 2022 2:37 PM *To:* Waines, Greg <Greg.Waines@windriver.com> *Subject:* Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .
I'll attempt to answer this at a high level.
Secure boot signing uses a client/server approach. build-pkgs acts as the client. The server holds the signing scripts and the keys used for signing.
The client side code was released to open source as part of StarlingX. The server side code was not released.
The interface between client and server is currently undocumented. I'll try to give an overview as best I can. Basically it is a series of ssh/scp calls made into signing server.
'build-pkgs' requires that the following environment variables be defined before it will attempt to request a secure boot signing.
export SIGNING_SERVER=<signing-host> export SIGNING_USER=<signing-user>
export SIGNING_SERVER_SCRIPT=<path-to-signing-script>
'build-pkgs' further requires that "$USER" == "jenkins", and
export FORMAL_BUILD=1
If that is satisfied, it calls into 'sign-secure-boot'
'sign-secure-boot' contains a fairly good set of comments describing what happens next.
The client side call sequence looks like this ...
# Set up the server side directory for files transfers. UPLOAD_PATH=`ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -r`
# upload the original package scp -q $FILE $SIGNING_USER@$SIGNING_SERVER:$UPLOAD_PATH <#REDACTED>
# Request that the package be signed ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -v -i $UPLOAD_PATH/$(basename $FILE) $UNSIGNED_OPTION -t $TYPE > $TMPFILE
# Download the file from the signing server DOWNLOAD_FILENAME=$(basename $OUTPUT_FILE) scp -q $SIGNING_USER@$SIGNING_SERVER:$OUTPUT_FILE <#REDACTED> $(dirname $FILE)
Within the signing server there are two keys used for signing, known as the 'boot' key and the 'shim' key. The public half of the 'boot' key must manually added to the secure boot keychain in firmware. The 'boot' key signs first executable loaded, contained in the 'shim' package. The first executable must then install the public half of the shim key (automatically) before passing control to grub, and ultimately the kernel, both of which are signed by the 'shim' key.
Three packages need to be passed to the signing server. The rpms need to be unpacked, the relevant binaries signed with correct keys, and the rpms reassembled.
package key files to sign ========= ==== =========================== shim boot BOOTX64, shim, shimx64 shim MokManager, fallback, mmx64, fbx64 grub shim grubx64.efi, gcdx64.efi kernel shim vmlinuz
NOTE: shim files to sign might include a '.efi' or '.EFI' suffix. Sign those as well.
NOTE: some files may be absent in newer packages. It is probably ok if some of the above are missing.
Signing looks like this ...
sbsign --key $KEYPATH/$KEYNAME.key --cert $KEYPATH/$KEYNAME.crt --output $SIGNEDFILE $UNSIGNEDFILE
On keys and certs ...
boot.crt - Certificate to boot (to be programmed in firmware) boot.key - Private key with which to sign shim shim.crt - Certificated embedded within shim used to validate kernel, grub shim.key - Private key with which to sign kernel/grub
key generation ...
|openssl req -new -x509 -newkey |rsa:2048 <#REDACTED>|-keyout $KEY.key -out $KEY.pem -days 3650|
|openssl x509 -in $KEY.pem -out $KEY.crt -outform DER|
Note: boot.crt should be copied to cgcs-root/build-tools/certificates/TiBoot.crt for inclusion during the 'build-iso' step
Hope this helps
Scott
On 2022-07-05 03:19, Kumar, Chandan wrote:
[Please note: This e-mail is from an EXTERNAL e-mail address]
Hi Greg,
Thanks for acknowledgement.
I have raised starlingx launchpad for document update. Meanwhile it would be really great if you can share the steps which has to be done to integrate signing of images as part of StarlingX build infrastructure.
Regards,
Chandan Kumar.
*From:* Waines, Greg <Greg.Waines@windriver.com> <mailto:Greg.Waines@windriver.com> *Sent:* Monday, July 4, 2022 6:00 PM *To:* starlingx-discuss@lists.starlingx.io *Cc:* Little, Scott <Scott.Little@windriver.com> <mailto:Scott.Little@windriver.com> *Subject:* Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .
Hey Chandan,
Thanks for bringing this up.
I chatted with Scott about this.
Currently the StarlingX public builds on CENGN are not building a secure boot capable load … i.e. signing the appropriate items to enable secure boot. Although the StarlingX build infrastructure allows it to be added.
Neither of these points are properly documented in docs.starlingx.io ☹
I can’t remember the details of why we are not doing this.
I am guessing that the thinking was that a user of StarlingX that wanted to use UEFI Secure Boot, would want to sign with his own private key.
Can you raise a starlingx launchpad ( https://launchpad.net/starlingx <https://urldefense.com/v3/__https:/secure-web.cisco.com/1mVLF-b4c-tBpQaEbNZbIeg5wuI2Sgdw11Kg2fRT9qRF2wo07vvRq040DIA0_Wsi3D4gtikjd41f-NbhgDr0WtPQQBHE441l65nwt6p00kAsBdGTNHMs0SRRp5xooNafH_Whk-Dm4t5akvM7v59ubFU1OqnyVm_DWXmTRsjlP7iavYNBqohwIkDwu5U_0bdpFU4p4YPP0Lf9wDBMltx2noOl9B-SkedaJ-aS-ZXVVTe6xH6VLXYIALMIH-dnrPQ7c4Gq8UZlj5vmUSNdnMlN2-alEns4KcCDiDF4IpogwjWO9-Bzcr272kWadoiBLaMmvU4L7OKnYa3EnFa8xAAyVJA/https*3A*2F*2Flaunchpad.net*2Fstarlingx__;JSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFaFWk0Ya8$> ) to address the docs.starlingx.io <https://urldefense.com/v3/__http:/docs.starlingx.io__;!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa1r3VAOU$> documentation issue, i.e. to indicate that the StarlingX CENGN builds are not signed to support uefi secure boot, and describe how a starlingx user could add signing to their StarlingX build environment in order to sign for uefi secure boot with their own private key ?
Greg.
*From:* Scott Little <scott.little@windriver.com> *Sent:* Wednesday, June 29, 2022 10:42 AM *To:* starlingx-discuss@lists.starlingx.io *Subject:* Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .
On 2022-06-02 13:12, Kumar, Chandan wrote:
[Please note: This e-mail is from an EXTERNAL e-mail address]
Hi,
I am trying to validate signed starlingX 5.0 iso on a secureboot enabled setup against public key(TiBoot.crt) embedded inside iso. After rebooting , operating system is not coming up with error screen saying “Verification failed: (0X1A) Security Violation”.
However, when I signed images with self-generated private key and validated against corresponding public key, system is able to boot up successfully. Signing is done after flashing the iso on a server. Please find attached procedure for signing images inside iso.
I believe, the public key provided with iso is not correct. Can you please confirm ?
Regards,
Chandan Kumar.
_______________________________________________
Starlingx-discuss mailing list
Starlingx-discuss@lists.starlingx.io
http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss <https://urldefense.com/v3/__https:/secure-web.cisco.com/1-KIhdgnDGw2i_w1bSfhcdQdJ0gtuSiGAoU-ggPInTuBelT92KbXPGwz89fztx-5CLsTQfshXKTc3aaqqJ-Mq4BnErMA5jCPj57X8BHou8RtYoI0fF-kIFVYYVX9qbmwnPrfape21hfY5wqnypwaoc7s_IL-RIFlZBKWMVC32JZy9GB4EI2XPFktp20B16JE2vxi4esR5XfNXcqUCBA5HqY3LGwMpw_r-Lz3Kxs5sFgxDJWsJNwol2lbAUfTEnyexbAghOCdz5cQrYRbu4HbMGraGchOZUlVwI22gkKpWT_z874pdrPIYAmShanAKy0bpA3IG3jgV79cAljguedbamQ/https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Flists.starlingx.io*2Fcgi-bin*2Fmailman*2Flistinfo*2Fstarlingx-discuss__*3B*21*21AjveYdw8EvQ*21e8leCxdSWn7CF5mepfpbV18UcLDSxfeu8JA2iW4ux5kQ7-Dya9uodepzEl_9Pj1QzoD5CDyT3LJdh6si3eZDcLl5VHlseg*24__;JSUlJSUlJSUlJSUlJSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa3RUKtLs$>
Thanks for the report. I'll look into it
Scott Little
On 2022-07-27 09:57, Kumar, Chandan wrote:
shim.crt - Certificated embedded within shim used to validate kernel, grub : How is this certificate embedded inside shim image ?
shim.crt is created as part of the build process for the 'shim' package. Refer to stx/integ/security/shim-unsigned/centos/patches/0001-Use-Titanium-certificate.patch
participants (5)
-
Balaraj, Juanita
-
Goncalves, Elisamara Aoki
-
Kumar, Chandan
-
Scott Little
-
Waines, Greg