<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI Emoji";
panose-1:2 11 5 2 4 2 4 2 2 3;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
code
{mso-style-priority:99;
font-family:"Courier New";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle27
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1209343902;
mso-list-template-ids:1674238672;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1
{mso-list-id:1276907346;
mso-list-type:hybrid;
mso-list-template-ids:-412062154 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-CA" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">+ Elisa<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">FYI<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Related to Gerrit Review
<a href="https://review.opendev.org/c/starlingx/docs/+/851084">https://review.opendev.org/c/starlingx/docs/+/851084</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thanks<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Juanita<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Kumar, Chandan <Chandan.Kumar@commscope.com>
<br>
<b>Sent:</b> July 27, 2022 9:57 AM<br>
<b>To:</b> Waines, Greg <Greg.Waines@windriver.com>; StarlingX ML <starlingx-discuss@lists.starlingx.io>; Little, Scott <Scott.Little@windriver.com><br>
<b>Subject:</b> Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FFEB9C"><span lang="EN-US" style="font-size:10.0pt;color:red">[Please note: This e-mail is from an EXTERNAL e-mail address]<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi Scott,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I was going through the procedure that you have shared below. Please clarify these two points:
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level1 lfo3"><span lang="EN-US" style="background:yellow;mso-highlight:yellow">The rpms need to be unpacked, the relevant binaries signed with correct keys, and the rpms reassembled. : </span><span lang="EN-US">The
signing server unpacks images like BOOTX64, shim, shimx64 to get rpms, then signs it using `sbsign` and then repack it as original image. Is this understanding correct ?<span style="background:yellow;mso-highlight:yellow"><o:p></o:p></span></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level1 lfo3"><span lang="EN-US" style="background:yellow;mso-highlight:yellow">shim.crt - Certificated embedded within shim used to validate kernel, grub
</span><span lang="EN-US">: How is this certificate embedded inside shim image ? <span style="background:yellow;mso-highlight:yellow">
<o:p></o:p></span></span></li></ul>
<p class="MsoNormal"><span lang="EN-US" style="background:yellow;mso-highlight:yellow"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I got review notification for launchpad, I had raised but could not find where to add comments so replying to this mail.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Chandan Kumar.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Waines, Greg <<a href="mailto:Greg.Waines@windriver.com">Greg.Waines@windriver.com</a>>
<br>
<b>Sent:</b> Wednesday, July 13, 2022 8:14 PM<br>
<b>To:</b> StarlingX ML <<a href="mailto:starlingx-discuss@lists.starlingx.io">starlingx-discuss@lists.starlingx.io</a>><br>
<b>Cc:</b> Kumar, Chandan <<a href="mailto:Chandan.Kumar@commscope.com">Chandan.Kumar@commscope.com</a>><br>
<b>Subject:</b> FW: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US">Forwarding ….<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I think scott meant this for the starlingx discuss list.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Greg.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Little, Scott <<a href="mailto:Scott.Little@windriver.com">Scott.Little@windriver.com</a>>
<br>
<b>Sent:</b> Wednesday, July 6, 2022 2:37 PM<br>
<b>To:</b> Waines, Greg <<a href="mailto:Greg.Waines@windriver.com">Greg.Waines@windriver.com</a>><br>
<b>Subject:</b> Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">I'll attempt to answer this at a high level.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Secure boot signing uses a client/server approach. build-pkgs acts as the client. The server holds the signing scripts and the keys used for signing.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">The client side code was released to open source as part of StarlingX. The server side code was not released.
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">The interface between client and server is currently undocumented. I'll try to give an overview as best I can. Basically it is a series of ssh/scp calls made into signing server.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">'build-pkgs' requires that the following environment variables be defined before it will attempt to request a secure boot signing.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">export SIGNING_SERVER=<signing-host><br>
export SIGNING_USER=<signing-user><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">export SIGNING_SERVER_SCRIPT=<path-to-signing-script><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">'build-pkgs' further requires that "$USER" == "jenkins", and<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">export FORMAL_BUILD=1<o:p></o:p></span></p>
</div>
<p><span lang="EN-US">If that is satisfied, it calls into 'sign-secure-boot'<o:p></o:p></span></p>
<p><span lang="EN-US">'sign-secure-boot' contains a fairly good set of comments describing what happens next.<o:p></o:p></span></p>
<p><span lang="EN-US">The client side call sequence looks like this ...<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> # Set up the server side directory for files transfers.<br>
UPLOAD_PATH=`ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -r` <o:p>
</o:p></span></p>
<p><span lang="EN-US"> # upload the original package<br>
scp -q $FILE $SIGNING_USER@$SIGNING_<a href="#REDACTED">SERVER:$UPLOAD_PATH</a><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> # Request that the package be signed<br>
ssh $SIGNING_USER@$SIGNING_SERVER sudo $SIGNING_SCRIPT -v -i $UPLOAD_PATH/$(basename $FILE) $UNSIGNED_OPTION -t $TYPE > $TMPFILE<o:p></o:p></span></p>
<p><span lang="EN-US"> # Download the file from the signing server<br>
DOWNLOAD_FILENAME=$(basename $OUTPUT_FILE)<br>
scp -q $SIGNING_USER@$SIGNING_<a href="#REDACTED">SERVER:$OUTPUT_FILE</a> $(dirname $FILE)<o:p></o:p></span></p>
<p><span lang="EN-US">Within the signing server there are two keys used for signing, known as the 'boot' key and the 'shim' key. The public half of the 'boot' key must manually added to the secure boot keychain in firmware. The 'boot' key signs first executable
loaded, contained in the 'shim' package. The first executable must then install the public half of the shim key (automatically) before passing control to grub, and ultimately the kernel, both of which are signed by the 'shim' key.<o:p></o:p></span></p>
<p><span lang="EN-US">Three packages need to be passed to the signing server. The rpms need to be unpacked, the relevant binaries signed with correct keys, and the rpms reassembled.<o:p></o:p></span></p>
<pre><span lang="EN-US"><o:p> </o:p></span></pre>
<pre><span lang="EN-US">package key files to sign<o:p></o:p></span></pre>
<pre><span lang="EN-US">========= ==== ===========================<o:p></o:p></span></pre>
<pre><span lang="EN-US">shim boot BOOTX64, shim, shimx64<o:p></o:p></span></pre>
<pre><span lang="EN-US"> shim MokManager, fallback, mmx64, fbx64<o:p></o:p></span></pre>
<pre><span lang="EN-US">grub shim grubx64.efi, gcdx64.efi<o:p></o:p></span></pre>
<pre><span lang="EN-US">kernel shim vmlinuz<o:p></o:p></span></pre>
<p><span lang="EN-US">NOTE: shim files to sign might include a '.efi' or '.EFI' suffix. Sign those as well.<o:p></o:p></span></p>
<p><span lang="EN-US">NOTE: some files may be absent in newer packages. It is probably ok if some of the above are missing.<o:p></o:p></span></p>
<p><span lang="EN-US"><o:p> </o:p></span></p>
<p><span lang="EN-US">Signing looks like this ...<o:p></o:p></span></p>
<p style="margin-bottom:12.0pt"><span lang="EN-US"> sbsign --key $KEYPATH/$KEYNAME.key --cert $KEYPATH/$KEYNAME.crt --output $SIGNEDFILE $UNSIGNEDFILE<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">On keys and certs ...<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> boot.crt - Certificate to boot (to be programmed in firmware)<br>
boot.key - Private key with which to sign shim<br>
shim.crt - Certificated embedded within shim used to validate kernel, grub<br>
shim.key - Private key with which to sign kernel/grub<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">key generation ...<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><code><span lang="EN-US" style="font-size:10.0pt"> openssl req -new -x509 -newkey
</span></code><span lang="EN-US"><a href="#REDACTED"><span style="font-size:10.0pt;font-family:"Courier New"">rsa:2048</span></a></span><code><span lang="EN-US" style="font-size:10.0pt"> -keyout $KEY.key -out $KEY.pem -days 3650</span></code><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><code><span lang="EN-US" style="font-size:10.0pt"> openssl x509 -in $KEY.pem -out $KEY.crt -outform DER</span></code><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Note: boot.crt should be copied to cgcs-root/build-tools/certificates/TiBoot.crt for inclusion during the 'build-iso' step<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hope this helps<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Scott<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">On 2022-07-05 03:19, Kumar, Chandan wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div style="border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FFEB9C"><span lang="EN-US" style="font-size:10.0pt;color:red">[Please note: This e-mail is from an EXTERNAL e-mail address]</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi Greg,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks for acknowledgement.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I have raised starlingx launchpad for document update. Meanwhile it would be really great if you can share the steps which has to be done to integrate signing of images as part of StarlingX build infrastructure.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Chandan Kumar.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Waines, Greg
<a href="mailto:Greg.Waines@windriver.com"><Greg.Waines@windriver.com></a> <br>
<b>Sent:</b> Monday, July 4, 2022 6:00 PM<br>
<b>To:</b> <a href="mailto:starlingx-discuss@lists.starlingx.io">starlingx-discuss@lists.starlingx.io</a><br>
<b>Cc:</b> Little, Scott <a href="mailto:Scott.Little@windriver.com"><Scott.Little@windriver.com></a><br>
<b>Subject:</b> Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US">Hey Chandan,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Thanks for bringing this up.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I chatted with Scott about this.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Currently the StarlingX public builds on CENGN are not building a secure boot capable load … i.e. signing the appropriate items to enable secure boot. Although the StarlingX build infrastructure allows it to be added.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Neither of these points are properly documented in docs.starlingx.io
</span><span lang="EN-US" style="font-family:"Segoe UI Emoji",sans-serif">☹</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I can’t remember the details of why we are not doing this.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I am guessing that the thinking was that a user of StarlingX that wanted to use UEFI Secure Boot, would want to sign with his own private key.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Can you raise a starlingx launchpad ( <a href="https://urldefense.com/v3/__https:/secure-web.cisco.com/1mVLF-b4c-tBpQaEbNZbIeg5wuI2Sgdw11Kg2fRT9qRF2wo07vvRq040DIA0_Wsi3D4gtikjd41f-NbhgDr0WtPQQBHE441l65nwt6p00kAsBdGTNHMs0SRRp5xooNafH_Whk-Dm4t5akvM7v59ubFU1OqnyVm_DWXmTRsjlP7iavYNBqohwIkDwu5U_0bdpFU4p4YPP0Lf9wDBMltx2noOl9B-SkedaJ-aS-ZXVVTe6xH6VLXYIALMIH-dnrPQ7c4Gq8UZlj5vmUSNdnMlN2-alEns4KcCDiDF4IpogwjWO9-Bzcr272kWadoiBLaMmvU4L7OKnYa3EnFa8xAAyVJA/https*3A*2F*2Flaunchpad.net*2Fstarlingx__;JSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFaFWk0Ya8$">
https://launchpad.net/starlingx</a> ) to address the <a href="https://urldefense.com/v3/__http:/docs.starlingx.io__;!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa1r3VAOU$">
docs.starlingx.io</a> documentation issue, i.e. to indicate that the StarlingX CENGN builds are not signed to support uefi secure boot, and describe how a starlingx user could add signing to their StarlingX build environment in order to sign for uefi secure
boot with their own private key ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Greg.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Scott Little <<a href="mailto:scott.little@windriver.com">scott.little@windriver.com</a>>
<br>
<b>Sent:</b> Wednesday, June 29, 2022 10:42 AM<br>
<b>To:</b> <a href="mailto:starlingx-discuss@lists.starlingx.io">starlingx-discuss@lists.starlingx.io</a><br>
<b>Subject:</b> Re: [Starlingx-discuss] Incorrect public key for signed starlingX 5.0 iso .<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">On 2022-06-02 13:12, Kumar, Chandan wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div style="border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FFEB9C"><span lang="EN-US" style="font-size:10.0pt;color:red">[Please note: This e-mail is from an EXTERNAL e-mail address]</span><span lang="EN-US"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Hi, <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I am trying to validate signed starlingX 5.0 iso on a secureboot enabled setup against public key(TiBoot.crt) embedded inside iso. After rebooting , operating system is not coming up with error screen saying
<span style="background:red;mso-highlight:red">“Verification failed: (0X1A) Security Violation</span>”.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">However, when I signed images with self-generated private key and validated against corresponding public key, system is able to boot up successfully. Signing is done after flashing the iso on a server. Please find attached
procedure for signing images inside iso.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">I believe, the public key provided with iso is not correct. Can you please confirm ?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"> <o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Chandan Kumar. <o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US"> <o:p></o:p></span></p>
<pre><span lang="EN-US">_______________________________________________<o:p></o:p></span></pre>
<pre><span lang="EN-US">Starlingx-discuss mailing list<o:p></o:p></span></pre>
<pre><span lang="EN-US"><a href="mailto:Starlingx-discuss@lists.starlingx.io">Starlingx-discuss@lists.starlingx.io</a><o:p></o:p></span></pre>
<pre><span lang="EN-US"><a href="https://urldefense.com/v3/__https:/secure-web.cisco.com/1-KIhdgnDGw2i_w1bSfhcdQdJ0gtuSiGAoU-ggPInTuBelT92KbXPGwz89fztx-5CLsTQfshXKTc3aaqqJ-Mq4BnErMA5jCPj57X8BHou8RtYoI0fF-kIFVYYVX9qbmwnPrfape21hfY5wqnypwaoc7s_IL-RIFlZBKWMVC32JZy9GB4EI2XPFktp20B16JE2vxi4esR5XfNXcqUCBA5HqY3LGwMpw_r-Lz3Kxs5sFgxDJWsJNwol2lbAUfTEnyexbAghOCdz5cQrYRbu4HbMGraGchOZUlVwI22gkKpWT_z874pdrPIYAmShanAKy0bpA3IG3jgV79cAljguedbamQ/https*3A*2F*2Furldefense.com*2Fv3*2F__http*3A*2Flists.starlingx.io*2Fcgi-bin*2Fmailman*2Flistinfo*2Fstarlingx-discuss__*3B*21*21AjveYdw8EvQ*21e8leCxdSWn7CF5mepfpbV18UcLDSxfeu8JA2iW4ux5kQ7-Dya9uodepzEl_9Pj1QzoD5CDyT3LJdh6si3eZDcLl5VHlseg*24__;JSUlJSUlJSUlJSUlJSUlJQ!!AjveYdw8EvQ!ftQxVQD6PBpbCLvLTR39Z8P_gDz5TUrBPEhzcs1gZuXNSAktfNGKZ7JpMi6FHbnT6g4f60qMmk2zKnypVD2dKYFa3RUKtLs$">http://lists.starlingx.io/cgi-bin/mailman/listinfo/starlingx-discuss</a><o:p></o:p></span></pre>
</blockquote>
<p><span lang="EN-US">Thanks for the report. I'll look into it<o:p></o:p></span></p>
<p><span lang="EN-US">Scott Little<o:p></o:p></span></p>
<p><span lang="EN-US"> <o:p></o:p></span></p>
</div>
</blockquote>
<p><span lang="EN-US"><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>