Skip to content

beast-booter 0.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 24 Oct 18:28
· 46 commits to main since this release
v0.1.0
3bddec0

beast-booter 0.1.0

Release v0.1.0. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-booter install --dist beast-booter-0.1.0-dist.zip.

Secure Boot certificate

On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-booter-0.1.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:

86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
  • Subject: CN=beast-booter Secure Boot release key (valid until 2036-10-21T04:21:14Z)
  • SHA-1: 86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B
  • SHA-256: 29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A

The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".

Vulnerabilities

From beast-booter-0.1.0-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):

  • Open boot-chain findings: 1 critical, 1 high, 1 medium
  • Open findings in shipped software (drive, beast-net, portable runtimes): 24 critical, 582 high, 4747 medium, 1116 low, 41 negligible
  • Open findings in build/test tooling (not shipped): 82 medium, 9 low
  • Closed by VEX statements: 0
  • Release gate: passed: no new critical finding without a VEX statement

Boot-chain findings and their VEX status:

  • CRITICAL BB-SBAT-REVOKED-grub: esp/EFI/BOOT/grubx64.efi: SBAT grub,5 is below the revocation level grub,6 (SbatLevel 2025112400) - VEX affected: Maintainer decision 2026-10-23: wait for Ubuntu to publish a grub2 build whose SBAT carries grub,6, then rebuild (make build), re-scan (make vulns) and re-test (make e2e). The grub generation is never raised by hand. Until then Secure Boot boots fail on PCs that applied SbatLevel 2025112400; documented in docs/SECURE_BOOT.md.
  • HIGH BB-SHIM-UEFI-CA-2011-ONLY: esp/EFI/BOOT/BOOTX64.EFI is signed only through Microsoft Corporation UEFI CA 2011 (notAfter 2026-06-27T21:32:45Z, expired 118 days ago) - VEX affected: Maintainer decision 2026-10-23: wait for Ubuntu to publish a shim-signed build signed by the Microsoft UEFI CA 2023, then rebuild, re-scan and re-test. Until then Secure Boot boots fail on PCs whose db trusts only the 2023 CA; documented in docs/SECURE_BOOT.md.
  • MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet

Critical/high findings in shipped software: CVE-2015-7837, CVE-2022-50240, CVE-2024-45774, CVE-2024-45776, CVE-2024-45777, CVE-2024-45780, CVE-2024-45781, CVE-2024-45782, CVE-2025-0622, CVE-2025-0690, CVE-2025-1272, CVE-2025-40190, CVE-2025-61662, CVE-2026-100074, CVE-2026-68103 and 294 more

Verify the download

sha256sum -c SHA256SUMS --ignore-missing   # Windows: Get-FileHash <file> -Algorithm SHA256

gh attestation verify beast-booter-0.1.0-dist.zip -R cynak/BeastBoot # build provenance, any file

The SBOM (beast-booter-0.1.0-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.

Files

File Size SHA-256
beast-booter-0.1.0-linux-x86_64.tar.gz 126.2 MiB cab8a0ea69203037...
beast-booter-0.1.0-windows-x86_64.zip 96.3 MiB 0a6386c8a751a97d...
beast-booter-0.1.0-macos-x86_64.zip 79.0 MiB 9b91fa2a33359b0e...
beast-booter-0.1.0-macos-arm64.zip 79.1 MiB 1d88f843f3415f42...
beast-booter-0.1.0-dist.zip 53.0 MiB b730f41dc3407154...
beast-booter-0.1.0-sbom.cdx.json 703.7 KiB fa8e95003895077f...
beast-booter-0.1.0-sbom.spdx.json 628.4 KiB a016a06b6bd4cbd0...
beast-booter-0.1.0-vulnerabilities.json 12.3 MiB da5d1e9c2662f21d...
beast-booter-0.1.0-VULNERABILITIES.md 124.6 KiB 6f32364b55e34876...
beast-booter-0.1.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer 869 B 294bd966257bff2a...
beast-booter-0.1.0-CERTIFICATE.txt 1.0 KiB 26aa696165ff7073...
SHA256SUMS 1.1 KiB bb6d662d76c7298f...
Assets 14
Loading