Skip to content

beast-booter 0.1.1

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Oct 04:05
· 43 commits to main since this release
v0.1.1
2f44de5

beast-booter 0.1.1

Release v0.1.1. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-booter install --dist beast-booter-0.1.1-dist.zip.

Secure Boot certificate

On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-booter-0.1.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:

86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
  • Subject: CN=beast-booter Secure Boot release key (valid until 2036-10-21T04:21:14Z)
  • SHA-1: 86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B
  • SHA-256: 29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A

The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".

Vulnerabilities

From beast-booter-0.1.1-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):

  • Open boot-chain findings: 1 critical, 1 high, 1 medium
  • Open findings in shipped software (drive, beast-net, portable runtimes): 2 critical, 212 high, 1568 medium, 371 low, 22 negligible
  • Open findings in build/test tooling (not shipped): 82 medium, 9 low
  • Closed by VEX statements: 4330
  • Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 2 known)

Boot-chain findings and their VEX status:

  • CRITICAL BB-SBAT-REVOKED-grub: esp/EFI/BOOT/grubx64.efi: SBAT grub,5 is below the revocation level grub,6 (SbatLevel 2025112400) - VEX affected: Maintainer decision 2026-10-23: wait for Ubuntu to publish a grub2 build whose SBAT carries grub,6, then rebuild (make build), re-scan (make vulns) and re-test (make e2e). The grub generation is never raised by hand. Until then Secure Boot boots fail on PCs that applied SbatLevel 2025112400; documented in docs/SECURE_BOOT.md.
  • HIGH BB-SHIM-UEFI-CA-2011-ONLY: esp/EFI/BOOT/BOOTX64.EFI is signed only through Microsoft Corporation UEFI CA 2011 (notAfter 2026-06-27T21:32:45Z, expired 119 days ago) - VEX affected: Maintainer decision 2026-10-23: wait for Ubuntu to publish a shim-signed build signed by the Microsoft UEFI CA 2023, then rebuild, re-scan and re-test. Until then Secure Boot boots fail on PCs whose db trusts only the 2023 CA; documented in docs/SECURE_BOOT.md.
  • MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet

Critical/high findings in shipped software: CVE-2015-7837, CVE-2022-50240, CVE-2025-1272, CVE-2025-40190, CVE-2025-61662, CVE-2026-100074, CVE-2026-72198, CVE-2026-74677, CVE-2026-74700, CVE-2026-74714, CVE-2026-74752, CVE-2026-80693, CVE-2026-80718, CVE-2026-80841, CVE-2026-80937 and 93 more

Verify the download

sha256sum -c SHA256SUMS --ignore-missing   # Windows: Get-FileHash <file> -Algorithm SHA256

gh attestation verify beast-booter-0.1.1-dist.zip -R cynak/BeastBoot # build provenance, any file

The SBOM (beast-booter-0.1.1-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.

Files

File Size SHA-256
beast-booter-0.1.1-linux-x86_64.tar.gz 126.4 MiB 311fcccd1b79b100...
beast-booter-0.1.1-windows-x86_64.zip 96.5 MiB acd667a1309735ba...
beast-booter-0.1.1-macos-x86_64.zip 79.1 MiB 59b8bed059c9e103...
beast-booter-0.1.1-macos-arm64.zip 79.3 MiB 11b84390b8820ae7...
beast-booter-0.1.1-dist.zip 52.8 MiB 3baa4e84a88bd7f5...
beast-booter-0.1.1-sbom.cdx.json 691.2 KiB cbd2780b49739ec0...
beast-booter-0.1.1-sbom.spdx.json 611.8 KiB c422907e52b7b8bb...
beast-booter-0.1.1-vulnerabilities.json 15.0 MiB c7fbeb992a68037d...
beast-booter-0.1.1-VULNERABILITIES.md 2.4 MiB 11641983e8047bed...
beast-booter-0.1.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer 869 B 294bd966257bff2a...
beast-booter-0.1.1-CERTIFICATE.txt 1.0 KiB c9e7c8a7d702502a...
SHA256SUMS 1.1 KiB 94d9f270eb7594b5...
Assets 14
Loading