beast-booter 0.1.2

What's new in 0.1.2

A security release: no critical or high vulnerability findings remain open, in the boot chain, on the drive or in the portable app (see the attached VULNERABILITIES.md and OpenVEX files).

Boots on new PCs with Secure Boot on. The drive now starts through Debian's shim 16.1, which is signed by both Microsoft UEFI CA 2011 and Microsoft UEFI CA 2023. PCs that trust only the 2023 certificate can boot BeastBoot with Secure Boot on. MokManager is Debian's. Enrolling the BeastBoot key works as before.

GRUB built from source, SBAT grub,6. grubx64.efi is built from Ubuntu's grub2 2.14-2ubuntu3 source plus three patches (CVE-2026-97876; upstream 089d0567; Debian 8719ef8a). The build proves every fix is present before it claims grub,6, so the drive keeps booting on PCs that apply shim's newest revocation level. It also closes the GRUB CVEs from the 2025 security pushes.

Ubuntu ISOs with Secure Boot on: one opt-in step. Debian's shim does not trust Canonical's key. To start Ubuntu and Ubuntu-based ISOs with Secure Boot on, choose Tools > Trust Ubuntu's Secure Boot key once per PC. It first enrolls Ubuntu's revoked keys, then Canonical's key, and you confirm each in MokManager. Or turn Secure Boot off. Debian-signed ISOs now start without any extra step. See docs/USER_GUIDE.md ("Booting Ubuntu ISOs with Secure Boot on") for the fingerprints to compare.

Network helper on Linux 7.3. The beast-net helper uses Ubuntu 26.10's kernel 7.3.0-9.9, signed with the BeastBoot key. This closes over 100 kernel CVEs. After you update a drive, firmware packs installed for the old 7.0 kernel are flagged; reinstall them from the Firmware packs page.

Upgrading from 0.1.1: use "Update boot files" in the app. Your ISOs and files stay. Then reinstall any flagged firmware packs. If you use Ubuntu ISOs with Secure Boot on, run the trust step once.

---

beast-booter 0.1.2

Release v0.1.2. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-booter install --dist beast-booter-0.1.2-dist.zip.

Secure Boot certificate

On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-booter-0.1.2-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:

86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B

• Subject: CN=beast-booter Secure Boot release key (valid until 2036-10-21T04:21:14Z)
• SHA-1: 86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B
• SHA-256: 29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A

The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".

Vulnerabilities

From beast-booter-0.1.2-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):

• Open boot-chain findings: 1 medium
• Open findings in shipped software (drive, beast-net, portable runtimes): 79 medium, 44 low, 19 negligible
• Open findings in build/test tooling (not shipped): 50 medium, 9 low
• Closed by VEX statements: 197
• Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)

Boot-chain findings and their VEX status:

• MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet

Critical/high findings in shipped software: none

Verify the download

sha256sum -c SHA256SUMS --ignore-missing   # Windows: Get-FileHash <file> -Algorithm SHA256

gh attestation verify beast-booter-0.1.2-dist.zip -R cynak/BeastBoot # build provenance, any file

The SBOM (beast-booter-0.1.2-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.

Files

File	Size	SHA-256
beast-booter-0.1.2-linux-x86_64.tar.gz	126.5 MiB	9470bbf9a306701e...
beast-booter-0.1.2-windows-x86_64.zip	96.6 MiB	80054037823c13be...
beast-booter-0.1.2-macos-x86_64.zip	79.2 MiB	ce8746fcb0b84bd7...
beast-booter-0.1.2-macos-arm64.zip	79.4 MiB	7f021f0070cf4082...
beast-booter-0.1.2-dist.zip	54.0 MiB	a986a99c591d6610...
beast-booter-0.1.2-sbom.cdx.json	726.5 KiB	1cab070183f3ac36...
beast-booter-0.1.2-sbom.spdx.json	643.0 KiB	0aa403e062956756...
beast-booter-0.1.2-vulnerabilities.json	928.5 KiB	4672aed6df8c0378...
beast-booter-0.1.2-VULNERABILITIES.md	110.7 KiB	5ab1948297edae89...
beast-booter-0.1.2-ENROLL_THIS_KEY_IN_MOKMANAGER.cer	869 B	294bd966257bff2a...
beast-booter-0.1.2-CERTIFICATE.txt	1.0 KiB	6ff9408bf00fe97f...
SHA256SUMS	1.1 KiB	157f499074ce9c88...