beast-boot 0.3.1

beast-boot 0.3.1

Release v0.3.1. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-boot install --dist beast-boot-0.3.1-dist.zip.

Secure Boot certificate

On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-boot-0.3.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:

86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B

• Subject: CN=beast-booter Secure Boot release key (valid until 2036-10-21T04:21:14Z)
• SHA-1: 86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B
• SHA-256: 29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A

The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".

Vulnerabilities

From beast-boot-0.3.1-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):

• Open boot-chain findings: 1 medium
• Open findings in shipped software (drive, beast-net, portable runtimes): 248 medium, 42 low, 19 negligible
• Open findings in build/test tooling (not shipped): 51 medium, 19 low
• Closed by VEX statements: 511
• Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)

Boot-chain findings and their VEX status:

• MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet

Critical/high findings in shipped software: none

Verify the download

sha256sum -c SHA256SUMS --ignore-missing   # Windows: Get-FileHash <file> -Algorithm SHA256

gh attestation verify beast-boot-0.3.1-dist.zip -R cynak/BeastBoot # build provenance, any file

The SBOM (beast-boot-0.3.1-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.

Files

File	Size	SHA-256
beast-boot-0.3.1-linux-x86_64.tar.gz	141.8 MiB	8e7f138601e2ff8c...
beast-boot-0.3.1-windows-x86_64.zip	109.9 MiB	a38746d201a7c36a...
beast-boot-0.3.1-macos-x86_64.zip	91.7 MiB	425f25729e5550a1...
beast-boot-0.3.1-macos-arm64.zip	91.4 MiB	d3b8ad81f7e7426c...
beast-boot-0.3.1-dist.zip	63.6 MiB	be2dbd04a68a1eb9...
beast-boot-0.3.1-sbom.cdx.json	802.2 KiB	1e4ff8c407bb8bcc...
beast-boot-0.3.1-sbom.spdx.json	731.2 KiB	b57a5f98340ac202...
beast-boot-0.3.1-vulnerabilities.json	2.0 MiB	898ded154f41538d...
beast-boot-0.3.1-VULNERABILITIES.md	266.0 KiB	f3653c4abaccde4e...
beast-boot-0.3.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer	869 B	294bd966257bff2a...
beast-boot-0.3.1-CERTIFICATE.txt	1.0 KiB	f388eed551d4b175...
SHA256SUMS	1.1 KiB	a0b0e1b8d37b062b...