Skip to content

beast-boot 0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 02:47
· 2 commits to main since this release
v0.4.0
93cd939

beast-boot 0.4.0

Release v0.4.0. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-boot install --dist beast-boot-0.4.0-dist.zip.

Secure Boot certificate

On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-boot-0.4.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:

86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
  • Subject: CN=beast-booter Secure Boot release key (valid until 2036-10-21T04:21:14Z)
  • SHA-1: 86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B
  • SHA-256: 29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A

The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".

Vulnerabilities

From beast-boot-0.4.0-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):

  • Open boot-chain findings: 1 medium
  • Open findings in shipped software (drive, beast-net, portable runtimes): 220 medium, 42 low, 19 negligible
  • Open findings in build/test tooling (not shipped): 52 medium, 19 low
  • Closed by VEX statements: 381
  • Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)

Boot-chain findings and their VEX status:

  • MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet

Critical/high findings in shipped software: none

Verify the download

sha256sum -c SHA256SUMS --ignore-missing   # Windows: Get-FileHash <file> -Algorithm SHA256

gh attestation verify beast-boot-0.4.0-dist.zip -R cynak/BeastBoot # build provenance, any file

The SBOM (beast-boot-0.4.0-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.

Files

File Size SHA-256
beast-boot-0.4.0-linux-x86_64.tar.gz 141.8 MiB c3fc6ee8f89f837a...
beast-boot-0.4.0-windows-x86_64.zip 109.9 MiB 2cad2fa870c14579...
beast-boot-0.4.0-macos-x86_64.zip 91.7 MiB f07475074d25289f...
beast-boot-0.4.0-macos-arm64.zip 91.4 MiB c6577747c09f4f43...
beast-boot-0.4.0-dist.zip 63.6 MiB 07d579581b770c38...
beast-boot-0.4.0-sbom.cdx.json 806.5 KiB 587e58a32c13bfee...
beast-boot-0.4.0-sbom.spdx.json 733.5 KiB 9bb88a8c1a425922...
beast-boot-0.4.0-vulnerabilities.json 1.6 MiB ba98af497f7d1d43...
beast-boot-0.4.0-VULNERABILITIES.md 204.1 KiB 93937fc0a75c947a...
beast-boot-0.4.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer 869 B 294bd966257bff2a...
beast-boot-0.4.0-CERTIFICATE.txt 1.0 KiB 017f390953f8f509...
SHA256SUMS 1.1 KiB 0ece2da1b603da9b...
Assets 14
Loading