Skip to content

beast-boot 0.4.1

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 03 Nov 02:43
v0.4.1
ac98671
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

beast-boot 0.4.1

Release v0.4.1. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-boot install --dist beast-boot-0.4.1-dist.zip.

Secure Boot certificate

On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-boot-0.4.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:

86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
  • Subject: CN=beast-booter Secure Boot release key (valid until 2036-10-21T04:21:14Z)
  • SHA-1: 86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B
  • SHA-256: 29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A

The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".

Vulnerabilities

From beast-boot-0.4.1-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):

  • Open boot-chain findings: 1 medium
  • Open findings in shipped software (drive, beast-net, portable runtimes): 415 medium, 43 low, 19 negligible
  • Open findings in build/test tooling (not shipped): 61 medium, 19 low
  • Closed by VEX statements: 379
  • Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)

Boot-chain findings and their VEX status:

  • MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet

Critical/high findings in shipped software: none

Verify the download

sha256sum -c SHA256SUMS --ignore-missing   # Windows: Get-FileHash <file> -Algorithm SHA256

gh attestation verify beast-boot-0.4.1-dist.zip -R cynak/BeastBoot # build provenance, any file

The SBOM (beast-boot-0.4.1-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.

Files

File Size SHA-256
beast-boot-0.4.1-linux-x86_64.tar.gz 141.8 MiB 45dde82bfa774856...
beast-boot-0.4.1-windows-x86_64.zip 109.9 MiB 6ff990914b497b98...
beast-boot-0.4.1-macos-x86_64.zip 91.7 MiB 0f13eb82cc84e38b...
beast-boot-0.4.1-macos-arm64.zip 91.5 MiB bf80d05ce63f3be0...
beast-boot-0.4.1-dist.zip 63.6 MiB 4b9adf147a77bacc...
beast-boot-0.4.1-sbom.cdx.json 806.5 KiB e907d684bbfed0a2...
beast-boot-0.4.1-sbom.spdx.json 733.5 KiB 1dc57645e9e0781f...
beast-boot-0.4.1-vulnerabilities.json 2.1 MiB 757e16c867c31364...
beast-boot-0.4.1-VULNERABILITIES.md 203.6 KiB 469904af0e621667...
beast-boot-0.4.1-ENROLL_THIS_KEY_IN_MOKMANAGER.cer 869 B 294bd966257bff2a...
beast-boot-0.4.1-CERTIFICATE.txt 1.0 KiB 50b6778dd961271c...
SHA256SUMS 1.1 KiB 23d8c5ed5fa27fc3...
Assets 14
Loading