Shim 15.7 - shimx64.efi and shimia32.efi for OpenText(MicroFocus) ZENworks #320
Comments
|
Done all cleanup and raised this request and closed the old request #311 |
|
@frozencemetery @steve-mcintyre @julian-klode - Kindly review this request. |
|
Kindly review this request and update the status. |
|
I'm not an authorized reviewer, but I'd like to contribute a little bit effort to help @frozencemetery @steve-mcintyre @julian-klode:
|
|
Kindly update the status for this review request. |
|
hi, whats the current Status of this request?? |
|
While I'm not an official reviewer, I can see a few curiosities: I can see the earlier shim you got approved was 15.4 here. It had the entry Therefore if this is the first time 15.7 is used (i.e. with The source RPM link doesn't work. Therefore I can't proceed with further verification. Though I suspect the Regarding your product specific generation number, I can't verify if it's correct as I have no knowledge, if you just take SUSE Linux Enterprise GRUB2 and rebuild it or add custom patches, where security issues to your custom build were addressed twice. |
|
There was a review comment to increase the number to 3, which required to revoke the shim <=2. With respect to grub source repo updated as below https://download.opensuse.org/repositories/openSUSE:/Factory/standard/src/grub2-2.06-49.1.src.rpm |
This was about increasing the Red Hat Bootloader Team's shim global generation number to 3, not about MicroFocus's product specific generation number. Normally it should be like this, assuming there were no security issues addressed beforehand There seems to be a difference between the modules listed in this review and your specfile. I was right about the If they are unused, even though they are listed, let me know, how that's implemented. PS: there are more modules in the specfile but seem to be architecture-specific (ppc/ppc64/ppc64le) so the macro parser I have in my head ignored these. ;) |
|
It is typo issue, grub-core is folder , where all the modules output files are placed as per below command. |
|
@frozencemetery @steve-mcintyre @julian-klode - Can you please provide any additional information regarding changes that need to be made or approve this review. As has been stated we have several thousand customers depending on this shim who have been broken since the fall of 2022. We need to be able to release this shim so that those customers can continue to provision their devices. |
|
@jrbnovell, the point of this project is that issues should be peer-reviewed:
As far as I can see the best people can do to speed up the reviewing process is to help review other issues. I helped you with yours, please help me with mine as a token of appreciation (I wrote more on this in this comment). Also, I pointed out some errors in the issue you posted. Please, fix these as it is pointless for official reviewers to spend more time on pointing out the same. Thank you in advance. |
|
Review for
Hashes SBAT
Notes/Questions
|
|
Thanks for reviewing. Will update required details asap. |
|
@MuthuvelKuppusamy since the submission, two new questions were added:
Can you also include them in the updated submission? |
|
MuthuvelKuppusamy
changed the title
MuthuvelKuppusamy
changed the title
Ok
Notes
Questions
|
|
Last submission validated by mailing random string to the both security contacts. |
|
@MuthuvelKuppusamy thank you. So this validation was done without any PGP keys then right? |
|
Yes, It was validated by sending random string to both mail-ids and pasting the same in the issue for verification. |
|
Kindly let me know, Is there any other information need to be provided. As the question label is not yet removed. |
|
What still needs to be figured out is how SUSE handles the signing of the kernel modules and if they are preventing older kernels to load older modules. At least for openSUSE Tumbleweed this seems not to be the case: #333 (comment) |
|
We will sign the kernel itself, using the shim embedded keys or else it will not be successful to chain load from our grub. |
|
Yes, but the kernel generally also has a certificate embedded to verify loaded kernel modules. The question is on how this is implemented e.g. new certificate for every build, kernel is build without module support etc. |
|
Thanks for the quick review and feedback. Hi, I have looked in to sles15sp3 and sles15sp5 kernel signature and modules signatures. |
|
Thanks, also looking at https://github.com/SUSE/kernel-source it seems that they are using a new key for every build. Maybe @jsegitz can confirm this, but otherwise my questions are now answered. Because the contacts have changed, I would like to do another round of contact verification (https://github.com/rhboot/shim-review/blob/main/docs/reviewer-guidelines.md#contact-verification). Can you provide me with which PGP keys I should use for those email addresses? |
THS-on
added
contact verification needed
|
Added the GPG key for contact verification. Please let me know if any other information required. |
|
@MuthuvelKuppusamy thanks, I sent out emails for contact verification. @dennis-tseng99 @aronowski can you have another look at this? Once the contact verification is done, it is ready to go from my side |
THS-on
added
the
extra review wanted
|
@THS-on, I'm kind of tied up at the moment and will be able to review the application as early as of November 18. |
|
wakings |
|
semaphores |
|
Updated the random strings for contacts verification. |
THS-on
removed
the
contact verification needed
|
@MuthuvelKuppusamy contact verification is complete. What is now left is at least one (also unofficial) review from another person. There are also currently a lot of reviews that need one more review which are tagged with "extra review wanted". I would like to encourage you to have a look at a couple of them and do an unofficial review (the guide can be found here: https://github.com/rhboot/shim-review/blob/main/docs/reviewer-guidelines.md). This helps us out, to keep the queue moving and catching mistakes. |
|
I'm not an authorized reviewer, I'm just trying to help and learn.
sha256:Obj Alignment:Alignment is ok shimx64.efishimia32.efiDllCharacteristics:NX_COMPAT is enabled shimx64.efishimx64.efiSections:shimx64.efiCode section is not writable: OK shimia32.efiCode section is not writable: OKSBAT:shimx64.efishimx64.efiCertificate: |
|
@ClaudioGranatiero-10zig thanks for taking a look. Marking now as accepted |
THS-on
added
accepted
|
What is the status of this? Did you get a signed shim back or are you creating a new submission for 15.8? |
|
We are going to submit the new request for 15.8. |
Confirm the following are included in your repo, checking each box:
What is the link to your tag in a repo cloned from rhboot/shim-review?
https://github.com/MuthuvelKuppusamy/shim-review/tree/opentext-shim-x64-ia32-20230929
What is the SHA256 hash of your final SHIM binary?
c11e597213af28f78c2f231ea9764748a84e49747993e7a9c24f73875516ef8b shimia32.efi
f88931998d2ee41e50671ba2528d93b1fcad2aa25706fbfe8bc9720fb0764b73 shimx64.efi
What is the link to your previous shim review request (if any, otherwise N/A)?
#166
The text was updated successfully, but these errors were encountered: