Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

24 Support shim fallback bootchain #107

Open
wants to merge 5 commits into
base: 24
Choose a base branch
from
Open

24 Support shim fallback bootchain #107

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5431e42
Implement shim fallback support.
xnox Feb 26, 2021
3a0e8d3
Implement shim fallback support for aa64.
olivercalder Sep 25, 2023
b4197ab
set up `fb${arch}.efi`, `mm${arch}.efi`, and `BOOT${arch}.CSV` correctly
olivercalder Sep 26, 2023
7538629
assume snapd 2.61 for handling assets in /EFI/ubuntu
olivercalder Sep 26, 2023
d38d6a6
gadget: remove shim from boot partition
alfonsosanchezbeato Jul 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions gadget/gadget-amd64.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,18 @@ volumes:
update:
edition: 2
content:
- source: shim.efi.signed
target: EFI/BOOT/BOOTX64.efi
- source: fbx64.efi
target: EFI/BOOT/fbx64.efi
- source: BOOTX64.CSV
target: EFI/ubuntu/BOOTX64.CSV
- source: grubx64.efi
target: EFI/boot/grubx64.efi
target: EFI/ubuntu/grubx64.efi
- source: mmx64.efi
target: EFI/ubuntu/mmx64.efi
- source: shim.efi.signed
target: EFI/boot/bootx64.efi
target: EFI/ubuntu/shimx64.efi
- name: ubuntu-boot
role: system-boot
filesystem: ext4
Expand Down
12 changes: 10 additions & 2 deletions gadget/gadget-arm64.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,18 @@ volumes:
update:
edition: 2
content:
- source: shim.efi.signed
target: EFI/BOOT/BOOTAA64.efi
- source: fbaa64.efi
target: EFI/BOOT/fbaa64.efi
- source: BOOTAA64.CSV
target: EFI/ubuntu/BOOTAA64.CSV
- source: grubaa64.efi
target: EFI/boot/grubaa64.efi
target: EFI/ubuntu/grubaa64.efi
- source: mmaa64.efi
target: EFI/ubuntu/mmaa64.efi
- source: shim.efi.signed
target: EFI/boot/bootaa64.efi
target: EFI/ubuntu/shimaa64.efi
- name: ubuntu-boot
role: system-boot
filesystem: ext4
Expand Down
23 changes: 20 additions & 3 deletions snapcraft.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,9 @@ hooks:
# DO NOT check this API key into a publicly accessible VCS
MODEL_APIKEY: ""

# Min version to support shim 15.7
# Min version to support shim 15.7 and assets in /EFI/ubuntu
assumes:
- snapd2.59.3
- snapd2.61

parts:
mbr:
Expand All @@ -52,27 +52,44 @@ parts:
grub_target=x86_64
grub_bin=grubx64.efi.signed
shim_bin=shimx64.efi.dualsigned
fb_bin=fbx64.efi
mm_bin=mmx64.efi
boot_csv=BOOTX64.CSV
if [ "$CRAFT_TARGET_ARCH" = arm64 ]; then
grub_target=arm64
grub_bin=grubaa64.efi.signed
shim_bin=shimaa64.efi.dualsigned
fb_bin=fbaa64.efi
mm_bin=mmaa64.efi
boot_csv=BOOTAA64.CSV
fi

# Make sure we have signatures from the UC certificates
shim_path="$CRAFT_PART_INSTALL"/usr/lib/shim/$shim_bin
grub_path="$CRAFT_PART_INSTALL"/usr/lib/grub/"$grub_target"-efi-signed/$grub_bin
fb_path="$CRAFT_PART_INSTALL"/usr/lib/shim/$fb_bin
mm_path="$CRAFT_PART_INSTALL"/usr/lib/shim/$mm_bin
csv_path="$CRAFT_PART_INSTALL"/usr/lib/shim/$boot_csv
#sbverify --list "$shim_path" | grep -E 'Canonical Ltd. Secure Boot Signing \(Ubuntu Core'
#sbverify --list "$grub_path" | grep -E 'Canonical Ltd. Secure Boot Signing \(Ubuntu Core'
#sbverify --list "$fb_path" | grep -E 'Canonical Ltd. Secure Boot Signing \(Ubuntu Core'
#sbverify --list "$mm_path" | grep -E 'Canonical Ltd. Secure Boot Signing \(Ubuntu Core'

# Move shim/grub to the expected path
# Move assets to the expected paths
install -m 644 "$shim_path" "$CRAFT_PART_INSTALL"/shim.efi.signed
install -m 644 "$grub_path" "$CRAFT_PART_INSTALL"/${grub_bin%.signed}
install -m 644 "$fb_path" "$CRAFT_PART_INSTALL"/$fb_bin
install -m 644 "$mm_path" "$CRAFT_PART_INSTALL"/$mm_bin
install -m 644 "$csv_path" "$CRAFT_PART_INSTALL"/$boot_csv
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe time to make this a for loop


# Remove all the bits we do not need, keeping changelogs and copyrights
# (using organize/prime is not possible due to different names per arch - x64/aa64)
find "$CRAFT_PART_INSTALL"/ -type f,l \
-not -path "$SNAPCRAFT_PART_INSTALL"/shim.efi.signed \
-not -path "$SNAPCRAFT_PART_INSTALL"/${grub_bin%.signed} \
-not -path "$SNAPCRAFT_PART_INSTALL"/$fb_bin \
-not -path "$SNAPCRAFT_PART_INSTALL"/$mm_bin \
-not -path "$SNAPCRAFT_PART_INSTALL"/$boot_csv \
-not -path "$SNAPCRAFT_PART_INSTALL"/usr/share/doc/grub-efi-$CRAFT_TARGET_ARCH-signed/'*' \
-and -not -path "$SNAPCRAFT_PART_INSTALL"/'usr/share/doc/shim-signed/*' \
-delete
Expand Down