rhel-7-shim-20221116

[vathpela]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/vathpela/shim-review/tree/rhel-7-shim-20221116

---

What is the SHA256 hash of your final SHIM binary?

---

$ sha256sum shimx64.efi
e8da09733d657838f6694eaf65d049b85976fe15a192895718b93277c36bab21 shimx64.efi
$ pesign -P -h -i shimx64.efi
7f1c904821006fd0c6c936ced779afef10bdcd71e98e486c08924e9ef126654a shimx64.efi

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

#178 (for the prior RHEL 7 version)

[jsetje]

• I can reproduce the build (well, once I realized this needs podman)
• The certs looks ok
• fully upstream shim is good
• grub looks fine
• for kernels it would be nice to see a fix for https://access.redhat.com/security/cve/cve-2022-21499

[vathpela]

fyi this is submission 14337024179215295