Shim 15.8 for 10ZiG Linux

[ClaudioGranatiero-10zig]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/ClaudioGranatiero-10zig/shim-review/tree/10zig-shim-x64-20240209

---

What is the SHA256 hash of your final SHIM binary?

---

881bb700c81264565df689f9749f16b02342a82d0f74a4629c63f9b611102e1c

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

#326

[vden-irm]

Hi, I'm not an authorized reviewer. I just want to help.

• Shim is reproducible using Dockerfile - OK
• Shim is based on the latest version 15.8 - OK
• hash value is matched - OK

$ sha256sum ./shimx64.efi
881bb700c81264565df689f9749f16b02342a82d0f74a4629c63f9b611102e1c  ./shimx64.efi

#22 [18/18] RUN sha256sum /build/output/*
#22 0.322 f3b011f61ee3c513068bcbc247f45ee930b377a9a1864fc96900c479beb8626b  /build/output/10ZiG_SecureBootCA_RootCA.der
#22 0.328 881bb700c81264565df689f9749f16b02342a82d0f74a4629c63f9b611102e1c  /build/output/shimx64.efi
#22 DONE 0.3s

• Shim SBAT seems OK and is bumped to 4:

objdump -s -j .sbat ./shimx64.efi 

./shimx64.efi:     file format pei-x86-64

Contents of section .sbat:
 d4000 73626174 2c312c53 42415420 56657273  sbat,1,SBAT Vers
 d4010 696f6e2c 73626174 2c312c68 74747073  ion,sbat,1,https
 d4020 3a2f2f67 69746875 622e636f 6d2f7268  ://github.com/rh
 d4030 626f6f74 2f736869 6d2f626c 6f622f6d  boot/shim/blob/m
 d4040 61696e2f 53424154 2e6d640a 7368696d  ain/SBAT.md.shim
 d4050 2c342c55 45464920 7368696d 2c736869  ,4,UEFI shim,shi
 d4060 6d2c312c 68747470 733a2f2f 67697468  m,1,https://gith
 d4070 75622e63 6f6d2f72 68626f6f 742f7368  ub.com/rhboot/sh
 d4080 696d0a73 68696d2e 31307a69 672c312c  im.shim.10zig,1,
 d4090 31305a69 47205465 63686e6f 6c6f6779  10ZiG Technology
 d40a0 2c736869 6d2c3135 2e382c6d 61696c3a  ,shim,15.8,mail:
 d40b0 73656375 7265626f 6f744031 307a6967  secureboot@10zig
 d40c0 2e636f6d 0a                          .com.   

• Newline at the end of SBAT exists - OK
• .sbatlevel seems OK and there is no binutils bug:

$ objdump -s -j .sbatlevel ./shimx64.efi 

./shimx64.efi:     file format pei-x86-64

Contents of section .sbatlevel:
 86000 00000000 08000000 37000000 73626174  ........7...sbat
 86010 2c312c32 30323330 31323930 300a7368  ,1,2023012900.sh
 86020 696d2c32 0a677275 622c330a 67727562  im,2.grub,3.grub
 86030 2e646562 69616e2c 340a0073 6261742c  .debian,4..sbat,
 86040 312c3230 32343031 30393030 0a736869  1,2024010900.shi
 86050 6d2c340a 67727562 2c330a67 7275622e  m,4.grub,3.grub.
 86060 64656269 616e2c34 0a00               debian,4..     

• NX compatibility is disabled and it is OK for now:

$ objdump -p shimx64.efi | grep DllCharacteristics
DllCharacteristics	00000000

• Certificate matches the organization:

$ openssl x509 -inform der -in 10ZiG_SecureBootCA_RootCA.der -text | grep Subject
        Subject: C = US, ST = AZ, L = Phoenix, O = 10ZiG Technology, CN = 10ZiG Technology Secure Boot CA 2023, emailAddress = [email protected]

• Certificate validity is OK (10 years):

$ openssl x509 -inform der -in 10ZiG_SecureBootCA_RootCA.der -text | grep -A2 Validity
        Validity
            Not Before: Oct 30 09:08:49 2023 GMT
            Not After : Oct 27 09:08:49 2033 GMT

• Certificate is CA with code singing attributes set:

$ openssl x509 -inform der -in 10ZiG_SecureBootCA_RootCA.der -text | grep -A3 "X509v3 Key Usage"
            X509v3 Key Usage: 
                Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment, Key Agreement, Certificate Sign, CRL Sign
            X509v3 Extended Key Usage: 
                Code Signing

• GRUB is from Debian and is based on the release 2.12 includes CVE-2023-4693 and CVE-2023-4692. It has SBAT level 4 - OK
• SBAT for GRUB2 looks good:

$ objdump -s -j .sbat ./grubx64.efi 

./grubx64.efi:     file format pei-x86-64

Contents of section .sbat:
 28a000 73626174 2c312c53 42415420 56657273  sbat,1,SBAT Vers
 28a010 696f6e2c 73626174 2c312c68 74747073  ion,sbat,1,https
 28a020 3a2f2f67 69746875 622e636f 6d2f7268  ://github.com/rh
 28a030 626f6f74 2f736869 6d2f626c 6f622f6d  boot/shim/blob/m
 28a040 61696e2f 53424154 2e6d640a 67727562  ain/SBAT.md.grub
 28a050 2c342c46 72656520 536f6674 77617265  ,4,Free Software
 28a060 20466f75 6e646174 696f6e2c 67727562   Foundation,grub
 28a070 2c322e31 322c6874 7470733a 2f2f7777  ,2.12,https://ww
 28a080 772e676e 752e6f72 672f736f 66747761  w.gnu.org/softwa
 28a090 72652f67 7275622f 0a677275 622e6465  re/grub/.grub.de
 28a0a0 6269616e 2c342c44 65626961 6e2c6772  bian,4,Debian,gr
 28a0b0 7562322c 322e3132 2d312c68 74747073  ub2,2.12-1,https
 28a0c0 3a2f2f74 7261636b 65722e64 65626961  ://tracker.debia
 28a0d0 6e2e6f72 672f706b 672f6772 7562320a  n.org/pkg/grub2.
 28a0e0 67727562 2e646562 69616e31 332c312c  grub.debian13,1,
 28a0f0 44656269 616e2c67 72756232 2c322e31  Debian,grub2,2.1
 28a100 322d312c 68747470 733a2f2f 74726163  2-1,https://trac
 28a110 6b65722e 64656269 616e2e6f 72672f70  ker.debian.org/p
 28a120 6b672f67 72756232 0a677275 622e7065  kg/grub2.grub.pe
 28a130 696d6167 652c312c 43616e6f 6e696361  image,1,Canonica
 28a140 6c2c6772 7562322c 322e3132 2d312c68  l,grub2,2.12-1,h
 28a150 74747073 3a2f2f73 616c7361 2e646562  ttps://salsa.deb
 28a160 69616e2e 6f72672f 67727562 2d746561  ian.org/grub-tea
 28a170 6d2f6772 75622f2d 2f626c6f 622f6d61  m/grub/-/blob/ma
 28a180 73746572 2f646562 69616e2f 70617463  ster/debian/patc
 28a190 6865732f 73656375 72652d62 6f6f742f  hes/secure-boot/
 28a1a0 6566692d 7573652d 7065696d 6167652d  efi-use-peimage-
 28a1b0 7368696d 2e706174 63680a00 00000000  shim.patch......

• Noticed that GRUB SBAT from the grubx64.efi does not match with the SBAT in the review template. Look like it is stripped in the README.md:

 28a000 73626174 2c312c53 42415420 56657273  sbat,1,SBAT Vers
 28a010 696f6e2c 73626174 2c312c68 74747073  ion,sbat,1,https
 28a020 3a2f2f67 69746875 622e636f 6d2f7268  ://github.com/rh
 28a030 626f6f74 2f736869 6d2f626c 6f622f6d  boot/shim/blob/m
 28a040 61696e2f 53424154 2e6d640a 67727562  ain/SBAT.md.grub
 28a050 2c342c46 72656520 536f6674 77617265  ,4,Free Software
 28a060 20466f75 6e646174 696f6e2c 67727562   Foundation,grub
 28a070 2c322e31 322c6874 7470733a 2f2f7777  ,2.12,https://ww
 28a080 772e676e 752e6f72 672f736f 66747761  w.gnu.org/softwa
 28a090 72652f67 7275622f 0a677275 622e6465  re/grub/.grub.de
 28a0a0 6269616e 2c342c44 65626961 6e2c6772  bian,4,Debian,gr
 28a0b0 7562322c 322e3132 2d312c68 74747073  ub2,2.12-1,https
 28a0c0 3a2f2f74 7261636b 65722e64 65626961  ://tracker.debia
 28a0d0 6e2e6f72 672f706b 672f6772 7562320a  n.org/pkg/grub2.
 28a0e0 67727562 2e646562 69616e31 332c312c  grub.debian13,1,
 28a0f0 44656269 616e2c67 72756232 2c322e31  Debian,grub2,2.1

• Ephemeral key signing for kernel modules is used - OK

[ClaudioGranatiero-10zig]

@aronowski can you please take a look here? Thank you!

[aronowski]

Build reproduces, SHA256 sum matches. The binary characteristics are fine, no NX support, as the whole chain is not NX-compatible.

Others appear to be fine, just like in the last review. I took a closer look at the changes between 15.7 and 15.8.

Huge thanks to @vden-irm for help!

Looks alright! There's just one typo I found: in line no. 266 there's bjdump, rather than objdump.
Accepting!

[ClaudioGranatiero-10zig]

Thank you very much @aronowski !

[ClaudioGranatiero-10zig]

Hi @aronowski, @vden-irm , @SherifNagy , @julian-klode , @kukrimate , @dennis-tseng99, @steve-mcintyre and everyone who knows...
Sorry to bother you, but finally we have the EV Certificate and the time to go further on this. I have the Shim signed with our EV Certificate, but don't know where to submit that to Microsoft. The site where upload the binary to be signed seems a moving target and the latest information I have found doesn't seems working anymore. Is there some of you who have updated information on this?
Thank you very much to anyone able to help me.

[SherifNagy]

I think this is a bit out of the scope here, but long story short, you need to register the organisation with https://partner.microsoft.com , read their docs and agreements, and follow the steps they mention in their resources section.

[SherifNagy]

also you don't sign the SHIM with your EV, you put the SHIM in a cab file an SIGN it with the EV cert's key and upload the EV PUBLIC cert part into the portal along doing some other stuff like signing a test file and such, their documents are pretty clear on what and how to do so.
example: https://learn.microsoft.com/en-us/windows-hardware/drivers/dashboard/file-signing-reqs

[ClaudioGranatiero-10zig]

@SherifNagy thank you very much, and sorry for hijacking the thread. I'll read the document and try to figure it out how to go further.

[ClaudioGranatiero-10zig]

Hi @SherifNagy, sorry to go off the trail again, but maybe someone else here has the same problem: it's over a month now that we are trying to enroll on the "Hardware Program" on Microsoft Partner, as required for having our SHIM signed... the enrollment page is not working and Microsoft Support is saying that they are aware of the problem but cannot give a ETA for the fix. In the meantime we can only wait. Do you (or someone else reading here) know if there is another way? Maybe you could give visibility to this problem to everyone, so the other new vendors can be aware of it. Sorry again, I don't know if there is another, more appropriate, channel for this.

[ClaudioGranatiero-10zig]

Thanks to everyone, finally Microsoft reopened the subscriptions and we were able to submit our shim; now it's signed.