AmZetta Technologies, LLC shim-15.8 x64

[amzdev0401]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
  'https://github.com/amzdev0401/shim-review/blob/AmZetta-shim-x86_64-20240220/build.log'
• a Dockerfile to reproduce the build of the provided shim EFI binaries
  'https://github.com/amzdev0401/shim-review/blob/AmZetta-shim-x86_64-20240220/Dockerfile'

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/amzdev0401/shim-review/tree/AmZetta-shim-x86_64-20240220

---

What is the SHA256 hash of your final SHIM binary?

---

a5e223647b0ba12cf8e6947de6b253dd5fba7f1f7c0356f55c387d7e64e5440a shimx64.efi

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

#321

[amzdev0401]

@dennis-tseng99 @aronowski @THS-on

I have resubmitted the latest SHIM 15.8. I kindly request you to review this new submission.

[aronowski]

Build reproduces, SHA256 sum matches (more on this in a moment). The binaries' characteristics are fine, no NX support, as the whole chain is not NX-compatible.

The application is generally alright, with some minor errors caused most likely due to some entries not being updated from an earlier application, where they were fine. I found these:

• There's an error that GRUB2 still has the upstream grub,3 entry, but an answer above the SBAT entries mentions that it's been set to 4.

• An older SHA-256 checksum has been provided in the latest README. Please, update it.
  It should be a5e223647b0ba12cf8e6947de6b253dd5fba7f1f7c0356f55c387d7e64e5440a just like in the current GitHub issue.

• At last, a minor rendering error is present in the GitHub issue's original post - an extra space has been added, making the checkboxes not render properly.

They can be fixed easily - please do so, update the tag in the original post and ping me for a quick re-review.

[amzdev0401]

@aronowski @THS-on @dennis-tseng99

Thank you for the review, I have fixed the issues you mentioned and I have created the release label v1.0.7 with the fixes.

https://github.com/amzdev0401/shim-review/releases/tag/AmZetta-shim-x86_64-20240220

[dennis-tseng99]

Sure, I will try my best. Currently, the binaries can be reproducible by podman when being tested at midnight. Please wait.

[dennis-tseng99]

=== Review for AmZetta Technologies, LLC shim-15.8 x64 #383 ===

• Binaries are producible based on tag AmZetta-shim-x86_64-20240220

• No extra patches are applied.

• NX flag is disable:
  shim-review# objdump -x shimx64.efi | grep -E 'SectionAlignment|DllCharacteristics'
  SectionAlignment 0000000000001000
  DllCharacteristics 00000000

• built hash matches the original one; and already fixed the incorrect hash in README.md pointed out by @aronowski.
  a5e223647b0ba12cf8e6947de6b253dd5fba7f1f7c0356f55c387d7e64e5440a

• produce-specific generation number is equal to 1 is reasonable because you said This is your first time SHIM submission
  for shim:
  sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
  shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
  shim.amzetta,1,AmZetta Technologies,shim,15.8,https://amzetta.com/
  for grub:
  sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
  grub,4,Free Software Foundation,grub,2.11,https://www.gnu.org/software/grub/
  grub.amzetta,1,AmZetta Technologies,grub2,2.11-65bc45963,https://amzetta.com/

• Certificate Validity:
  shim-review# openssl x509 -in amzetta.der -inform der -noout -text
  Validity
  Not Before: Feb 27 20:26:36 2023 GMT
  Not After : Feb 24 20:26:36 2033 GMT
  10 years is good for user

---

• Minor suggestion:
  For the next submission, please specify more details about the contact information for your product when you specify vendor_url field, or just use email instead. For example, you might change it to:
  grub.amzetta,1,AmZetta Technologies,grub2,2.11-65bc45963,https://amzetta.com/products/ztc/packages/grub

---

Conclusion:

• It is acceptable to me
• @aronowski needs your ping for the 2nd quick re-view .

[aronowski]

Awesome! Accepting it.

[amzdev0401]

@aronowski @THS-on @dennis-tseng99

A big thank you to everyone. Greatly appreciated!!

[amzdev0401]

@aronowski @THS-on @dennis-tseng99

Thank you all. Our SHIM was approved by Microsoft. Greatly appreciated!!