mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-09-23 06:31:18 +02:00
Code Issues Packages Projects Releases Wiki Activity

offline_signing: sign UEFI binaries for Secure Boot

Browse Source
This commit is contained in:
David Michael 2017-02-03 20:15:45 -08:00
parent d91c0c398f
commit 40b60875d0
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
offline_signing/sign.sh
View File

@ -5,14 +5,27 @@ DATA_DIR="$(readlink -f "$1")"
KEYS_DIR="$(readlink -f "$(dirname "$0")")" KEYS_DIR="$(readlink -f "$(dirname "$0")")"
gpg2 --verify "${DATA_DIR}/coreos_production_update.bin.bz2.sig" gpg2 --verify "${DATA_DIR}/coreos_production_update.bin.bz2.sig"
gpg2 --verify "${DATA_DIR}/coreos_production_image.vmlinuz.sig"
gpg2 --verify "${DATA_DIR}/coreos_production_update.zip.sig" gpg2 --verify "${DATA_DIR}/coreos_production_update.zip.sig"
bunzip2 --keep "${DATA_DIR}/coreos_production_update.bin.bz2" bunzip2 --keep "${DATA_DIR}/coreos_production_update.bin.bz2"
unzip "${DATA_DIR}/coreos_production_update.zip" -d "${DATA_DIR}" unzip "${DATA_DIR}/coreos_production_update.zip" -d "${DATA_DIR}"
export PATH="${DATA_DIR}:${PATH}" export PATH="${DATA_DIR}:${PATH}"
cd "${DATA_DIR}" cd "${DATA_DIR}"
# Sign UEFI binaries for Secure Boot.
for bin in vmlinuz grub shim
do
[ -e "coreos_production_image.$bin" ] || continue
gpg2 --verify "coreos_production_image.$bin.sig"
mv "coreos_production_image.$bin" "$bin.unsigned"
pesign --in="$bin.unsigned" \
--out="coreos_production_image.$bin" \
--certdir="${KEYS_DIR}" \
--certificate='CoreOS Secure Boot Certificate' \
--sign
done
# Sign the delta, with the Secure Boot signed kernel.
./core_sign_update \ ./core_sign_update \
--image "${DATA_DIR}/coreos_production_update.bin" \ --image "${DATA_DIR}/coreos_production_update.bin" \
--kernel "${DATA_DIR}/coreos_production_image.vmlinuz" \ --kernel "${DATA_DIR}/coreos_production_image.vmlinuz" \