mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-09-28 17:11:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

Reuse Secure Boot EFI variables image prepared by Gentoo

Browse Source 
Rather than starting with a blank image, reuse the image that already
has the Microsoft certificates and the latest DBX revocation list
applied. Gentoo also applies the Red Hat certificates, which we don't
need, but this is okay.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
This commit is contained in:
James Le Cuirot 2024-10-02 17:59:29 +01:00
parent e50fe0a7e4
commit c0b58cf56b
No known key found for this signature in database
GPG Key ID: 1226415D00DD3137
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
build_library/vm_image_util.sh
View File

@ -865,27 +865,30 @@ _write_qemu_uefi_secure_conf() {
local flash_ro="$(_dst_name "_efi_code.qcow2")" local flash_ro="$(_dst_name "_efi_code.qcow2")"
local script="$(_dst_dir)/$(_dst_name ".sh")" local script="$(_dst_dir)/$(_dst_name ".sh")"
local owner="00000000-0000-0000-0000-000000000000" local owner="00000000-0000-0000-0000-000000000000"
local flash_in
_write_qemu_uefi_conf _write_qemu_uefi_conf
case $BOARD in case $BOARD in
amd64-usr) amd64-usr)
cp "/usr/share/edk2/OvmfX64/OVMF_CODE_4M.secboot.qcow2" "$(_dst_dir)/${flash_ro}" cp "/usr/share/edk2/OvmfX64/OVMF_CODE_4M.secboot.qcow2" "$(_dst_dir)/${flash_ro}"
flash_in="/usr/share/edk2/OvmfX64/OVMF_VARS_4M.secboot.qcow2"
;; ;;
arm64-usr) arm64-usr)
# This firmware is not considered secure due to the lack of an SMM # This firmware is not considered secure due to the lack of an SMM
# implementation, which is needed to protect the variable store, but # implementation, which is needed to protect the variable store, but
# it's only supposed to be used for testing anyway. # it's only supposed to be used for testing anyway.
cp "/usr/share/edk2/ArmVirtQemu-AARCH64/QEMU_EFI.secboot_INSECURE.qcow2" "$(_dst_dir)/${flash_ro}" cp "/usr/share/edk2/ArmVirtQemu-AARCH64/QEMU_EFI.secboot_INSECURE.qcow2" "$(_dst_dir)/${flash_ro}"
flash_in="/usr/share/edk2/ArmVirtQemu-AARCH64/QEMU_VARS.secboot_INSECURE.qcow2"
;; ;;
esac esac
virt-fw-vars \ virt-fw-vars \
--inplace "$(_dst_dir)/${flash_rw}" \ --input "${flash_in}" \
--output "$(_dst_dir)/${flash_rw}" \
--set-pk "${owner}" /usr/share/sb_keys/PK.crt \ --set-pk "${owner}" /usr/share/sb_keys/PK.crt \
--add-kek "${owner}" /usr/share/sb_keys/KEK.crt \ --add-kek "${owner}" /usr/share/sb_keys/KEK.crt \
--add-db "${owner}" /usr/share/sb_keys/DB.crt \ --add-db "${owner}" /usr/share/sb_keys/DB.crt
--secure-boot --no-microsoft
sed -e "s%^SECURE_BOOT=.*%SECURE_BOOT=1%" -i "${script}" sed -e "s%^SECURE_BOOT=.*%SECURE_BOOT=1%" -i "${script}"
} }