From 16419c7076c4360a089aa6bdc4d7bd6599a37ae2 Mon Sep 17 00:00:00 2001 From: Chris Coulson Date: Tue, 28 Nov 2023 13:00:16 +0000 Subject: [PATCH] efi: resurrect a deleted test key https://github.com/snapcore/secboot/pull/274 deleted a test key that was used by the mock dual signed shim. Rather than resurrecting the entire certificate chain, this brings back one deleted leak key and then uses this to create one of the signatures on the mock dual signed binary. --- efi/pe_test.go | 4 +- .../amd64/mockgrub1.efi.signed.shim.1 | Bin 5056 -> 5056 bytes efi/testdata/amd64/mockshim.efi.signed.1.1.1 | Bin 7304 -> 7304 bytes ...+1.1.1 => mockshim.efi.signed.1.2.1+1.1.1} | Bin 9136 -> 9096 bytes .../mockshim_initial_sbat.efi.signed.1.1.1 | Bin 6744 -> 6744 bytes .../amd64/mockshim_no_sbat.efi.signed.1.1.1 | Bin 6176 -> 6176 bytes .../mockshim_no_vendor_cert.efi.signed.1.1.1 | Bin 6800 -> 6800 bytes .../amd64/mockshim_vendor_db.efi.signed.1.1.1 | Bin 7304 -> 7304 bytes efi/testdata/buildenv.yaml | 72 +++++++++--------- .../src/keys/TestUefiSigning1.2.1.key | 27 +++++++ tools/make-efi-testdata/apps.go | 6 +- tools/make-efi-testdata/certs.go | 14 ++++ 12 files changed, 82 insertions(+), 41 deletions(-) rename efi/testdata/amd64/{mockshim.efi.signed.2.1.1+1.1.1 => mockshim.efi.signed.1.2.1+1.1.1} (77%) create mode 100644 efi/testdata/src/keys/TestUefiSigning1.2.1.key diff --git a/efi/pe_test.go b/efi/pe_test.go index c9f0f2ea..8b0304bc 100644 --- a/efi/pe_test.go +++ b/efi/pe_test.go @@ -193,8 +193,8 @@ func (s *peSuite) TestPeImageHandleSecureBootSignaturesUnsigned(c *C) { func (s *peSuite) TestPeImageHandleSecureBootSignaturesDualSigned(c *C) { s.testPeImageHandleSecureBootSignatures(c, - "testdata/amd64/mockshim.efi.signed.2.1.1+1.1.1", + "testdata/amd64/mockshim.efi.signed.1.2.1+1.1.1", [][]byte{ - testutil.DecodeHexString(c, "f1260899324e0ba7d98058decd55df34faf9884b5429288e0e67bbb2917e4609"), + testutil.DecodeHexString(c, "713af30678aba44b6c437cfc4fec26d386d3e2fea75b055df010d4af7b11b484"), testutil.DecodeHexString(c, "4c503fa92a4d6ab180962c29aa8324cc873e8f74b259fb28347443ac8fef6af8")}) } diff --git a/efi/testdata/amd64/mockgrub1.efi.signed.shim.1 b/efi/testdata/amd64/mockgrub1.efi.signed.shim.1 index 358fa6f8f55a0b34db2d97b24a31c0f3784813a6..6f73204babcaf8729a7c7b546696074306e7aa47 100644 GIT binary patch delta 299 zcmV+`0o4A$C%`9=*ahWI000V;K>;VT1Oe_43NbMHP0rf8a%~TrCk+07TS6|U@ns?@am?t)`e%#bEXZd3pj(siNsPn zMp2&lDAq!cl8jN{!uaWb1QC9`9~Tx}>$9maAMIEE|Bgc8J&(c$&%@O;BxqF6w|&B| zcg1<-!%)ZE*0Q}kn2)jO_By|-ST5O6U%|P|59lfhupuh*!&P>c*6^b2Yj?pDZt>mH xFfJBhD#7!p7XrN9uAa07#MF#TkfCxA;l7Df46O4}lNDVgM~OxTNk9Mq004^AjbH!( delta 299 zcmV+`0o4A$C%`9=*agRo000V;K>;VT1Oe_43NSS>I59RgG%_-i{1L!^PI3fN-}~W+ z)8jY;1uk#@K=n`rmTCy;5fx~j?Wv31=)Hs8ny9Au|NWT-go{)7zvm|xr&;a&Y2+Ta z!nzi5OcT=&gQOvGnrusdDkJv@>tqrPPJa_Wzlxt`Q8)d8*zN5dhSt2#3rv$|5c}bJ z|4(t8j79L13n5*zlYsE_T7CwQ*Su8mqbIMhk?7c&G!Bt9utRA}18>pbN-pe^Zy?~B xX92|;*_cOGly?hlWzL_(kjI#ud8i5gI6m7>1)_Z|A8$D;VT1Od7k3NbMdtzp# zdNg}P{syq3A=1gdhp0|bb8}|}W`)fpJw`0eL(<4SNZ$dEQQF#;WA5g}yjjn32jRN$ zuJU!jHWVK3n56>jB2B;P8e!bwCh}>06F=vUs?638SA}fEC@5rP454upeHVdp|Ad9H zd6k+d`2uFw9gAP7Wgf|MvAFhd|I7pV8wWg1l583puz zu>31e1k6Llda$MD>}{!zVjSNmpWA6op-KAQoU(E{YOO!!Z_MQPXKY%je^aPb&1MjW t#lcVaJ5nqJkHn@IFru-|d>$40Li_Koxc`kafHnhz@7u*ylsQrYE0O{rjg$ZY delta 295 zcmV+?0oeYCIfyxs*aZ`&000V;K>;VT1Od7k3NSS>I59RgG%_-i$Qru$;lwKW6X7*k)t#JEk^198w4`l1M~4a1$oZ!peTjt9>Ikhgrfg%|(; diff --git a/efi/testdata/amd64/mockshim.efi.signed.2.1.1+1.1.1 b/efi/testdata/amd64/mockshim.efi.signed.1.2.1+1.1.1 similarity index 77% rename from efi/testdata/amd64/mockshim.efi.signed.2.1.1+1.1.1 rename to efi/testdata/amd64/mockshim.efi.signed.1.2.1+1.1.1 index aa936687d9d46806d7589a03b3f3b117cc213912..70a332d632d472060ae7f72baa73088849021e5e 100644 GIT binary patch delta 1200 zcmV;h1W)_0M~Fv|*ahs{000V;K>;U|1OX@k0JALtTNJaf95n#}GLy*`Ba;apmw)Z3 zezAJ?W(Y`sx?(r#Ze&YN`xMHmDWzdtN7OSYfj~gYQa)sXqtR5D=AVcz(r`{T9<3T- zzb)0&`~A3Th!9teE4MA+xAJ9&Keqf#PdNl+8nmN!@8xK<=nX{OA*3 z?CUS|7n*D<-HbXPr{iPb4D#fHLO>9VSTBzoLbykeq%K8Ogt@v`-@zR1L{01}-TfIy z=b9vX{>p=O*VfoNAai?h#|N!``mCQW^&`y}QR5F3nJ^y)163U(1Q;+DfE3W9o(TdfG7iGI_6fakGnl03 zva&D@1_>&LNQU*S0Jtm)Q2`NbZi_vRH{FHZ3!Z zdr&5}arjmX*bK%(;}1BPTnS2P01SA>fIQLN;LDO-!j=0U5}zwo_YkA@y{@zAO23%g zV>yOK1_Jc8j5Na_3y$!OKoccRlQ1E20Wy=F8bb;(F)}zYGBq?YG?VZlz<(BkrNdl0 zw=Z`|{eIK`pFQZq1>r|9y8{7v)LAwRcuYrak8RtGe@z4i*atv1ZrT!nNzZ5X=*xtF zm&_f~uRY$a3d%NLD1&Een?CMOEl~V(2Z)5M(@CiAab(*1A;lHVFffIV%Bz9K92fVq-T;09e0d|}9x%v(^J zz>ph(URY{9J56vn2MoF`xd;fqfc7N#^{=15D#h!H&^mx+MH}GsbQQ8-tywX4pln<% z+#-iY8uJzVF3Yf%`q8(CO2TQ-00qggoXJ~r;X}N$a-MRpZshpL=3vrFt}bME(Y_q9M}BzK5tzQFC)=1!jfKBt1qf%|p`2 zJxJdHk5Ss%mSgVb#JpM0atGnM@vic9z%~>f@0g_m>>^FS=^A0&;U@BFeG@U^t;WU> zI%=&y=5Ng8_h)Qcseel?#0LJ&-Fy@vui;anrnA+pJX%e;$Wq#&K*o8_=`4yVQYInwH)VXb1-I*wq z3K1r9OY$R{j);UMEz*yRCFDnXoa>MK*X+eAp|H5ABpV z8(@KW32BYlW;BS>f(2;6^>thi9}8neF^@)&Hh`x8dI){2b6h+-GJ<6$xnSZAO-ucr zgo$A=?|$yVK8LZix%V`VUENE^dsEU=^;wdu1rGWrY|F$$C;Qu!0|KiWV=|-GR}kh; z9^PF`P0N?|;q#XCqutLUzuGjfHFJ)&5-n+FicY5KVb(9x^KC~r0^SgE&7QL6;dY9; z$oNu0UAAD1~U(q4Ikz{eJNFYk~w!qNy3G-O{(Au=X-& z4nxAh(s@%Vec7N`aihFzZd3G_NsZm$_V90rP0Tg0pg}4o?fB=8QjKXI3$-T%XJnD; z^E>_vi2SccKvxq2;{yN$Qz7zvd<|f{TD)q|Bc5}+7SZqYWQBRjBSQR9exS^4IS_rX zC0SPUz$0tJ$`zxyiCW`RbtoPQZ8XbH>~til)01=&h_GsHhp3?bj0#!2pA`3MHpWnt z8~h?WNqr@&%<{g+0WjgYzkMB^bUpO=WC_}W^0Y2fzTPm%gm1+j*o*OcQ-7*{dp^MG zWyIR1pr@YX-?l}b(P2zm0ObY>G)KQO)R{bEk6@@{hdwt+9f3u_EN zft*y8_e^8V@Q=+TJ~VT6!Rb%{0NLPoPM9F!Zg53_6p}s3jTB=4Ybr|Q@5Tgxq(rFquC#|-bL{kcUgN$@rc@S{-G0rh0ilK;Htt_ z7%flFOx_l(3oVQ@Kewoipn5NVP}@4{&M-ayD!-==uFG#m-0LgviglyNM5?Fk(oY`?xMxb6WyfIUG*ccjrSv5(u1wW>5qGewJ!ZrW$G9}$bVoeJEGJS` z%ftLnc}gZxcqA1DMGm)4y&zZ`8Jud!(%T%O}RT8zeA0@0F$EsvmcstGi!vRA( zta50^oL^lUJ>RMrn@9cp4`Z@Y{8;8&MJ++@UN;a+)`V%TkZyFeFZQ%7(q$GcWRh~l z5I1$AzK{2UE`)6#@hNtFKGXGKOH9pg>L(rQqHyYSM~l81^C3?CE(x3$9bR?-#-!L&f#~08?07^Z)<= diff --git a/efi/testdata/amd64/mockshim_initial_sbat.efi.signed.1.1.1 b/efi/testdata/amd64/mockshim_initial_sbat.efi.signed.1.1.1 index ffc70d0ebe350afe29aaa8994e9c1091a84c7175..218f6f83e0c7052f0168746ea34a9328c4564fc6 100644 GIT binary patch delta 295 zcmV+?0oeZ7G}ttd*aei_000V;K>;VT1ObW{3NbM9r+uS2!iTVnpb zG$RN$nb1n)0d?d*C9|dvTZZ!{|A;5~coV9VO5iY(Mr$@Kx5oAwI7OPV;rh8T8-v1% zp=eay`Q6z16i-`H5Wh+YV+J<687_qPsa5_5Z~D)jFR7>%f{#AM4h;9Jbwm)KXkLLjHY(`xKPN+ delta 295 zcmV+?0oeZ7G}ttd*acG-0RRe;VT1ObW{3NSS>I59RgG%_-im>9r+cT!Yb;UjeP z27oMw9C%0#LNiF8`Tj5r8*N{86Mpl3A04DZF5O;M@YX!XHvgg#KG1d&3>Zsu^=u3y zlqTPB1eQ;?iwClHH!?2^kt9;mKfYv**pAZ$!f??bybqPU^|{gn4D7j(<|4{f)E;8t z=vAeNTvL30je*Se*IGG$cV|M1^#}94(ET971Ra~+#=zOx6a42?#{d^@aI;Mhk!4e2 zlavZlGg}=xjex*$%tvezpxo*s3t{Zw5mVb6gYhX~-0D$Z<5Qt#@E~@R~p!lm;632=xDA2^j-^qhOqzu diff --git a/efi/testdata/amd64/mockshim_no_sbat.efi.signed.1.1.1 b/efi/testdata/amd64/mockshim_no_sbat.efi.signed.1.1.1 index dd6c31eecaee4cd23e78257373eb3760f4c97064..b66819e89b41f0222aab0b015b9df948ebbf377d 100644 GIT binary patch delta 295 zcmV+?0oeYaFrYAy*ah?D000V;K>;VT1OZYN3NbM3lCZfm7_dHh8N zmeQns;1kw*N-U#&<*Ns#P&;$yTN#tM`<+p)e;mcU_UU8EU zO3J(i+>@z~yOS+~%ak%ld10F?94NG-*TuP!| trnSwo@Xl-VMs#im>O^vVaxGP+xzAwlSbGLG1!oh3(8}fs>Jb70u?%dMhp_+v delta 295 zcmV+?0oeYaFrYAy*ab{b000V;K>;VT1OZYN3NSS>I59RgG%_-iU>3lCThyLp5W-sb zWKCXk^Z3+yC%PmC@H3E8e&Ct!5gYklCfKdR**{~~0#=XtKM-xdJ3S|M$i&H((Da`= zq}9kGKodL-hyP$>-{uz?+)-K0C!=#qw7(Bn#hv(Hj-antDkO0Ba`EAmwmr?2mDq^R z%DNIm&wr#eG|VyxzuFRid(oz~hu?CdfxiDn#+E-NB#a-{y2C>%(S1;e*vR)CUyR~` z_xOF*zuoq7_rfK^!Bv3nkxZ$=&wGA*XuV84-e&b`U5lGtHYJl%O&6bzV_AG6d)Z&| tBKy2WQvF&yIYCQ0zGwJ~l689nb7d~*YuwH19<^4v!F2zQn*iJb)xzgZlPdrK diff --git a/efi/testdata/amd64/mockshim_no_vendor_cert.efi.signed.1.1.1 b/efi/testdata/amd64/mockshim_no_vendor_cert.efi.signed.1.1.1 index daaff3f1bba61dbeb8375bb635d37f0b496290d0..3ab45db67efed11d55fb93e78a1f691ec83e40d5 100644 GIT binary patch delta 295 zcmV+?0oeYKHIOxs*aa$A000V;K>;VT1OdVq3NbMux9Pp)maD)G%7x?UtN4{2vnlK6U=wiZdz+bY|eV_3;7mZxI-3(Rlv2Zrm4I zcfcuLA!qtV3i8vA=Y+v8oX7{t-UuFLJ#azP|50B!>yAgblR69Ad} zoR=Hc%MQ?*)f-fcJuUlxt&y?$TR`sP%`q&E9|>Wh-8sp#=N_WS&2;L1^HU3atEQW| zGBwoBZu(Pz;Hkfyrpc|lwqAb_mOh-aoVjA9hR%}@{=;Q?8F@PZ!!Ri+U95+_TW;*l t<@p-fFEL|T9ei6+g!d&a5*w<~)Qb!`1|Zo?xrVkM(@=|Xfm+Z46BG;VT1OdVq3NSS>I59RgG%_-i&=|mfW4d#VFye}C zm`<1kMv{xQMPHGXV ze@q%G%9~wrIuINs7+H&q$b0vUkjYOWS^-*=X!Q4ALQ9|@`Dg_{CEUy;VT1Od7k3NbM z16_$+dV5OevD?}XWtUNH%EEQ#5#yx-PZK_|I1SQw-Z^mc4~H(W8ti$*Cn?onm)$!Bc+`dYY)Fs-!r1PAdUSBnXykZxF0I>tKBqi ztLd#R0B@|63&)^QKr`RPv5M!AXgS*sGSayzGrx(7#<{ymPoLdNv38M|%YWyMAsRmJ tBy#kARLq^59xdX;{1Wl2%H=5*- delta 295 zcmV+?0oeYCIfyxs*ah;VT1Od7k3NSS>I59RgG%_-i$Qr3#d?{{ozwuz+#dpG0hPAGwZp*jEY$N2d@CWCxT(c6Sd-xKtfUup4Q=!mer zPdrD^oI7<%;~^%;S*_!46nN8On}dWd6h= zi97UR`V)7KP1{(2hl t=