rhboot / rhboot/shim

certmule discovery doesn't work when network booting

Open
#482 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
1.1k
Forks
348
PR merge metrics
No merged PRs in 30d

Description

In https://github.com/rhboot/shim/commit/35d7378d29b9ad6f664df20efc4121e210859e65, we add a method of discovering wrapped certificates to import for validation, but it relies on opening a directory and doing efi_status = dir->Read(dir, &buffersize, buffer);. This doesn't work when booting from TFTP, HTTP, or HTTPS, because they don't present directories in a structured way.

We need a different discovery method that takes that into account. The typical way we do this is to have a template like "cert####.efi", and we iterate our load directory looking for cert0000.efi, cert0001.efi, through certffff.efi until we get an error.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the certificate-discovery method introduced by commit 35d7378d29b9ad6f664df20efc4121e210859e65, especially the directory Read call described in the issue. Check how discovery behaves over TFTP, HTTP, and HTTPS, then compare it with the existing load-directory lookup patterns. Done means wrapped certificates can be found through the cert0000.efi–certffff.efi template when network booting.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.