Signed shim signature cannot be verified by UEFI BIOS (signed using sbsign tool)
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 1.1k
- Forks
- 348
- PR merge metrics
- No merged PRs in 30d
Description
I have created shim.efi using the Makefile in https://github.com/rhboot/shim. Signed the generated shim.efi using the keys generated by openssl and the sbsign executable. (Command sbsign --key shim.key --cert shim.crt). I got the following warning message " warning: data remaining[1034752 vs 1159672]: gaps between PE/COFF sections?".
The generated efi did not pass the signature validation check in the new BIOS.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the shim Makefile and reproduce the reported signing command, sbsign --key shim.key --cert shim.crt, using the generated shim.efi. Investigate the data remaining warning and compare the resulting signature validation behavior with the new UEFI BIOS. Done means the signed image passes BIOS signature validation or the incompatibility is documented with a clear diagnosis.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- build-system, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100