Shim 16.0 for VyOS (amd64)

[c-po]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/vyos/shim-review/tree/vyos-shim-16.0-amd64-20250707

---

What is the SHA256 hash of your final SHIM binary?

---

64c945dd275a6d95cb97a79a208b3ddcc6fb42706e67de58206c77d023c7ef99

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

N/A

---

If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?

---

N/A

[steve-mcintyre]

Several of the checklist items are not filled in...

[c-po]

Several of the checklist items are not filled in...

I did not check them on purpose. The public key portion is there, but we use vendor db over vendort cert, which is why I did not check it.

We also do not have additional patches to GRUB which is why I did not check it because we use Debian upstream Grub.

I think I was wrong - should I check them, too?

[steve-mcintyre]

Please do, yes. In those cases, describe things in the README.md

The checklist makes it easier for us to see that all the submission steps have been at least considered.

[c-po]

Done and all outlined in the README.md of the shim-review.

[steve-mcintyre]

New vendor, so 3 reviews needed.

Contact verification emails sent.

[c-po]

Identity confirmation email received:

halos harbingers bankrolling sulfates executioners anesthetized tromps lodged Cotton ecumenical

[dmbaturin]

I also received the identity confirmation message:

coordinated sulked costings Holmes Fleming diversions porterhouses bubble lisped aquariums

[aceos-workspace]

I'm not an official reviewer, but I want to help speed up reviewing.

• Build is reproducible with the same sha256sum:

#24 [21/23] RUN sha256sum /efi-boot-shim/shim*.efi /shim-review/$(basename /shim/shim*.efi)
#24 2.104 64c945dd275a6d95cb97a79a208b3ddcc6fb42706e67de58206c77d023c7ef99  /efi-boot-shim/shimx64.efi
#24 2.104 64c945dd275a6d95cb97a79a208b3ddcc6fb42706e67de58206c77d023c7ef99  /shim-review/shimx64.efi

• Revoked certs in dbx - None, first submission

• Embedded certs are CA certs:

  Debian cert, 30 years expiry date:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            ed:54:a1:d5:af:87:48:94:8d:9f:89:32:ee:9c:7c:34
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=Debian Secure Boot CA
        Validity
            Not Before: Aug 16 18:09:18 2016 GMT
            Not After : Aug  9 18:09:18 2046 GMT
        Subject: CN=Debian Secure Boot CA
        ...
        X509v3 extensions:
            Authority Information Access: 
                CA Issuers - URI:https://dsa.debian.org/secure-boot-ca
            X509v3 Authority Key Identifier: 
                6C:CE:CE:7E:4C:6C:0D:1F:61:49:F3:DD:27:DF:CC:5C:BB:41:9E:A1
            Netscape Cert Type: critical
                SSL Client, SSL Server, S/MIME, Object Signing, SSL CA, S/MIME CA, Object Signing CA
            X509v3 Extended Key Usage: 
                Code Signing
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                6C:CE:CE:7E:4C:6C:0D:1F:61:49:F3:DD:27:DF:CC:5C:BB:41:9E:A1
    Signature Algorithm: sha256WithRSAEncryption
    ...

Vyos cert, 100 years expiry date, seems too long?:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            35:b6:f8:e1:8f:e9:65:79:f7:f6:0c:62:a8:2b:3d:b0:27:0c:1c:4b
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=VyOS Networks Secure Boot CA
        Validity
            Not Before: Apr 26 09:07:03 2025 GMT
            Not After : Apr  2 09:07:03 2125 GMT
        Subject: CN=VyOS Networks Secure Boot CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)
                ...
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                78:99:6C:D5:B5:0A:E3:7A:C8:DB:82:85:DF:94:6F:57:F1:D1:E5:46
            X509v3 Authority Key Identifier: 
                78:99:6C:D5:B5:0A:E3:7A:C8:DB:82:85:DF:94:6F:57:F1:D1:E5:46
            X509v3 Basic Constraints: critical
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
    ...

• Key in HSM

• SBAT sections look reasonable:

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.vyos,1,VyOS,shim,16.0,https://github.com/vyos/efi-boot-shim.git

• Patch from official merged PR.

• NX flag not set:

objdump -x shimx64.efi | grep -E 'SectionAlignment|DllCharacteristics'
SectionAlignment	00001000
DllCharacteristics	00000000

Others seems good.