Shim 16.1 - shimx64.efi and shimia32.efi for OpenText ZENworks

[MuthuvelKuppusamy]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/MuthuvelKuppusamy/shim-review/tree/opentext-shim-x64-ia32-20251224

---

What is the SHA256 hash of your final SHIM binary?

---

340a2a6c624f8ac9833c2877002f32ab7886b38e8be9bc0adea4712b1c98b91c shimia32.efi
018bfaa21ed4f954e0dc9c589fcec62f877eb44cf3ae5568df20fe9832e8d422 shimx64.efi

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

#505

---

If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?

---

#505

[MuthuvelKuppusamy]

Due to recent Organization Signing server certificate update from "Global Sign" to "DigiCert" resubmitting the #505 with only certificate changes.

[imedusa]

@MuthuvelKuppusamy I'm on Apple Silicon machine and im unable to cross compile build this repo.
Dockerfile doesn't specify the target architecture for the build, so when running on ARM64 hardware, the make process defaults to building shimaa64.efi (for aarch64) instead of the expected shimx64.efi.

Changes might be needed so that build produces the expected x64 binaries regardless of the host architecture.

[MuthuvelKuppusamy]

Thanks for the review. I have updated the Dockerfile and respective build.log file.

[lorddoskias]

• Build reproduces:

  10 #21 0.194 340a2a6c624f8ac9833c2877002f32ab7886b38e8be9bc0adea4712b1c98b91c  /shim-16.1/build-ia32/shimia32.efi
   8 #21 0.196 018bfaa21ed4f954e0dc9c589fcec62f877eb44cf3ae5568df20fe9832e8d422  /shim-16.1/build-x64/shimx64.efi

• Upstream 16.1 sources are used and a single patch is applied which was already reviewed and deemed fine
• NX flag is not set
• SBAT looks sane:

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.OTZENworks,1,OpenText,shim,16.1,https://www.opentext.com/

• Keys are stored in a codeseal server, as per the previous explanation this relies on secure Azure infrastructure so should be considered safe.

• Certificate is ok, only minor thing is it's not including the CA attribute, however given it's a code signing certificate this is not needed :

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0a:d8:65:49:f2:55:bb:7e:1a:6b:d8:ba:1a:b9:90:2b
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, O = "DigiCert, Inc.", CN = DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
        Validity
            Not Before: Sep 23 00:00:00 2025 GMT
            Not After : Sep 22 23:59:59 2028 GMT
        Subject: jurisdictionC = CA, businessCategory = Private Organization, serialNumber = 1083604-4, C = CA, ST = Ontario, L = Waterloo, O = Open Text Corporation, CN = Open Text Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (4096 bit)

           X509v3 Basic Constraints: 
                CA:FALSE

• Kernel/modules are92 taken from SuSE

Overall looks good.