d5754cbe76
New git repo cgcs-root/public-keys is available now for public
keys used in secure boot process.
This commit moves below keys to this git repo:
boot_pub_key
tis-boot.crt
tis-shim.der
TiBoot.crt
Please pay attention to that tis-boot.crt(pem) and TiBoot.crt(der)
are the same pub key with different formats in fact, which are used
in different user cases.
Test plan:
The tests are done with all the changes which involve
public-keys/integ/root repos for this enhancement about pub keys.
- PASS: rebuild gurb-efi/efitools/shim packages;
- PASS: follow the process to build iso image for secure boot;
- PASS: installation test on AIO-DX lab with secure boot enabled;
- PASS: check that the CERTS/TiBoot.crt in the disk mounted from
the efi.img in the iso image is same with the one in
this git repo.
Story: 2009221
Task: 47358
Signed-off-by: Li Zhou <li.zhou@windriver.com>
Change-Id: I540875293548d4b3e191ea50445ad4dfc5d53a51
The keys under this directory are the public keys used in
the verification process of secure boot process for StarlingX
debian.
Keys Introduction:
tis-boot.crt: it is the public key flashed into BIOS to verify
bootx64.efi (signed shim image shimx64.efi) and mmx64.efi
(signed shim tool image);
tis-shim.der: it is the public key used by shim to verify
grubx64.efi (signed grub image);
boot_pub_key: it is the public key used by grub to verify signed
kernel image and initramfs image and efitools image and so on.
TiBoot.crt: it is the same pub key with tis-boot.crt (pem) as a
der format. It is installed as /CERTS/TiBoot.crt in the efi.img
which is in the iso image.
The following ways can be used to create substitute keys:
(1)example to create tis-boot.crt/TiBoot.crt
openssl req -new -x509 -newkey rsa:2048 -keyout BOOT.priv -outform DER -out BOOT.der -days 36500 -subj "/CN=My Boot/" -nodes
openssl x509 -inform der -in BOOT.der -out BOOT.pem
cp BOOT.pem tis-boot.crt
cp BOOT.priv tis-boot.key
cp BOOT.der TiBoot.crt
The tis-boot.crt and tis-boot.key are used to sign images mentioned above.
The tis-shim.crt/tis-shim.der/tis-shim.key can be created in the same way.
(2)example to create boot_pub_key
************
#!/bin/bash
key_dir="./"
priv_key="${key_dir}/BOOT-GPG-PRIVKEY-SecureBootCore"
pub_key="${key_dir}/BOOT-GPG-KEY-SecureBootCore"
name_real="SecureBootCore"
pw="PASSWORD"
USE_PW="Passphrase: PASSWORD"
cat >"${key_dir}/gen_keyring" <<EOF
Key-Type: RSA
Key-Length: 4096
Name-Real: ${name_real}
Name-Comment: EXAMPLE
Name-Email: a@b.com
Expire-Date: 0
${USE_PW}
%commit
%echo keyring ${name_real} created
EOF
gpg --homedir "${key_dir}" --batch --yes --gen-key "${key_dir}/gen_keyring"
gpg --homedir "${key_dir}" -k
gpg --homedir "${key_dir}" --export --armor "${name_real}" > "${pub_key}"
gpg --homedir "${key_dir}" --export-secret-keys --pinentry-mode=loopback --passphrase "${pw}" --armor "${name_real}" > "${priv_key}"
gpg --homedir "${key_dir}" --export "${name_real}" > ${key_dir}/boot_pub_key
************
The BOOT-GPG-PRIVKEY-SecureBootCore is used to sign images mentioned above.