diff options
Diffstat (limited to 'raveos-center/secureboot')
15 files changed, 683 insertions, 0 deletions
diff --git a/raveos-center/secureboot/adat/KEK.pem b/raveos-center/secureboot/adat/KEK.pem new file mode 100644 index 0000000..5a49691 --- /dev/null +++ b/raveos-center/secureboot/adat/KEK.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDVzCCAj+gAwIBAgIUcKsPl6DDusNNC3vQNBhvFjw+vIwwDQYJKoZIhvcNAQEL +BQAwMzEPMA0GA1UECgwGUmF2ZU9TMSAwHgYDVQQDDBdSYXZlT1MgS2V5IEV4Y2hh +bmdlIEtleTAeFw0yNjEwMDIyMTU5MTNaFw0zNjA5MjkyMTU5MTNaMDMxDzANBgNV +BAoMBlJhdmVPUzEgMB4GA1UEAwwXUmF2ZU9TIEtleSBFeGNoYW5nZSBLZXkwggEi +MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrz7sOnYkci8zut/0BmGbdftPk +3cSBn3/rOaY4RMgQ8gsntAQRRnOp1NHsu87/9u0qk+n4qgqX/EZBRYZozfEI3Xu5 +4h0LbZwsOFItaellUEw+Jfviz1ZCGj6cPRqtS/rZNMd2/6qdFc+hnz4FjRHX6cYM +WWuYBhUgjSbGncsh0qWg0BLVzwniD9rO/NQ7nCP2ZNnkllG9HRffIFzJjmP1/DfN +jXorb4egi7EFPFFgddB4wM6DeXd8GhosJD1ilW2W2Ww8Xu/R9IXTSOefG3sZLZKf +jaj7kmYNmkRrr0aQ2pSwC4lDsba7Yob6zsuDMyPjbSiPqTzZ12RXV7UdKN47AgMB +AAGjYzBhMB0GA1UdDgQWBBTVBDvn/UGvO9uqzh6Yb7Lw59LvhzAfBgNVHSMEGDAW +gBTVBDvn/UGvO9uqzh6Yb7Lw59LvhzAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB +/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOCAQEAFhnk0GsalDm66gp+yrWTiP/9vVny +RD3RdryYxTcpPAjRAmmAdgPGE6IxX5cfkgYw+OdvBmDJah4p9Z945NF3Emjm3xlY +2RmDI4IGeBTBKKt03cx69fdvUyuQAqx9mBoGywolUk3mWi8LK2YLU0NPuKCuduw1 +UFw5NEkwJg9Awo0YKTZHxMrHkftXY5CAUi6H0VeYJlpMiaRPInEYIYJuMVEWFaL4 +wsFC6pTHwYsMH9yrijzcMQ2PSZeZi8jGPCG4LifVzv/VwHxgwvK9Byy5yVvFvVCT +h2A0T27Qxf23Xbu/wh/rgaM/cSg8gsFidqyTEyeCEDYyxSIk1lzsuT+zrw== +-----END CERTIFICATE----- diff --git a/raveos-center/secureboot/adat/PK.auth b/raveos-center/secureboot/adat/PK.auth Binary files differnew file mode 100644 index 0000000..b546b2c --- /dev/null +++ b/raveos-center/secureboot/adat/PK.auth diff --git a/raveos-center/secureboot/adat/PK.pem b/raveos-center/secureboot/adat/PK.pem new file mode 100644 index 0000000..558c178 --- /dev/null +++ b/raveos-center/secureboot/adat/PK.pem @@ -0,0 +1,20 @@ +-----BEGIN CERTIFICATE----- +MIIDTzCCAjegAwIBAgIUTwsILq1KfHS0nLE9ylandBBWErcwDQYJKoZIhvcNAQEL +BQAwLzEPMA0GA1UECgwGUmF2ZU9TMRwwGgYDVQQDDBNSYXZlT1MgUGxhdGZvcm0g +S2V5MB4XDTI2MTAwMjIxNTkxM1oXDTM2MDkyOTIxNTkxM1owLzEPMA0GA1UECgwG +UmF2ZU9TMRwwGgYDVQQDDBNSYXZlT1MgUGxhdGZvcm0gS2V5MIIBIjANBgkqhkiG +9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0BfhuL/qkkT2w52O+lDV1UebAJvWT1six9MJ +pbxbO8NVhvQnwSK2mixYhvfOQVctW7ww7pN6eFk3e/j3IyWUHDhUZbwA4/4d6TpM +MJQoLkfNN/Xa5+eNKWGFaOQOQ+qDAPy9rNYvqHPCS8f9pEOsLFW7vhlTsmtr3qeX +E2rLXPVdQmLuzsKTvHbKWbI4ofxqBU44TAU0FVXAaC5OWDSwYuRwr0WZgFXxnn2e +G4qA7/Uix8esq6eLR+mYDK63w2iMnraHmXiCcK5W+2jDflkns87EeKRJpWAqleUI +L3LDotB/TzjM59Nx5QFAGho42qMS46ea8oluAXZTs+lWSFdd3wIDAQABo2MwYTAd +BgNVHQ4EFgQUtFZf8lEVkLs+PQe3U3LFwExzuTkwHwYDVR0jBBgwFoAUtFZf8lEV +kLs+PQe3U3LFwExzuTkwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYw +DQYJKoZIhvcNAQELBQADggEBAA6zG2QTdZUsgKrhLMabO5exce7yGuhsFB0uRe2F +ooa6RfswSRe4QNUdnAcLNsqSNMRAJ4Pboz7bi2zp4QPkZh92EADG/UWUXQJEzl25 +s8QsIJAr88Qf1fXG07kz0JBBh1A7MzoSaNZ4JLdoovAFkZuG7pHIT4VxnqpzYS2c +0w2EqPtqubTzPqt6wZ191QtPp1Jif6WL95VapGVpqGzQKo6msirdNcGrIX0JR7Lm +CrmIkh5HogWYzY3YYmEbjbM5uK0019NZg5vAmLCy6P6SHq5+feUd1ae02EfW0FTa +udszl9fXtWlmoioffvRvpZ7VBXXPnXv7Ca6nDxgEVAjNYgg= +-----END CERTIFICATE----- diff --git a/raveos-center/secureboot/adat/db.pem b/raveos-center/secureboot/adat/db.pem new file mode 100644 index 0000000..c9ed693 --- /dev/null +++ b/raveos-center/secureboot/adat/db.pem @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDYjCCAkqgAwIBAgIUapoezG6LBdbRhKoNniRol3q6Ui4wDQYJKoZIhvcNAQEL +BQAwLjEPMA0GA1UECgwGUmF2ZU9TMRswGQYDVQQDDBJSYXZlT1MgU2VjdXJlIEJv +b3QwHhcNMjYxMDAyMjE1OTEzWhcNMzYwOTI5MjE1OTEzWjAuMQ8wDQYDVQQKDAZS +YXZlT1MxGzAZBgNVBAMMElJhdmVPUyBTZWN1cmUgQm9vdDCCASIwDQYJKoZIhvcN +AQEBBQADggEPADCCAQoCggEBAJjE+etmu0Ev7chkgiih4D2AZ02+W9xzp+t8dEBC +P1Sw4xXXG56jBvPzDC48F4u4GZLu/DSDMfpXqg6AvVVaXRXE48E2hIRMCshoLjId +xkl+cGFQ2KvGo+hFItftq8IV1hU0zqtKfxa+eygklim1bjhB6jBsm9bjstbQ/fl3 +j2vPw1yTmpwgx6NgfFLtrXeZ1KGKIAo/kImiqStPyh5cWH72CSG6ppYYiaW5sx+j +f0IqHsyllX/Hoii4NXjAmmTeRXk0c8Mj8B8RZBAx9V3m144j5+z2jRbvYElWxmwU +k1m6VA9x3UZXZxiJ9BwwaL+8TK9UNS8QhOZ+BF5rQjbaeScCAwEAAaN4MHYwHQYD +VR0OBBYEFI/b7ftnyYNFrGMT/WFuwopejtdYMB8GA1UdIwQYMBaAFI/b7ftnyYNF +rGMT/WFuwopejtdYMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgGGMBMG +A1UdJQQMMAoGCCsGAQUFBwMDMA0GCSqGSIb3DQEBCwUAA4IBAQATWkIFkjetX/eQ +Mas/kADYYOeOcTZ/N4ha56aDYicEs2g+jUGSzUBvELhBLLM0TVIn/Qrej175sBox +icwtQJuIUJdZauF8tf217JT+NFRjwAaW7DGdQpeMTLSP5ijhD1XoX8Yp0/00bJiK +/ZjP1CWCgYlJYJyKmU8a0cPPvTWMaL8e8mT/yHvzVrBfUyJrZh9wWJmnym43Rt8X +IuMkuORXy32873J3KOYhVZLZ+o//LDfpAzohDagZaFM5oiXKG24P/mbSAN6HQuki +Q5qh4lr5P4afJPdjiA41sT8Tz/xhRlAGF06KfUXcWKX5qA8+HSb5lo0EapEWEQWC +KPLgKAk1 +-----END CERTIFICATE----- diff --git a/raveos-center/secureboot/adat/installed/raveos-sb-resume.service b/raveos-center/secureboot/adat/installed/raveos-sb-resume.service new file mode 100644 index 0000000..d6005b6 --- /dev/null +++ b/raveos-center/secureboot/adat/installed/raveos-sb-resume.service @@ -0,0 +1,7 @@ +[Unit] +Description=RaveOS Secure Boot beallitas befejezese +[Service] +Type=oneshot +ExecStart=/usr/bin/raveos-secureboot-setup --resume +[Install] +WantedBy=multi-user.target diff --git a/raveos-center/secureboot/adat/installed/raveos-sb-sign-local.sh b/raveos-center/secureboot/adat/installed/raveos-sb-sign-local.sh new file mode 100755 index 0000000..af20118 --- /dev/null +++ b/raveos-center/secureboot/adat/installed/raveos-sb-sign-local.sh @@ -0,0 +1,50 @@ +#!/bin/bash +set -u + +KEY=/etc/raveos/secureboot/machine.key +CERT=/etc/raveos/secureboot/machine.pem +SIGNFILE=/usr/local/bin/raveos-sign-file +[[ -f "$KEY" && -f "$CERT" ]] || exit 0 +command -v sbsign >/dev/null 2>&1 || exit 0 + +signed=0 + +for f in /boot/vmlinuz-* /boot/memtest86+/memtest.efi /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI; do + [[ -f "$f" ]] || continue + case "$f" in *.signed) continue ;; esac + if sbverify --cert "$CERT" "$f" >/dev/null 2>&1; then + continue + fi + if sbsign --key "$KEY" --cert "$CERT" --output "${f}.signed" "$f" 2>/dev/null; then + mv "${f}.signed" "$f" + signed=$((signed + 1)) + fi +done + +if [[ -x "$SIGNFILE" ]]; then + for d in /usr/lib/modules/*/; do + for sub in extramodules updates/dkms extras; do + [[ -d "${d}${sub}" ]] || continue + while IFS= read -r -d '' f; do + modinfo -F signer "$f" 2>/dev/null | grep -q "RaveOS Machine Key" && continue + case "$f" in + *.ko) + "$SIGNFILE" sha512 "$KEY" "$CERT" "$f" >/dev/null 2>&1 && signed=$((signed + 1)) + ;; + *.ko.zst) + tmp="$(mktemp -d)" + if zstd -q -d -c "$f" > "$tmp/m.ko" 2>/dev/null && + "$SIGNFILE" sha512 "$KEY" "$CERT" "$tmp/m.ko" >/dev/null 2>&1 && + zstd -q -f -o "$f" "$tmp/m.ko" 2>/dev/null; then + signed=$((signed + 1)) + fi + rm -rf "$tmp" + ;; + esac + done < <(find "${d}${sub}" -type f \( -name '*.ko' -o -name '*.ko.zst' \) -print0 2>/dev/null) + done + done +fi + +[ "$signed" -gt 0 ] && echo "[raveos-sb] $signed fajl ujraalairva" +exit 0 diff --git a/raveos-center/secureboot/adat/installed/zz-raveos-sb-sign.hook b/raveos-center/secureboot/adat/installed/zz-raveos-sb-sign.hook new file mode 100644 index 0000000..cf64ee2 --- /dev/null +++ b/raveos-center/secureboot/adat/installed/zz-raveos-sb-sign.hook @@ -0,0 +1,17 @@ +[Trigger] +Operation = Install +Operation = Upgrade +Type = Package +Target = linux-cachyos +Target = linux +Target = nvidia +Target = nvidia-dkms +Target = nvidia-open +Target = nvidia-open-dkms +Target = systemd +Target = dkms + +[Action] +Description = RaveOS Secure Boot: bootlanc + out-of-tree modulok ujraalairasa... +When = PostTransaction +Exec = /usr/local/bin/raveos-sb-sign-local.sh diff --git a/raveos-center/secureboot/adat/ms/MicCorKEKCA2011_2011-06-24.pem b/raveos-center/secureboot/adat/ms/MicCorKEKCA2011_2011-06-24.pem new file mode 100644 index 0000000..37c814a --- /dev/null +++ b/raveos-center/secureboot/adat/ms/MicCorKEKCA2011_2011-06-24.pem @@ -0,0 +1,34 @@ +-----BEGIN CERTIFICATE----- +MIIF6DCCA9CgAwIBAgIKYQrRiAAAAAAAAzANBgkqhkiG9w0BAQsFADCBkTELMAkG +A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx +HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjE7MDkGA1UEAxMyTWljcm9z +b2Z0IENvcnBvcmF0aW9uIFRoaXJkIFBhcnR5IE1hcmtldHBsYWNlIFJvb3QwHhcN +MTEwNjI0MjA0MTI5WhcNMjYwNjI0MjA1MTI5WjCBgDELMAkGA1UEBhMCVVMxEzAR +BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p +Y3Jvc29mdCBDb3Jwb3JhdGlvbjEqMCgGA1UEAxMhTWljcm9zb2Z0IENvcnBvcmF0 +aW9uIEtFSyBDQSAyMDExMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +xOi1ir+tVyawJsPq5/tXekQCXQcN2krldCrmsA/sbevsf7njWmMyfBEXTw7jC6c4 +FZOOxvXghLGamyzn9beR1gnh4sAEqKwwHN9I8wZQmmSnUX/IhU+PIIbO/i/hn/+C +wO3pzc70U2piOgtDueIl/f4F+dTEFKsR4iOJjXC3pB1N7K7lnPoWwtfBy9ToxC/l +me4kiwPsjfKL6sNK+0MREgt+tUeSbNzmBInr9TME6xABKnHl+YMTPP8lCS9odkb/ +uk++3K1xKliq+w7SeT3km2U7zCkqn/xyWaLrrpLv9jUTgMYC7ORfzJ12ze9jksGv +eUCEeYd/41Ko6J17B2mPFQIDAQABo4IBTzCCAUswEAYJKwYBBAGCNxUBBAMCAQAw +HQYDVR0OBBYEFGL8Q82gPqTLZxLSW9lVrHvMtopfMBkGCSsGAQQBgjcUAgQMHgoA +UwB1AGIAQwBBMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB8GA1UdIwQY +MBaAFEVmUkPhflgRv9ZOniNVCDs6ImqoMFwGA1UdHwRVMFMwUaBPoE2GS2h0dHA6 +Ly9jcmwubWljcm9zb2Z0LmNvbS9wa2kvY3JsL3Byb2R1Y3RzL01pY0NvclRoaVBh +ck1hclJvb18yMDEwLTEwLTA1LmNybDBgBggrBgEFBQcBAQRUMFIwUAYIKwYBBQUH +MAKGRGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2kvY2VydHMvTWljQ29yVGhp +UGFyTWFyUm9vXzIwMTAtMTAtMDUuY3J0MA0GCSqGSIb3DQEBCwUAA4ICAQDUhIj1 +FJQYAsoqPPsqkhwM16DR8ehSZqjuorV1epAAqi2kdlrqebe5N2pRexBk9uFk8gJn +vveoG3i9us6IWGQM1lfIGaNfBdbbxtBpzkhLMrfrXdIw9cD1uLp4B6Mr/pvbNFaE +7ILKrkElcJxr6f6QD9eWH+XnlB+yKgyNS/8oKRB799d8pdF2uQXIee0PkJKcwv7f +b35sD3vUwUXdNFGWOQ/lXlbYGAWW9AemQrOgd/0IGfJxVsyfhiOkh8um/Vh+1Gln +FZF+gfJ/E+UNi4o8h4Tr4869Q+WtLYSTjmorWnxE+lKqgcgtHLvgUt8AEfiaPcFg +sOEztaOI0WUZChrnrHykwYKHTjixLw3FFIdv/Y0uvDm25+bD4OTNJ4TvlELvKYuQ +RkE7gRtn2PlDWWXLDbz9AJJP9HU7p6kk/FBBQHngLU8Kaid2blLtlml7rw/3hwXQ +RcKtUxSBH/swBKo3NmHaSmkbNNho7dYCz2yUDNPPbCJ5rbHwvAOiRmCpxAfCIYLx +/fLoeTJgv9ispSIUS8rB2EvrfT9XNbLmT3W0sGADIlOukXkd1ptBHxWGVHCy3g01 +D3ywNHK6l2A78HnrorIcXaIWuIfF6Rv2tZclbzif45H6inmYw2kOt6McIAWX+MoU +rgDXxPPAFBB1azSgG7WZYPNcsMVXTjbSMoS/ng== +-----END CERTIFICATE----- diff --git a/raveos-center/secureboot/adat/ms/MicCorUEFCA2011_2011-06-27.pem b/raveos-center/secureboot/adat/ms/MicCorUEFCA2011_2011-06-27.pem new file mode 100644 index 0000000..d7c29ef --- /dev/null +++ b/raveos-center/secureboot/adat/ms/MicCorUEFCA2011_2011-06-27.pem @@ -0,0 +1,35 @@ +-----BEGIN CERTIFICATE----- +MIIGEDCCA/igAwIBAgIKYQjTxAAAAAAABDANBgkqhkiG9w0BAQsFADCBkTELMAkG +A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx +HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjE7MDkGA1UEAxMyTWljcm9z +b2Z0IENvcnBvcmF0aW9uIFRoaXJkIFBhcnR5IE1hcmtldHBsYWNlIFJvb3QwHhcN +MTEwNjI3MjEyMjQ1WhcNMjYwNjI3MjEzMjQ1WjCBgTELMAkGA1UEBhMCVVMxEzAR +BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p +Y3Jvc29mdCBDb3Jwb3JhdGlvbjErMCkGA1UEAxMiTWljcm9zb2Z0IENvcnBvcmF0 +aW9uIFVFRkkgQ0EgMjAxMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB +AKUIbEzHRQlqSwykwId/BnUMQwFUZOAWfwftkn0LsnO/DArGSkVhoMUWLZbT9Sug ++01Jm0GAkDy5VP3mvNGdxKQYin9BilxZg2gyu4xHye5xvCFPmop8/0Q/jY8ysiZI +rnW17slMHkoZfuSCmh14d00MsL32D9MW07z6K6VROF31+7rbeALb/+wKG5bVg7gZ +E+m2wHtAe+EfKCfJ+u9WXhzmfpR+wPBEsnk55dqyYotNvzhw4mgkFMkzpAg31Vhp +XtN87cEEUwjnTrAqh2MIYW9jFVnqsit51wxhZ4pb/V6th3+6hmdPcVgSIgQiIs6L +71RxAM5QNVh2lQjuarGiAdUCAwEAAaOCAXYwggFyMBIGCSsGAQQBgjcVAQQFAgMB +AAEwIwYJKwYBBAGCNxUCBBYEFPjBa7d/d1NK8yU3HU6hJnsPIHCAMB0GA1UdDgQW +BBQTrb9DCb2CcJyM1U8xbtUimIob1DAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMA +QTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRFZlJD +4X5YEb/WTp4jVQg7OiJqqDBcBgNVHR8EVTBTMFGgT6BNhktodHRwOi8vY3JsLm1p +Y3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNDb3JUaGlQYXJNYXJSb29f +MjAxMC0xMC0wNS5jcmwwYAYIKwYBBQUHAQEEVDBSMFAGCCsGAQUFBzAChkRodHRw +Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY0NvclRoaVBhck1hclJv +b18yMDEwLTEwLTA1LmNydDANBgkqhkiG9w0BAQsFAAOCAgEANQhC/zDMzvd2DK0Q +aFg1KUYydid87xJBJ0IbSqptgThIWRNV8+lYNKYWC4KqXa2C2oCDQQaPtB3yA7nz +Gl0b8VCQ+bNVhEIoHCC9sq5RFMXArJeVIRyQ2w/8d56Vc5GIyr29UrkFUA3fV56g +Ye0N5W0l2UAPF0DIzqNKwk2vmhIdCFSPvce8uSs9SSsfMvxqIWlPm8h+QjT8NgYX +i48gQMCzmiV1J83JA6P2XdHnNlR6uVC10xLRB7+7dN/cHo+A1e0Y9C8UFmsv3maM +sCPlx4TY7erBM4KtVksYLfFolQfNz/By8K673YaFmCwhTDMr8A9K8GiHtZJVMnWh +aoJqPKMlEaTtrdcErsvYQFmghNGVTGKRIhp0HYw9Rw5EpuSwmzQ1sfq2U6gsgeyk +BXHInbi66BtEZuRHVA6OVn+znxaYsobQaD6QI7UvXo9QhY3GjYJfQaH0Lg3gmdJs +deS2abUhhvoH0fbiTdHarSx3Ux4lMjfHbFJylYaw8TVhahn1sjuBUFamMi3+oon5 +QoYnGFWhgspam/gwmFQUpkeWJS/IJuRBlBpcAj/lluOFWzw+P7tHFnJV4iUisdl7 +5wMGKqP3HpBGwwAN1hmJ4w41J2IDcRWm79AnoKBZN2D4OJS44Hhw+LpMhoeU9uCu +AkXuZcK2o35pFnUHkpv1prxZg1g= +-----END CERTIFICATE----- diff --git a/raveos-center/secureboot/adat/ms/MicWinProPCA2011_2011-10-19.pem b/raveos-center/secureboot/adat/ms/MicWinProPCA2011_2011-10-19.pem new file mode 100644 index 0000000..0390d2a --- /dev/null +++ b/raveos-center/secureboot/adat/ms/MicWinProPCA2011_2011-10-19.pem @@ -0,0 +1,34 @@ +-----BEGIN CERTIFICATE----- +MIIF1zCCA7+gAwIBAgIKYQd2VgAAAAAACDANBgkqhkiG9w0BAQsFADCBiDELMAkG +A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx +HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9z +b2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTAwHhcNMTExMDE5MTg0 +MTQyWhcNMjYxMDE5MTg1MTQyWjCBhDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldh +c2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBD +b3Jwb3JhdGlvbjEuMCwGA1UEAxMlTWljcm9zb2Z0IFdpbmRvd3MgUHJvZHVjdGlv +biBQQ0EgMjAxMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN0Mu6Lk +Lgnj58X3lmm8ACG9aTMz760Ey1SA7gaDu8UghNn30ovzOLCrpK0tfGJ5Bf/jSj8E +NSBw48Tna+CcwDZ16Yox3Y1w5dw3tXRGlihbh2AjLL/cR6Vn91EnnnLrB6bJuR47 +UzV85dPsJ7mHHP65ySMJb6hGkcFuljxB08ujP10Cak3saR8lKFw2//1DFQqU4Bm0 +z9/CEuLCWyfuJ3gwi1sqCWsiiVNgFizAaB1TuuxJ851hjIVoCXNEXX2iVCvdefcV +zzVdbBwrXM68nCOLb261Jtk2E8NP1ieuuTI7QZIs4cfNd+iqVE73XAsEh2W0Qxio +suBtGXfsWiT6SAMCAwEAAaOCAUMwggE/MBAGCSsGAQQBgjcVAQQDAgEAMB0GA1Ud +DgQWBBSpKQI5jhbEl3jNkPmeT5rhfFWvUzAZBgkrBgEEAYI3FAIEDB4KAFMAdQBi +AEMAQTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBTV +9lbLj+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8vY3Js +Lm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRfMjAx +MC0wNi0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRwOi8v +d3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEwLTA2 +LTIzLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAFPx8cVGlecJusu85Prw8Ug9uKz8Q +E3P+qGjQSKY0TYqWBSbuMUaQYXnW/zguRWv0wOUouNodj4rbCdcax0wKNmZqjOwb +1wSQqBgXpJu54kAyNnbEwVrGv+QEwOoW06zDaO9irN1UbFAwWKbrfP6Up06O9Ox8 +hnNXwlIhczRa86OKVsgE2gcJ7fiL4870fo6u8PYLigj7P8kdcn9TuOu+Y+DjPTFl +sIHl8qzNFqSfPaixm8JC0JCEX1Qd/4nquh1HkG+wc05Bn0CfX+WhKrIRkXOKISjw +zt5zOV8+q1xg7N8DEKjTCen09paFtn9RiGZHGY2isBI9gSpoBXe7kUxie7bBB8e6 +eoc0Aw5LYnqZ6cr8zko3yS2kV3wc/j3cuA9a+tbEswKFAjrqs9lu5GkhN96B0fZ1 +GQVn05NXXikbOcjuLeHN5EVzW9DSznqrFhmCRljQXp2Bs2evbDXyvOU/JOI1ogp1 +BvYYVpnUeCzRBRvr0IgBnaoQ8QXfun4sY7cGmyMhxPl4bOJYFwY2K5ESA8yk2fIt +uvmUnUDtGEXxzopcaz6rA9NwGCoKauBfR9HVYwoy8q/XNh8qcFrlQlkIcUtXun6D +gfAhPPQcwcW5kJMOiEWThumxIJm+mMvFlaRdYtagYwggvXUQd30980W5n5efy1eA +bzOpBM93pGIcWX4= +-----END CERTIFICATE----- diff --git a/raveos-center/secureboot/adat/ms/microsoft corporation kek 2k ca 2023.pem b/raveos-center/secureboot/adat/ms/microsoft corporation kek 2k ca 2023.pem new file mode 100644 index 0000000..771d8ad --- /dev/null +++ b/raveos-center/secureboot/adat/ms/microsoft corporation kek 2k ca 2023.pem @@ -0,0 +1,33 @@ +-----BEGIN CERTIFICATE----- +MIIFsjCCA5qgAwIBAgITMwAAABMUFrhhbYKCSwAAAAAAEzANBgkqhkiG9w0BAQsF +ADBaMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u +MSswKQYDVQQDEyJNaWNyb3NvZnQgUlNBIERldmljZXMgUm9vdCBDQSAyMDIxMB4X +DTIzMDMwMjIwMjEzNVoXDTM4MDMwMjIwMzEzNVowXDELMAkGA1UEBhMCVVMxHjAc +BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEtMCsGA1UEAxMkTWljcm9zb2Z0 +IENvcnBvcmF0aW9uIEtFSyAySyBDQSAyMDIzMIIBIjANBgkqhkiG9w0BAQEFAAOC +AQ8AMIIBCgKCAQEA416Ii3MswwrE6fXOgS3xD/EmNTfRSVNxsVuTUq/hFd/eizm9 +r0xldVPl2goymC8zJrYrvpSZn+zawo4FNJITD2O/dKJyqCl+nzIhKQhZxHfEKpJM +h7YDN+ua4sPJtEghw2GU6hdRsecU4iRjLtXyxqXyol4facZRDacp+1IKm+OI6Gj/ +u/qSaa/EFv9d5V/g3+xmVQthwqw7IG7ftA3rK8jQwjROgpY57vExhQQ979Z2+8PK +wdWMLwsQKJtImrAQFKTZlOVoW81u53rsvKBJuKlT2E0vsnvI2ryy5/yrcBB3lUVJ +/a3SPxfLZpryfTbdCiziwIchLZPbCJbS6FxU4QIDAQABo4IBbTCCAWkwDgYDVR0P +AQH/BAQDAgGGMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBTgq3K8lj7/uGab +fRBaQz5cQlSHXzAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAPBgNVHRMBAf8E +BTADAQH/MB8GA1UdIwQYMBaAFIREhgYAmD8sqrPFifOsLsnmnQkDMGUGA1UdHwRe +MFwwWqBYoFaGVGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01p +Y3Jvc29mdCUyMFJTQSUyMERldmljZXMlMjBSb290JTIwQ0ElMjAyMDIxLmNybDBy +BggrBgEFBQcBAQRmMGQwYgYIKwYBBQUHMAKGVmh0dHA6Ly93d3cubWljcm9zb2Z0 +LmNvbS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwUlNBJTIwRGV2aWNlcyUyMFJv +b3QlMjBDQSUyMDIwMjEuY3J0MA0GCSqGSIb3DQEBCwUAA4ICAQCFAgYS+meuTzmp +uDTcXSp4GXs47pyCjxviPD0yCl6/WAbnb/iNGKgbhPWbyq2LCEQOJo0s2F9uIyUH ++ltMJi52MUMubujIMcFK0vICt6bxdeSW7QbiypV4RKgzdtQrTde83Ic7q00prZaJ +t9XCj6tGw12z/e2lnvV2tyuF/5ihn2scmz737g4Xo/02L+HNKJgcQJkmygONpjXq +0gqnixauIQEAHicPtw6yQjFWLub4juoMNPBO33AwaQTRz9OcZEZvzCHNy+8FMrsI +ptifRThdTtKckonpc+R6CDUeT6bCums+tx9UNEn6tHrL2qAfWYErKvaIJrD6bPLr +wdiuQeFv/L8T6G4U5+fHA4tAmRA4Bm1wvQHI3o1WHTgPTyOoJUDeuygtQ6+kvCCD +tQb5BSGfO7l5DXBrU8B1whsQE7Pkbwmoz9G3DnFct8mP5RzwE1XZk7muXT/KC7BZ +akVKw+HjJ3gNFoH8WC2xQboYDc/w76sIHk/4/Mb9S90d7zAlUDmj3/4/ufrrlpfQ +zfkEJvsNSBkI2OGTwVDHbm3Y0GuOlXJkUMntVYluwUuiBtQytaltZQF68VJXGAUw +XLgoZhG3evBxToZhYHptVsdbCT6i79QOnpLTH5n2nbEdeHhr/+gqBK94Zz7wKgun +4F0B6YeZNTCQ7ddFa5zM5qLk5hen3Q== +-----END CERTIFICATE----- diff --git a/raveos-center/secureboot/adat/ms/microsoft option rom uefi ca 2023.pem b/raveos-center/secureboot/adat/ms/microsoft option rom uefi ca 2023.pem new file mode 100644 index 0000000..139ca44 --- /dev/null +++ b/raveos-center/secureboot/adat/ms/microsoft option rom uefi ca 2023.pem @@ -0,0 +1,33 @@ +-----BEGIN CERTIFICATE----- +MIIFrzCCA5egAwIBAgITMwAAABez7E2PAeJwBQAAAAAAFzANBgkqhkiG9w0BAQsF +ADBaMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u +MSswKQYDVQQDEyJNaWNyb3NvZnQgUlNBIERldmljZXMgUm9vdCBDQSAyMDIxMB4X +DTIzMTAyNjE5MDIyMFoXDTM4MTAyNjE5MTIyMFowWTELMAkGA1UEBhMCVVMxHjAc +BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEqMCgGA1UEAxMhTWljcm9zb2Z0 +IE9wdGlvbiBST00gVUVGSSBDQSAyMDIzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A +MIIBCgKCAQEA0wv+ic3Ntu7c5RqN3MohGg8iLwu1MoQ1wL5vcJNVtEfMSQPC/s+6 +MmVktzW9BDtEZC+g8t3hXbrnvTmavctL4YOqG+hvTkyRUkOlxFBVaPXarEiinOw1 +pwRWaBnisWLUkvSFPzShFWeHIW4fydg1Mrg9y1jKKUNUSn6LVXsjejq2nUMHBGua +a/TwIP/6pt+inknoVcV1iESspEE6A3y76ZPkbPHteSbHizL3WUklMQBnGAxn+0DF +XXY9CYfCLYxfK1oeAQ8zr2UIkE/8ZFuco1zWUxtRAZ+Yz8RTxbHfs2hvRUvIRYXI +Hbie0XdxoNWid4fsZy65hwZG3UFDQGpfLwIDAQABo4IBbTCCAWkwDgYDVR0PAQH/ +BAQDAgGGMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRRT7+Tf6RvtXvwevi+ +2Es7hksXETAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAPBgNVHRMBAf8EBTAD +AQH/MB8GA1UdIwQYMBaAFIREhgYAmD8sqrPFifOsLsnmnQkDMGUGA1UdHwReMFww +WqBYoFaGVGh0dHA6Ly93d3cubWljcm9zb2Z0LmNvbS9wa2lvcHMvY3JsL01pY3Jv +c29mdCUyMFJTQSUyMERldmljZXMlMjBSb290JTIwQ0ElMjAyMDIxLmNybDByBggr +BgEFBQcBAQRmMGQwYgYIKwYBBQUHMAKGVmh0dHA6Ly93d3cubWljcm9zb2Z0LmNv +bS9wa2lvcHMvY2VydHMvTWljcm9zb2Z0JTIwUlNBJTIwRGV2aWNlcyUyMFJvb3Ql +MjBDQSUyMDIwMjEuY3J0MA0GCSqGSIb3DQEBCwUAA4ICAQBKS4D8cbGH3QaLJBDR +dvgQ5GU0obuBCH1w1BUk+ZA7SG9uTiP+hVPsopkfieQ0vtCYr/H4LfNH0bUyZJ7e +csAXfoEgesFfkfVOOqZ7adnQ1vD6gGPFwERn04snYcHl3FGZbiPJKRj+Nb1FIawP ++WDiD9FfcA+SK1hOz6xkLwlz7VAIyOGFc0AsMam0tiNLwBk7/RX408t0VM3au30E +hZ9wFXX5t/RhS/7kn0UO9YLpxfN4u6pq4fe7hZIrr0u1J06aySlvDsjSZGObXRQG +zHh/5BLdluOcBELsF/qSIafe9WmPILJk8z8Vo1GvJ2+3YlevdBfsq7HuqFDvr4OC +q2EEeT9JjEBWwDyv+ypaGR6q5i5nJCGsM/DXSosKJDAQplI+Hcj8kZyHG/qG4Z5r +5QlhdaijOV/in2wOhSHmvXal6kWDaB4vNr/gaIpCzh+4jeFg5pOK7rpKrbNJTO6j +A8mnooZxnIEBZ2kP3oBV1sDecoXARmDwzmAqiAiNnDDrqYtA82ElCeHhgjIEpSn4 +WewmtsjXI/AL02xjatov0tOlJZqaXqX9AqXsopCBaD49RY58BbIu6pkBRf0JMJQm +10os/n2CRDNDVctaQ9KSkv5OR8ZJPzUbIZxq2oL8ZDf7J+r0MN9l7ND8UAE4auzc +Ufb17psmzO5t/i9WDjroOCKOqg== +-----END CERTIFICATE----- diff --git a/raveos-center/secureboot/adat/ms/microsoft uefi ca 2023.pem b/raveos-center/secureboot/adat/ms/microsoft uefi ca 2023.pem new file mode 100644 index 0000000..5c7ad84 --- /dev/null +++ b/raveos-center/secureboot/adat/ms/microsoft uefi ca 2023.pem @@ -0,0 +1,33 @@ +-----BEGIN CERTIFICATE----- +MIIFpDCCA4ygAwIBAgITMwAAABY2vzaJnxV1zAAAAAAAFjANBgkqhkiG9w0BAQsF +ADBaMQswCQYDVQQGEwJVUzEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9u +MSswKQYDVQQDEyJNaWNyb3NvZnQgUlNBIERldmljZXMgUm9vdCBDQSAyMDIxMB4X +DTIzMDYxMzE5MjE0N1oXDTM4MDYxMzE5MzE0N1owTjELMAkGA1UEBhMCVVMxHjAc +BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEfMB0GA1UEAxMWTWljcm9zb2Z0 +IFVFRkkgQ0EgMjAyMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL0i +Kq7vGjGFE3hRp5v9/HjRY7gam2P1EgbbS0E1am+r9WoEzJfPu9QICRphOg3ms6BG +/wmt3oAk3BKA8l/ZFu3iQp3NL01hAmGKHEsdGGI5hpdxrT5/XXETS+kqAMG+1bcA +n15lsiwa/3Tt6oPSOYkzNXN9oKL6QORmUFiq/IfoXCCDNOyr4gvFXz7/SCsRkSbv +GG5XxZ8Yc5nv4Wp0K7svf1COHdo9drYE5cwuEMeDG4Oj5KUTE3FuM3ijqDzsSCZe +x8ZeDYeaqsxVNIGtnZD15pZjpugHIBfIkx7SrqTcrn1Zv4heYgyuW/IpQFYdJkDe +haatVtHPVUd2X5w52wMCAwEAAaOCAW0wggFpMA4GA1UdDwEB/wQEAwIBhjAQBgkr +BgEEAYI3FQEEAwIBADAdBgNVHQ4EFgQUgaprMkTJNbzg1mKK85gnQh4ySX0wGQYJ +KwYBBAGCNxQCBAweCgBTAHUAYgBDAEEwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSME +GDAWgBSERIYGAJg/LKqzxYnzrC7J5p0JAzBlBgNVHR8EXjBcMFqgWKBWhlRodHRw +Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBSU0El +MjBEZXZpY2VzJTIwUm9vdCUyMENBJTIwMjAyMS5jcmwwcgYIKwYBBQUHAQEEZjBk +MGIGCCsGAQUFBzAChlZodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2Nl +cnRzL01pY3Jvc29mdCUyMFJTQSUyMERldmljZXMlMjBSb290JTIwQ0ElMjAyMDIx +LmNydDANBgkqhkiG9w0BAQsFAAOCAgEAB2ATKlOHEg8a81oUlRfl2NeVVJuLDt2R +pe3HXUdQk0W3lYhfFxlBY3a1grCoxZ2ZFTaJSb4Swmb7gwywgc7lpKvCoJrr9Qc8 +/iH4mtwZIQyeJCzRXKIWCkvr7EicsVt02wFkwuOAaqsazXcbajmat7pwRP9nlMWB +BvDLgQSTJyGZvYeIFJwicQ4LL1y+uJBUfMAevCubo1YXS5fn438TNPqwNGub9rIt +99h72CDTXKeVTE8q+eceaK/8bI/Ihj2fyNHvTRrI0fb9LXzj6EHB6ifB+44lhlqJ +phC+zuOPpXvEGqDodZD9IbDBo8UWI148zi/+jJi/CFz2ucWyPLbMyOx/0nd0y+3z +lsmLjRwqiQ+jj73OKoVGmiOij0LAmdbqhR9hGb4WNbd1oJWAZQaH1As1yMSqDs6i +CmNgyksrXCcEgq8+WIN6WthnPxBT9QwW9yZLioC5xR+g3tjTYUQURaf1q5qIF/23 +lFQCi+S3U6E+jZ5QgqgA4HiUG76zxDAfsg7b8EaQweZX/nzBcLIcS2TZEAMbNPtm +z4JunkCoETfyZYshCa88k2I987yD3T9VkBXSMa8R5/jKoILhuc+zV5PHVTesf0G/ +H5Y88yaU+djSVSSKirZB8OAWwCOSjHEKTGoNGVX3OpySIZah1fgKjJ2/yevKiEL8 +S7Tv/ycwIWE= +-----END CERTIFICATE----- diff --git a/raveos-center/secureboot/adat/ms/windows uefi ca 2023.pem b/raveos-center/secureboot/adat/ms/windows uefi ca 2023.pem new file mode 100644 index 0000000..9ba1c75 --- /dev/null +++ b/raveos-center/secureboot/adat/ms/windows uefi ca 2023.pem @@ -0,0 +1,33 @@ +-----BEGIN CERTIFICATE----- +MIIFqjCCA5KgAwIBAgITMwAAABqIi5gAViKEwQAAAAAAGjANBgkqhkiG9w0BAQsF +ADCBiDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT +B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UE +AxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IDIwMTAwHhcN +MjMwNjEzMTg1ODI5WhcNMzUwNjEzMTkwODI5WjBMMQswCQYDVQQGEwJVUzEeMBwG +A1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR0wGwYDVQQDExRXaW5kb3dzIFVF +RkkgQ0EgMjAyMzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALyyNdFU +ebSPzIEqbrMS1pOXMHw4XL95khkKDy0K/r/gqNgyP9Krb2+BwU0XaUXPhYAno3yz +Mcylp035Q9BaL9cYG9JYlgU5o5W3vN15waDPj+JTHismYqgcrjYeT6HfuRO6DCW7 +JGVnAaodQRC3NsFrLrVsENNOltCfKqHx7aEVC4KVxf9jihO1kjQeMV5hEa5dzPEQ +5kx5yXKyNIqCVi2rD3zAT5OOWXVBhqwJEAnyUWVQtfUhsyY5jarEkbPcrGQjBs01 +Xw1CSZxPDc6Ag4JZ/t9LROFAyD1jts+0Qg05XNJCEAwIwnTrHNxuvAqsmLvM+h48 +p4MWxdsC2tmW32sCAwEAAaOCAUYwggFCMA4GA1UdDwEB/wQEAwIBhjAQBgkrBgEE +AYI3FQEEAwIBADAdBgNVHQ4EFgQUrvxfu74FXY+NqlhUc0mUF6taUnIwGQYJKwYB +BAGCNxQCBAweCgBTAHUAYgBDAEEwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAW +gBTV9lbLj+iiXGJo0T2UkFvXzpoYxDBWBgNVHR8ETzBNMEugSaBHhkVodHRwOi8v +Y3JsLm1pY3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXRf +MjAxMC0wNi0yMy5jcmwwWgYIKwYBBQUHAQEETjBMMEoGCCsGAQUFBzAChj5odHRw +Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY1Jvb0NlckF1dF8yMDEw +LTA2LTIzLmNydDANBgkqhkiG9w0BAQsFAAOCAgEAn8m2/27hnDtV9v6LOd1hBG/Q +rWPNF3ZKqEOJjfjG8oxekOHkaKUV7LjTYAxAVx/7XjVyYd6XMWx5oPUWrksc7QEM +7/dXD0IwGGn4oaMul5K4vhv+K4ZeQkIRj45wTZCn/QFj8mS/m+J7CIHPSfI3F9/x ++XLTwx3DkEVN5oAGvf3lamnOs35OMVuEc6jocj8nNcl8IM4Am0/gTLQ2acv3NBER +dBJ6qIwugWymUK0Z+qhGRW+xZ3PDa+NA6CppjyQQ4SlujRaI7o5/ZpMCb1ueBIzM +gRytl1TxGC5+UpC8Ud4qDq5m6rxkbqCRZOQvEqi852u6xxubeRpkZvFDtNHDRiE4 +gXlM+vAxDdN5/3oSpR3Z3ayiD3GC95P/XKFhrmXyFIHteVqah+pge8uzT3U0yrqh +76L2ooBFoYsngc3Vdzg+yk7dKOpYusWgKd6GjIj8lSdR3avT0FsNd8dsj1XX1KIO +W+Q0RhQWHeMc1m2ZrUzscXMvq86ytCneVTBTOToyi/DqnIgSOwVoGb/Ph1IQ+9YT +YPNBZPQIV4HLnRGljvTlJ/WjOuzkPUq3zvmIDZ+9ym3SSrxYdo4yBJRu3fTPbUdt +wtdq3Idx6qS/72eXnLjHgDYqKlnJwAynRKBztYzPOFqu+LuGlfBErWZ6M+1x5EWH +g+WnzqJA0HLSSAD6+Ro= +-----END CERTIFICATE----- diff --git a/raveos-center/secureboot/raveos-secureboot-setup b/raveos-center/secureboot/raveos-secureboot-setup new file mode 100644 index 0000000..149bfda --- /dev/null +++ b/raveos-center/secureboot/raveos-secureboot-setup @@ -0,0 +1,313 @@ +#!/bin/bash +set -u + +GLOBAL_GUID="8be4df61-93ca-11d2-aa0d-00e098032b8c" +DB_GUID="d719b2cb-3d3a-4596-a3bc-dad00e67656f" + +SB_DIR=/usr/share/raveos/secureboot +MS="$SB_DIR/ms" +MACHINE_DIR=/etc/raveos/secureboot +STATE=/var/lib/raveos-sb +RESUME_UNIT=raveos-sb-resume.service +WORK="" + +log() { echo "[raveos-sb] $*"; } + +cleanup() { [ -n "$WORK" ] && rm -rf "$WORK"; } +trap cleanup EXIT + +efi_var() { + od -An -t u1 /sys/firmware/efi/efivars/"$1"-* 2>/dev/null | awk '{print $5}' +} + +status_cmd() { + if [ ! -d /sys/firmware/efi/efivars ]; then + log "Nem UEFI rendszer - Secure Boot nem elerheto." + return 1 + fi + local sb sm keys tools signed + sb=$(efi_var SecureBoot) + sm=$(efi_var SetupMode) + keys=0 + [ -f "$MACHINE_DIR/machine.pem" ] && keys=1 + tools=0 + command -v sbsign >/dev/null 2>&1 && tools=1 + signed=0 + if [ "$keys" = "1" ] && command -v sbverify >/dev/null 2>&1; then + signed=1 + for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-*; do + [ -f "$f" ] || continue + sbverify --cert "$MACHINE_DIR/machine.pem" "$f" >/dev/null 2>&1 || signed=0 + done + fi + echo "uefi=1" + echo "secureboot=${sb:-?}" + echo "setupmode=${sm:-?}" + echo "keys=$keys" + echo "tools=$tools" + echo "signed=$signed" + if [ -f "$STATE/pending" ]; then echo "pending=1"; else echo "pending=0"; fi + log "SecureBoot=${sb:-?} SetupMode=${sm:-?} gepkulcs=$keys alairasok=$signed" +} + +deps_cmd() { + local need=() + local p + for p in sbsigntools efitools openssl zstd; do + pacman -Qq "$p" >/dev/null 2>&1 || need+=("$p") + done + if [ "${#need[@]}" -gt 0 ]; then + log "Hianyzo eszkozok telepitese: ${need[*]}" + pacman -S --noconfirm "${need[@]}" || return 1 + fi +} + +keygen_cmd() { + if [ -f "$MACHINE_DIR/machine.key" ]; then + log "A gepkulcs mar letezik." + return 0 + fi + install -d -m 711 "$MACHINE_DIR" + openssl req -newkey rsa:2048 -nodes -keyout "$MACHINE_DIR/machine.key" -x509 -days 3650 \ + -out "$MACHINE_DIR/machine.pem" \ + -subj "/O=RaveOS/CN=RaveOS Machine Key" \ + -addext "basicConstraints=critical,CA:TRUE" \ + -addext "keyUsage=critical,digitalSignature,keyCertSign,cRLSign" \ + -addext "extendedKeyUsage=codeSigning" 2>/dev/null || { + log "HIBA: gepkulcs generalas sikertelen" + return 1 + } + chmod 600 "$MACHINE_DIR/machine.key" + chmod 644 "$MACHINE_DIR/machine.pem" + log "Gepkulcs generalva: CN=RaveOS Machine Key" +} + +signfile_path() { + local c + for c in /usr/lib/modules/*/build/scripts/sign-file /usr/src/linux/scripts/sign-file; do + [ -x "$c" ] && { echo "$c"; return 0; } + done + return 1 +} + +sign_one() { + local key="$1" cert="$2" f="$3" + sbverify --cert "$cert" "$f" >/dev/null 2>&1 && return 0 + if sbsign --key "$key" --cert "$cert" --output "$f.signed" "$f" 2>/dev/null; then + mv "$f.signed" "$f" + log "alairva: $f" + return 0 + fi + log "FIGYELEM: nem sikerult alairni: $f" + return 1 +} + +sign_cmd() { + command -v sbsign >/dev/null 2>&1 || { log "HIBA: sbsign nem elerheto"; return 1; } + local key="$MACHINE_DIR/machine.key" cert="$MACHINE_DIR/machine.pem" + local n=0 f signfile t + for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-* /boot/memtest86+/memtest.efi; do + [ -f "$f" ] || continue + sign_one "$key" "$cert" "$f" && n=$((n + 1)) + done + signfile=$(signfile_path) || signfile="" + if [ -n "$signfile" ]; then + install -m 755 "$signfile" /usr/local/bin/raveos-sign-file + local d sub m + for d in /usr/lib/modules/*/; do + for sub in extramodules updates/dkms extras; do + [ -d "${d}${sub}" ] || continue + while IFS= read -r -d '' m; do + if modinfo -F signer "$m" 2>/dev/null | grep -q "RaveOS Machine Key"; then + continue + fi + case "$m" in + *.ko) + /usr/local/bin/raveos-sign-file sha512 "$key" "$cert" "$m" >/dev/null 2>&1 && n=$((n + 1)) + ;; + *.ko.zst) + t=$(mktemp -d) + if zstd -q -d -c "$m" > "$t/m.ko" 2>/dev/null && + /usr/local/bin/raveos-sign-file sha512 "$key" "$cert" "$t/m.ko" >/dev/null 2>&1 && + zstd -q -f -o "$m" "$t/m.ko" 2>/dev/null; then + n=$((n + 1)) + fi + rm -rf "$t" + ;; + esac + done < <(find "${d}${sub}" -type f \( -name '*.ko' -o -name '*.ko.zst' \) -print0 2>/dev/null) + done + done + else + log "FIGYELEM: sign-file nem talalhato (kernel-headers nelkul a modulok kimaradnak)" + fi + log "Alairt elemek: $n" +} + +hook_cmd() { + install -d -m 755 /usr/local/bin /etc/pacman.d/hooks + install -m 755 "$SB_DIR/installed/raveos-sb-sign-local.sh" /usr/local/bin/raveos-sb-sign-local.sh + install -m 644 "$SB_DIR/installed/zz-raveos-sb-sign.hook" /etc/pacman.d/hooks/zz-raveos-sb-sign.hook + log "Pacman hook + helyi alairo telepitve." +} + +verify_cmd() { + local cert="$MACHINE_DIR/machine.pem" bad=0 f + for f in /boot/EFI/systemd/systemd-bootx64.efi /boot/EFI/BOOT/BOOTX64.EFI /boot/vmlinuz-*; do + [ -f "$f" ] || continue + sbverify --cert "$cert" "$f" >/dev/null 2>&1 || { bad=1; log "NINCS alairva: $f"; } + done + [ "$bad" = "0" ] && log "Alairas-ellenorzes: rendben." + if command -v efi-readvar >/dev/null 2>&1; then + log "Firmware db tartalom:" + efi-readvar -v db 2>/dev/null | grep -E "CN *=|O *=" | head -14 + fi +} + +cert_to_esl() { + cert-to-efi-sig-list "$1" "$2" 2>/dev/null || return 1 + local sz + sz=$(stat -c %s "$2" 2>/dev/null || echo 0) + [ "$sz" -gt 100 ] +} + +build_db_esl() { + local out="$1" f + cert_to_esl "$SB_DIR/db.pem" "$WORK/raveos-db.esl" || return 1 + cert_to_esl "$MACHINE_DIR/machine.pem" "$WORK/machine.esl" || return 1 + cat "$WORK/raveos-db.esl" > "$out" + for f in "$MS/MicCorUEFCA2011_2011-06-27.pem" "$MS/MicWinProPCA2011_2011-10-19.pem" \ + "$MS/microsoft uefi ca 2023.pem" "$MS/windows uefi ca 2023.pem" \ + "$MS/microsoft option rom uefi ca 2023.pem"; do + [ -f "$f" ] || continue + cert_to_esl "$f" "$WORK/ms-extra.esl" && cat "$WORK/ms-extra.esl" >> "$out" + done + cat "$WORK/machine.esl" >> "$out" +} + +build_kek_esl() { + local out="$1" f + cert_to_esl "$SB_DIR/KEK.pem" "$WORK/raveos-kek.esl" || return 1 + cat "$WORK/raveos-kek.esl" > "$out" + for f in "$MS/MicCorKEKCA2011_2011-06-24.pem" "$MS/microsoft corporation kek 2k ca 2023.pem"; do + [ -f "$f" ] || continue + cert_to_esl "$f" "$WORK/ms-extra.esl" && cat "$WORK/ms-extra.esl" >> "$out" + done +} + +clear_var() { + local name="$1" guid="$2" f + f="/sys/firmware/efi/efivars/${name}-${guid}" + [ -e "$f" ] || return 0 + chattr -i "$f" 2>/dev/null || true + rm -f "$f" 2>/dev/null || log "FIGYELEM: ${name} regi valtozo torlese nem sikerult" +} + +enroll_cmd() { + local sm t + sm=$(efi_var SetupMode) + if [ "${sm:-0}" != "1" ]; then + log "A firmware nincs Setup Mode-ban." + return 10 + fi + for t in cert-to-efi-sig-list efi-updatevar; do + command -v "$t" >/dev/null 2>&1 || { log "HIBA: $t nem elerheto (efitools)"; return 1; } + done + [ -f "$SB_DIR/PK.auth" ] || { log "HIBA: hianyzik a PK.auth"; return 1; } + + WORK=$(mktemp -d) + build_db_esl "$WORK/db.esl" || { log "HIBA: db ESL epites"; return 1; } + build_kek_esl "$WORK/KEK.esl" || { log "HIBA: KEK ESL epites"; return 1; } + + log "Meglevo PK/KEK/db valtozok torlese..." + clear_var PK "$GLOBAL_GUID" + clear_var KEK "$GLOBAL_GUID" + clear_var db "$DB_GUID" + + log "db irasa (RaveOS + Microsoft + gepkulcs)..." + efi-updatevar -e -f "$WORK/db.esl" db || { log "HIBA: db iras"; return 1; } + + log "KEK irasa (RaveOS + Microsoft)..." + efi-updatevar -e -f "$WORK/KEK.esl" KEK || { log "HIBA: KEK iras"; return 1; } + + log "PK irasa (elore alairt PK.auth)..." + efi-updatevar -f "$SB_DIR/PK.auth" PK || { log "HIBA: PK iras"; return 1; } + + log "Kulcsok telepitve a firmware-be." +} + +setup_cmd() { + status_cmd || return 1 + log "FIGYELEM (BitLocker): ha a Windowson BitLocker van, elotte inditsd el a Windowst es futtasd:" + log " manage-bde -protectors -disable C: -rebootcount 2" + log " vagy legyen keznel a 48 jegyu helyreallitasi kulcs." + deps_cmd || return 1 + keygen_cmd || return 1 + sign_cmd || return 1 + hook_cmd || return 1 + install -d -m 755 "$STATE" + local rc + enroll_cmd + rc=$? + if [ "$rc" = "0" ]; then + verify_cmd + rm -f "$STATE/pending" + log "KESZ. A BIOS-ban allitsd a Secure Boot-ot Enabled-re, majd ujrainditas." + return 0 + fi + if [ "$rc" = "10" ]; then + install -m 644 "$SB_DIR/installed/raveos-sb-resume.service" /etc/systemd/system/"$RESUME_UNIT" + systemctl daemon-reload + systemctl enable "$RESUME_UNIT" >/dev/null 2>&1 + touch "$STATE/pending" + log "A BIOS-ban: Secure Boot menuben Key Management, Clear Secure Boot keys (Setup Mode)," + log "ments, majd inditsd ujra a gepet. Boot utan a folyamat magatol befejezodik." + return 10 + fi + return "$rc" +} + +resume_cmd() { + [ -f "$STATE/pending" ] || exit 0 + if enroll_cmd; then + verify_cmd + rm -f "$STATE/pending" + date -Is > "$STATE/done" + systemctl disable "$RESUME_UNIT" >/dev/null 2>&1 + log "Secure Boot beallitas befejezve. A BIOS-ban allitsd a Secure Boot-ot Enabled-re." + exit 0 + fi + exit 1 +} + +need_root() { + if [ "$(id -u)" != "0" ]; then + echo "[raveos-sb] Root jogosultsag szukseges." >&2 + exit 1 + fi +} + +case "${1:-}" in + --status) + status_cmd + ;; + --verify) + verify_cmd + ;; + --setup) + need_root + setup_cmd + ;; + --resume) + need_root + resume_cmd + ;; + --resign) + need_root + keygen_cmd && sign_cmd && verify_cmd + ;; + *) + echo "hasznalat: raveos-secureboot-setup --status|--setup|--resume|--resign|--verify" >&2 + exit 2 + ;; +esac |