Ubuntu
shim-signed package

shim-signed 1.51.1 source package in Ubuntu

Changelog

shim-signed (1.51.1) jammy; urgency=medium

  * New upstream version 15.7 (LP: #1996503)
    - SBAT level: shim,3
    - SBAT policy bumped to for grub,2 in previous and grub,3 in latest:
      SBAT policy: latest="shim,2\ngrub,3\n" previous="grub,2\n"
  * SECURITY FIX: Buffer overflow when loading crafted EFI images.
      - CVE-2022-28737
  * debian/control: Depend on new grub versions (1.191 on lunar+, 1.187.2 elsewhere)
  * Break fwupd-signed signed with old keys
  * Check for revoked fb,mm binaries in build, grubs, fwupd in autopkgtest
  * Install both previous and latest shim as alternatives. On secure boot
    systems, if the current kernel or any newer one is revoked, the previous
    shim will continue to be used until current kernel and all newer ones
    are signed with a non-revoked key.

 -- Julian Andres Klode <email address hidden>  Thu, 26 Jan 2023 13:03:25 +0100

Upload details

Uploaded by:
Julian Andres Klode
Uploaded to:
Jammy
Original maintainer:
Steve Langasek
Architectures:
amd64 arm64
Section:
utils
Urgency:
Medium Urgency

See full publishing history Publishing

Series Pocket Published Component Section

Builds

Jammy: [FULLYBUILT] amd64 [FULLYBUILT] arm64

Downloads

File Size SHA-256 Checksum
shim-signed_1.51.1.tar.xz 902.5 KiB c32668f450167b03a1ee5ed7b57e00d02cabf7a394cd7a6324b849ad64567b69
shim-signed_1.51.1.dsc 1.8 KiB 44d3324e6922abf473cf7f236e8731421ea6b9e1f082205df4b673bbfc1072f5

Available diffs

View changes file

Binary packages built by this source

shim-signed: Secure Boot chain-loading bootloader (Microsoft-signed binary)

 This package provides a minimalist boot loader which allows verifying
 signatures of other UEFI binaries against either the Secure Boot DB/DBX or
 against a built-in signature database. Its purpose is to allow a small,
 infrequently-changing binary to be signed by the UEFI CA, while allowing
 an OS distributor to revision their main bootloader independently of the CA.
 .
 This package contains the version of the bootloader binary signed by the
 Microsoft UEFI CA.