From a68334a13cf243fb024644fcca6ae04a9825ffa7 Mon Sep 17 00:00:00 2001 From: srs5694 Date: Sun, 16 Dec 2012 21:02:45 -0500 Subject: [PATCH] Public keys for Secure Boot/shim --- keys/README.txt | 26 ++++++++++++++++++++++++++ keys/canonical-uefi-ca.der | Bin 0 -> 1080 bytes keys/refind.cer | Bin 0 -> 831 bytes keys/refind.crt | 20 ++++++++++++++++++++ 4 files changed, 46 insertions(+) create mode 100644 keys/README.txt create mode 100644 keys/canonical-uefi-ca.der create mode 100644 keys/refind.cer create mode 100644 keys/refind.crt diff --git a/keys/README.txt b/keys/README.txt new file mode 100644 index 0000000..5376570 --- /dev/null +++ b/keys/README.txt @@ -0,0 +1,26 @@ +This directory contains known public keys for Linux distributions and other +parties that sign boot loaders and kernels that should be verifiable by +shim. I'm providing these keys as a convenience to enable easy installation +of keys should you replace your distribution's version of shim with another +one and therefore require adding its public key as a machine owner key +(MOK). + +Files come with three extensions. A filename ending in .crt is a +certificate file that can be used by sbverify to verify the authenticity of +a key, as in: + +$ sbverify --cert keys/refind.crt refind/refind_x64.efi + +The .cer and .der filename extensions are equivalent, and are public key +files similar to .crt files, but in a different form. The MokManager +utility expects its input public keys in this form, so these are the files +you would use to add a key to the MOK list maintained by MokManager and +used by shim. + +The files in this directory are: + +- canonical-uefi-ca.der -- Canonical's public key, used to sign Ubuntu + boot loaders and kernels. + +- refind.cer & refind.crt -- My own (Roderick W. Smith's) public key, + used to sign refind_x64.efi and the 64-bit rEFInd drivers. diff --git a/keys/canonical-uefi-ca.der b/keys/canonical-uefi-ca.der new file mode 100644 index 0000000000000000000000000000000000000000..b4098d9cd81ea586602804afcf876e6247230081 GIT binary patch literal 1080 zcmXqLVlgpjVwPFJ%*4pV#L2MJQDuRI&ZKk$UN%mxHjlRNyo`+8tPBQ?Er#3%oNUaY zENsF|?oNgx20|bX2M@PraZaj2ewu=BVxFOZ0Ut<|orm2ezcf83vDi@DKolgx#lz>E zn3tcInVguT;8T*KXJ}$z1d?Fp(MFX3np0eoTBP8dT2zvm22@{?s^C~!l96AOSyE{r zC(dhVWME=wWN2t;WNH{C&T9hVf&hp+Se)6!sDvDVjI0dIO^o~u22G4yOihf84Ev+4 z#7f>N#;!|zJ2!02-h20oKHsg=^-1Dib0F7)L-2fW_wPh`^)rHbH$!bLLtZ;rZ`}Q; z)ui&&_v-z-s!j;#O4hE8JiqM9OF#Zw>w;eS%$soT*i2r(^wf&jpBJxMczIRzPo7gR zwYc^6xnJGi4=qyEogLz6DiAK*o3lrgEx@bp)y$O{%dL;IOB>BwAlc4WxjSQ~Zr$Xd zr{7+moc&Y#?T!r3JvXNYI7A=aRJiJOO!&RRpAKAiqu0o_=mtmyU3>UBJ8wdYfAp5u z3QrORZbf}~^~C8q(ExfiNTEe->5)W*}w24HDpIVF9M-HUno6N1nyTz{E-gycP0G(N(ai-XLfzyW+5vV1kNIuBValdgL*1jLWE~G(7V^3Ce;wDP zIZ0gNjB|<~#BKb$=h{|D!K%8mcFc8Yx1(2_wDbu4AN+8RVemw0Yk^W`@m&)A`=NHGmowR%3#lO$q$QuV1v+T1e z+EB~!gYo~2+S79$WLlQ1x)*kA>{VZ?x8l2fd_(4RyOm#NirhZO%*UN}L?(Cd4)yYb MPE+>&$>Q1r029B9o&W#< literal 0 HcmV?d00001 diff --git a/keys/refind.cer b/keys/refind.cer new file mode 100644 index 0000000000000000000000000000000000000000..9774f80c201b0d18221c35585d9f6d8e0fa7283a GIT binary patch literal 831 zcmXqLVzxGDVp3kf%*4pV#L4jB=$jHA(I7tqUN%mxHjlRNyo`*jtPBPwhDHVkY|No7 z%siSw`6;PInaSA-;d%!{wGEHq_R6=$hBP#=Q6C*!^K@%evQxhX2!z#bh$$P&qlMg-rP-+oJ z%d@Mq*B{a>{aF!H*i)9syIs-$-WBV+^XKGFUZQfLMe5TuwhvYpN}g~|=+3|M;l_^F zThit4%0}+J*U8SpvNb-*v*={bf$IM)48ogTpYJa}xxH3R-Q(7e1-Ct(m4`dC|C(`d z;`v{8ejnu?FNx+j`AYfc+{gF$PqFP~XWPvd_q8HPJJ>5b_wm=9tHCEyFYaD=a_u2eUZKH&vcXHJLo6ZTlpX2}{_t`tL1KwT-e(0vScfmm^wHpgh_rFZEwiQxpa$dgS?6C_OGQVeh zy;r=WQn=~eF+pp$_X#sW(f7MvesYi{VSmp<(Xcz_Qdn>XoCQubKkD7sZlAY>#|>SqwWyX zUi;_Eba&MCs+|6Bx@8HP9Kt|z?NrSZ6I&+3)piVyj0&l+26u0H>Q gm+|yopI2A