Back when we started with a signed shim in Debian, the tooling was
Windows-only and required me to do a reboot dance and it was all quite
tedious. Over time, more and more of the tooling has migrated to
Linux and it all works quite well.
The signing is done with an EV code signing cert from SSL.com and
stored on a Yubikey. Getting the certificate onto the key is a bit
tedious, but reasonably well-explained in the ssl.com docs.
Microsoft wants the shim binaries uploaded to their partner portal
wrapped in a .cab file, which should be signed.
The wrapping in a .cab file is easy enough: lcab shim.efi shim-unsigned.cab. It’s fine to put shims for multiple architectures
in the same .cab file.
Signing of the file is a little bit of a rune:
osslsigncode sign -pkcs11module /usr/lib/x86_64-linux-gnu/libykcs11.so -key "pkcs11:serial=XXX" -askpass -certs chain.crt -h sha256 -ts http://ts.ssl.com shim-unsigned.cab shim-unsigned.signed.cab
chain.crt contains first our EV code signing cert, then the ssl.com
intermediate EV code signing cert, then the ssl.com EV root cert. The
naming of the packages is a tiny bit confusing, but it’s because the
package name in Debian is shim-unsigned.
Occasionally, processing of uploaded binaries just stops in the
validation stage in the portal, but I’ve so far been able to unstuck
them by re-signing and uploading again, and I saw the same with the
MS/Windows toolchain, so I suspect it’s just flakiness on the portal
side.
Log in
