[bug #67690] regression: secureboot: chainloader to shim does not allow trust of shim keys

--8323329-378924769-1762785272=:1227138
Content-Type: TEXT/plain; CHARSET=utf-8
Content-Transfer-Encoding: QUOTED-PRINTABLE
Content-Disposition: inline

URL:=0A  <https://savannah.gnu.org/bugs/?67690>=0A=0A                 Summa=
ry: regression: secureboot: chainloader to shim does not=0Aallow trust of s=
him keys=0A                   Group: GNU GRUB=0A               Submitter: b=
radh352=0A               Submitted: Mon 10 Nov 2025 02:34:28 PM UTC=0A     =
           Category: Booting=0A                Severity: Major=0A          =
      Priority: 5 - Normal=0A              Item Group: Software Error=0A   =
               Status: None=0A                 Privacy: Public=0A          =
   Assigned to: None=0A         Originator Name:=0A        Originator Email=
:=0A             Open/Closed: Open=0A         Discussion Lock: Any=0A      =
           Release: other=0A                 Release:=0A         Reproducib=
ility: Every Time=0A         Planned Release: None=0A=0A=0A    ____________=
___________________________________________=0A=0AFollow-up Comments:=0A=0A=
=0A-------------------------------------------------------=0ADate: Mon 10 N=
ov 2025 02:34:28 PM UTC By: Brad House <bradh352>=0AIssue Reproduction / Bo=
ot Process:=0A 1. SONiC shim loaded=0A 2. SONiC grub loaded, menu shown=0A =
3. choose ONIE entry=0A 4. grub then calls chainloader ONIE shim=0A 5. ONIE=
 shim loaded=0A 6. ONIE grub loaded=0A 7. Choose ONIE option (e.g. Rescue)=
=0A 8. ONIE vmlinuz attempts to be loaded FAILS SIGNATURE=0A=0AIn a SONiC i=
nstallation, there are 2 OS installations, one is ONIE which is=0Aused to i=
nstall the NOS, and the other is the NOS itself, in this case SONiC.=0AOnce=
 the NOS is installed, the EFI is told to boot from the NOS partition so=0A=
first loads the NOS shim and grub. To make it easy to get into ONIE, SONiC=
=0Auses chainload to point to the ONIE partition and shim.=0A=0ASONiC is up=
grading from Debian Bookworm (12) to Trixie (13), which has changed=0Afrom =
grub 2.04 to grub 2.12 (of course Debian has patches they apply).  SONiC=0A=
is currently using the upstream debian grub and not compiling or modifying =
its=0Aown patches. This regression occurs when the SONiC grub is updated to=
 the=0ATrixie grub version.=0A=0AA few signing details:=0A- ONIE shim is si=
gned by a DB key, but is compiled with an ephemeral key to=0Atrust, which i=
s used to verify the ONIE grub and ONIE kernel, both of which=0Aare signed =
with the ephemeral key.=0A- SONiC shim, grub, and kernel are all signed wit=
h the DB key (since SONiC=0Aisn't building the shim or grub itself to embed=
 an ephemeral key).=0A=0AJust for clarification purposes, yes, ONIE boots f=
ine if you point EFI to boot=0Aonie directly without chainloading through t=
he NOS bootloader.  And yes, the=0ANOS itself boots fine.=0A=0AThis seems t=
o be the embedded chainloaded shim key from ONIE isn't getting=0Atrusted.  =
The shim version itself between bookworm and trixie appear to be the=0Asame=
 (15.8) so I don't think it is related to the shim itself.=0A=0AThere are s=
ome more details on=0Ahttps://github.com/sonic-net/sonic-buildimage/issues/=
24249=0A=0A=0A=0A=0A=0A=0A=0A    __________________________________________=
_____________=0A=0AReply to this item at:=0A=0A  <https://savannah.gnu.org/=
bugs/?67690>=0A=0A_______________________________________________=0AMessage=
 sent via Savannah=0Ahttps://savannah.gnu.org/=0A
--8323329-378924769-1762785272=:1227138
Content-Type: APPLICATION/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYIAB0WIQQk97aszIMMAvLLwm6qLAuaBUf3TgUCaRH3+AAKCRCqLAuaBUf3
ThtKAQCnshbcge28Q7XeD7g1ZJxgKIaMEtm8AtdUTDoJCQVgIwEAzSURzSnVCL+1
rEeSUyommN4ZearnMJaBDvavk6gGAwA=
=eXIv
-----END PGP SIGNATURE-----

--8323329-378924769-1762785272=:1227138--