Code

add support for Secure Boot#3097

Code

Merged

bcressey merged 18 commits intobottlerocket-os:developbottlerocket-os/bottlerocket:developfrom bcressey:secureboot-shenanigansbcressey/bottlerocket:secureboot-shenanigansCopy head branch name to clipboardJul 13, 2023

+2,033-31

Commits

Commits on Jul 13, 2023

• packages: update grub

  Show description for f30647b
  bcressey

  committed
  f30647b

  Copy full SHA for f30647b

• grub: move embedded public key into dedicated section

  Show description for 4192fde
  

  markusboehme

  authored and

  bcressey

  committed
  4192fde

  Copy full SHA for 4192fde

• grub: add SBAT info

  Show description for 5dea175
  bcressey

  committed
  5dea175

  Copy full SHA for 5dea175

• grub: add modules for GPG signature verification

  Show description for f617a12
  bcressey

  committed
  f617a12

  Copy full SHA for f617a12

• grub: add script to replace the public key embedded in GRUB

  Show description for cbf7179
  

  markusboehme

  authored and

  bcressey

  committed
  cbf7179

  Copy full SHA for cbf7179

• packages: build shim

  Show description for 09d1dca
  bcressey

  committed
  09d1dca

  Copy full SHA for 09d1dca

• shim: embed placeholder for vendor cert

  Show description for 91544ff
  bcressey

  committed
  91544ff

  Copy full SHA for 91544ff

• build: add scripts to create Secure Boot profiles

  Show description for 9965967
  bcressey

  committed
  9965967

  Copy full SHA for 9965967

• build: auto-create a local Secure Boot profile

  Show description for 69c9bf6
  bcressey

  committed
  69c9bf6

  Copy full SHA for 69c9bf6

• build: pass Secure Boot profile secrets to builds

  Show description for 701779a
  bcressey

  committed
  701779a

  Copy full SHA for 701779a

• build: add image feature flag for Secure Boot

  Show description for 3765e53
  bcressey

  committed
  3765e53

  Copy full SHA for 3765e53

• build: add Secure Boot OVF templates

  Show description for 975a32d
  bcressey

  committed
  975a32d

  Copy full SHA for 975a32d

• build: sign artifacts for Secure Boot

  Show description for 548c470
  bcressey

  committed
  548c470

  Copy full SHA for 548c470

• pubsys: register AMIs with Secure Boot support

  Show description for 2b75fc2
  bcressey

  committed
  2b75fc2

  Copy full SHA for 2b75fc2

• variants: enable Secure Boot for dev builds

  Show description for d12b26d
  bcressey

  committed
  d12b26d

  Copy full SHA for d12b26d

• docs: document tools to generate Secure Boot Keys

  Show description for 2393d7b
  bcressey

  committed
  2393d7b

  Copy full SHA for 2393d7b

• start-local-vm: add options to override firmware

  Show description for e0cbdb4
  bcressey

  committed
  e0cbdb4

  Copy full SHA for e0cbdb4

• docs: add notes on Secure Boot

  Show description for 50f6ffa
  bcressey

  committed
  50f6ffa

  Copy full SHA for 50f6ffa