vcswatch reports that
this package seems to have a new changelog entry (version
1.48, distribution
UNRELEASED) and new commits
in its VCS. You should consider whether it's time to make
an upload.
Here are the relevant commit messages:
commit 0140b59d00318019177364b0a56f180052394868
Author: Steve McIntyre <steve@einval.com>
Date: Thu May 14 16:53:15 2026 +0100
Update to boot check: ignore keys listed in DBX
commit be5e1a1dd8e69d54bd52ff55f801028af6b83767
Author: Steve McIntyre <steve@einval.com>
Date: Thu May 14 16:33:23 2026 +0100
Check that we can boot on the current system
If SecureBoot is enabled, check that our shim binary is signed by at
least one of the certificates enrolled in firmware.
commit 51d7291fc779e9c961c942fb503ffa2d02205b3c
Author: Steve McIntyre <steve@einval.com>
Date: Thu May 14 00:18:16 2026 +0100
Grab the sha1 fingerprint of each used cert as we match them
Later, install that data alongside the shim binaries in the package.
We can then use this data to check that we can boot the signed shim
we're installing.
commit a4d4af294e188bd9bae83a0d1df2191180961c7b
Author: Steve McIntyre <steve@einval.com>
Date: Thu May 14 00:17:47 2026 +0100
Makefile: add clean rule
commit bfdd628e60db5818e90967b142bd511c597a1352
Author: Steve McIntyre <steve@einval.com>
Date: Wed May 13 23:26:39 2026 +0100
Update lintian source overrides
commit 8ed0e53daa6a62a42ddc07ba3f223fc33fc8714a
Author: Steve McIntyre <steve@einval.com>
Date: Wed May 13 23:22:53 2026 +0100
Update build-deps for 16.1-2
commit fb7896559b4673427f4f4075bd74512bb3a5bf30
Author: Steve McIntyre <steve@einval.com>
Date: Wed May 13 23:15:31 2026 +0100
Add the new 16.1-2 binaries signed by Microsoft
commit 46b1703f38382efebc0526e1c7f98609d6d2f5f0
Author: Steve McIntyre <steve@einval.com>
Date: Wed May 13 23:08:09 2026 +0100
Update changelog
commit d26ca79bcb7a6e2c59f7b6f9292c28b7189d431a
Author: Steve McIntyre <steve@einval.com>
Date: Wed May 6 23:58:34 2026 +0100
Fix up cert filenames and explicitly sort them before use
commit 06be276481fa3481cbdb3fa24ce8a1114d1bcdbd
Author: Steve McIntyre <steve@einval.com>
Date: Wed May 6 23:45:07 2026 +0100
Add the "new" Microsoft 2023 UEFI CA key
Found at
https://github.com/microsoft/secureboot_objects/blob/main/PreSignedObjects/DB/Certificates/microsoft%20uefi%20ca%202023.der
and copied here in PEM format, ready to use.
commit 221cc767346b1715e7f138b184ed596796181416
Author: Steve McIntyre <steve@einval.com>
Date: Wed May 6 23:44:01 2026 +0100
Shuffle test certificates
commit e2a56d673c66989136c41a6f1c997ff1aad10097
Author: Steve McIntyre <steve@einval.com>
Date: Tue Apr 28 14:01:32 2026 +0100
Add support for verifying and then combining signatures
from multiple signed shims.
* Move the verification logic out into a new helper script
verify_combine_sigs - see comments there for how it works.
* Rename the existing shim binaries and CA cert to match
* Include some extra certs and binaries for testing with
![[bug history graph]](https://qa.debian.org/data/bts/graphs/s/shim-signed.png){kind=link}