mirror of
https://github.com/containers/bootc.git
synced 2026-02-05 15:45:53 +01:00
6f69534f9b
Main goal is to reduce signing logic duplication between the systemd-boot and UKI generation. However, this quickly snowballed into wanting to actually verify by providing a custom secure boot keys to bcvk that things worked. This depends on https://github.com/bootc-dev/bcvk/pull/170 Now as part of that, I ran into what I think are bugs in pesign; this cuts things back over to using sbsign. I'll file a tracker for that separately. Finally as part of this, just remove the TMT example that builds a sealed image but doesn't actually verify it works - it's already drifted from what we do outside here. Ultimately what we need is to shift some of this into the Fedora examples and we just fetch it here anyways. Assisted-by: Claude Code (Sonnet 4.5) Signed-off-by: Colin Walters <walters@verbum.org>
18 lines
877 B
Bash
Executable File
18 lines
877 B
Bash
Executable File
#!/bin/bash
|
|
set -euo pipefail
|
|
# Generate Secure Boot keys, only intended to be used for our CI pipeline.
|
|
d=target/test-secureboot
|
|
# This file existing signals completion
|
|
if test -f "${d}/.done"; then exit 0; fi
|
|
mkdir -p "$d"
|
|
cd "$d"
|
|
systemd-id128 new -u > GUID.txt
|
|
openssl req -quiet -newkey rsa:4096 -nodes -keyout PK.key -new -x509 -sha256 -days 3650 -subj '/CN=Test Platform Key/' -out PK.crt
|
|
openssl x509 -outform DER -in PK.crt -out PK.cer
|
|
openssl req -quiet -newkey rsa:4096 -nodes -keyout KEK.key -new -x509 -sha256 -days 3650 -subj '/CN=Test Key Exchange Key/' -out KEK.crt
|
|
openssl x509 -outform DER -in KEK.crt -out KEK.cer
|
|
openssl req -quiet -newkey rsa:4096 -nodes -keyout db.key -new -x509 -sha256 -days 3650 -subj '/CN=Test Signature Database key/' -out db.crt
|
|
openssl x509 -outform DER -in db.crt -out db.cer
|
|
touch .done
|
|
echo "Generated Secure Boot keys in ${d}"
|