Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1299712

Bug#1140761: bookworm-pu: package shim-signed/1.51~1+deb12u1

Cross-posted to 2 groups.

Show all headers | View raw

Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: shim-signed@packages.debian.org
Control: affects -1 + src:shim-signed
User: release.debian.org@packages.debian.org
Usertags: pu

Hey folks,
 
As mentioned in #1131862...
 
We've had new signed shim binaries back from Microsoft for some
time. I've been waiting on the fix for #1137247 (hang/crash
chainloading Windows from grub) in case that might have been shim bug,
but it's now been fixed in grub and we're good.
 
So, it's time to get a new shim-signed package into bookworm, for the
last point release. I've backported the logic from 1.51 in unstable:
 
  * Add support for verifying and then combining signatures from
    multiple signed shims.
    + Existing sbverify versions in Debian are buggy when verifying.
    + Switch to using a python script verify_combine_sigs to fill in
      the gaps.
  * In preinst, try to verify that the signed shim we're trying to
    install will actually boot on this system - let's not break
    systems on upgrade.
 
and imported the signed shim binaries which resulted from the bookworm
shim update in #1131862.
 
We need this new signed shim to allowe bookworm to install and run on
newer systems which may ship with *only* the new 2023 UEFI CA included
in firmware.
 
See https://wiki.debian.org/SecureBoot/CAChanges for more background.
.

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1140761: bookworm-pu: package shim-signed/1.51~1+deb12u1 Steve McIntyre <steve@einval.com> - 2026-06-26 01:20 +0200
  Bug#1140761: shim-signed 1.51~1+deb12u1 flagged for acceptance Jonathan Wiltshire <jmw@debian.org> - 2026-06-26 23:00 +0200

csiph-web