Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Factory
sbctl
sbctl.changes
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File sbctl.changes of Package sbctl
------------------------------------------------------------------- Tue Oct 22 03:56:54 UTC 2024 - Joshua Smith <smolsheep@opensuse.org> - Disable tests that fail due to gh/foxboron/sbctl#343 - Update to version 0.16: * Ensure sbctl reads --config even if /etc/sbctl/sbctl.conf is present * Fixed a bug where sbctl would abort if the TPM eventlog contains the same byte multiple times * Fixed a landlock bug where enroll-keys --export did not work * Fixed a bug where an ESP mounted to multiple paths would not be detected * Exporting keys without efivars present work again * sbctl sign will now use the saved output path if the signed file is enrolled * enroll-keys --append will now work without --force. - Updates from version 0.15.4: * Fixed an issue where sign-all did not report a non-zero exit code when something failed * Fixed and issue where we couldn't write to a file with landlock * Fixed an issue where --json would print the human readable output and the json * Fixes landlock for UKI/bundles by disabling the sandbox feature * Some doc fixups that mentioned /usr/share/ ------------------------------------------------------------------- Wed Jul 31 23:55:22 UTC 2024 - Joshua Smith <smolsheep@opensuse.org> - Update to version 0.15.3: * Fixed a mistake where the db_additions setting in sbctl.conf was not wired up to sbctl setup. * Relaxed the check for an existing install in sbctl setup form looking after /var/lib/sbctl to check for /var/lib/sbctl/keys. * Fixed a bug where dmi information was not read for quirk detection when landlock was enabled. * Fixed a bug where sbctl create-keys did not have access to /var/lib under landlock. * Fixed a bug where sbctl setup didn't have access to /usr/share. ------------------------------------------------------------------- Wed Jul 31 14:13:47 UTC 2024 - Joshua Smith <smolsheep@opensuse.org> - Added minimum go required version - Update to version 0.15.2: * Fixed a bug where sbctl setup aborts early because /var/lib/sbctl already exists. - Updates from version 0.15.1: * Fixed an issue where sbctl migrate did not work without --disable-landlock. * Fixed an issue where bundles.db would be written to files.json deleting list of files. - Updates from version 0.15: See the release for full changes. https://github.com/Foxboron/sbctl/releases/tag/0.15 * sbctl will try to sandbox all commands with landlock. Landlock is a unpriviledged sandbox, similar to OpenBSD pledge, that allows sbctl to declare the directories and files we are reading/writing a head. This feature is enabled by default and can be disabled by setting landlock: false in the new config file, or by passing --disable-landlock flag. * sbctl has moved from using /usr/share/secureboot to /var/lib/sbctl. The useage of /usr was mostly for legacy reasons but there wasn't any motivation to fix this until now. To help with the migration sbctl migrate has been implemented. It will move all the files from the old location to /var/lib/sbctl and rename files accordingly. * sbctl now support creation of TPM key files using go-tpm-keyfiles. These keys are mostly compatible with how other TPM2 TSS keyfiles are created. This key type can be used by passing on of several keytype flags to create-keys or rotate-keys, or by specifying the type in the new configuration file. ------------------------------------------------------------------- Thu May 9 15:54:58 UTC 2024 - Joshua Smith <smolsheep@opensuse.org> - Enable tests - Fix bashism error in 91-sbctl.install by using bash shebang - Service to use manual instead of deprecated disabled and pattern cleanup - Update to version 0.14: New commands * export-enrolled-keys will export all enrolled keys on the system to a directory * list-enrolled-keys will list the enrolled keys on the system New Things * The test suite has now been rewritten to use the new vmtest library. Bugfixes * sign-all won't abort when it encounters a file it can't sign. * The kernel-install hook won't try to sign things if there are no signing keys available. * The kernel-install hook will now only remove things if they actually did exist on the system. * The mkinitcpio hook now only sign the built kernel/UKI instead of all the sbctl files. ------------------------------------------------------------------- Wed Dec 27 08:21:25 UTC 2023 - Joshua Smith <jsmithfpv@gmail.com> - Update to version 0.13: * --export,-e and --database-path,-d now work properly and don't overwrite the create-keys variables internally * remove erronous dbx enrollment. Previous release implemented support for dbx that doesn't really work as expected. It would also fail to enroll keys for previously setup clients. Implementation has been removed and will be iterated upon at a later date. * make: fix github artifact upload * Change shebang * Ensure file signing hook is run when initrd is rebuilt * Fixed typo, removed mention enroll-keys enables Secure Boot automatically * Ignore Setup mode and immutable variables for export * Specify file origin + always print signing message * tests/utils/certs.go: drop keyUsage bitfield * update manpage docs * allow specifying keys and GUID paths * Update README.md * keys.go: drop the keyUsage bitfield * Check and return Open errs * Update documentation for custom dbx ------------------------------------------------------------------- Fri Oct 20 23:32:22 UTC 2023 - Joshua Smith <jsmithfpv@gmail.com> - Update to version 0.12: * sbctl bundle might be depreciated in the future. * sbctl now allows you to enroll custom certificates into KEK and db. * sbctl now allows keys to be exported as EFI Signature Lists (esl) or EFI Authenticated Variables (auth), which are pre-signed. * sbctl can now enroll certificates found in dbxDefault, dbDefault, KEKDefault and PKDefault. * Before this release sbctl would enroll, reset and rotate the entire key hierarchy when requested. With this release several improvements have been made to have the ability to support partial key hierarchies. This can be used through the --partial flag in their respective commands. * add documentation for the extra flags of enroll/rotate/reset * feat: add option to remove specific certs from db instead of an entire reset * feat: add append option to enroll-keys * feat: force key flag * Add support for OEM dbx enrollment * feat(dbx): enroll/rotate/reset dbx keys * feat(rotate): enable partial rotation and providing different sources * feat(reset): enable partial resets of secureboot keys * feat(enroll-keys): add partial enrollment of keys * Implement full support for loading builtin firmware certificates * Add support for loading certificates from dbDefault ------------------------------------------------------------------- Mon Mar 27 07:36:22 UTC 2023 - jan.loeser@posteo.de - Update to version 0.11: * status: Warn about firmware quirks * Add trailing newline to JSON output * Improve wording * Always include vendor keys in status output * Move a few more functions to afero and fs.Fs * Remove unused code * Include fs module * Implement fs package and remove all direct filesystem calls * Updated dependencies * status: Added e2e test * enroll-keys: remove variable overriding for OEM key enrollment * updated to go 1.20 * Fix arbitrary sizes in UKI generation * Update README.md * enroll-keys: Enroll Microsoft KEK along with their other keys * pacman: Add extramodules target to hook * Fix POSIX sh comparison * verify: Implement file verification ------------------------------------------------------------------- Thu Jan 19 12:29:01 UTC 2023 - Joshua Smith <jsmithfpv@gmail.com> - Update to version 0.10: * go.mod: Properly fetch new library version * go.mod: update go-uefi and cleanup * rotate-keys: Implement rotate-keys * Add support for the uki layout * Fix typos and some improve grammar a bit * sbctl.8: Provide more precise setup mode instructions * enroll-keys: Error if user has Setup Mode disabled * update manpage to reflect defaults in bundle.go * Fix crash when ESP is not mounted * main: Always ensure we allow printing before json prints ------------------------------------------------------------------- Mon Nov 28 04:07:35 UTC 2022 - Joshua Smith <jsmithfpv@gmail.com> - Initial package of sbctl 0.9.0 for openSUSE
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
