[Bug 2044606] Re: Reset Checksum upon removing all signatures

[Dimitri John Ledkov]

** Changed in: sbsigntool (Ubuntu)
       Status: New => Fix Committed

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to sbsigntool in Ubuntu.
https://bugs.launchpad.net/bugs/2044606

Title:
  Reset Checksum upon removing all signatures

Status in sbsigntool package in Ubuntu:
  Fix Committed

Bug description:
  When compiling grub, shim, kernels the unsigned binaries are typically
  produced with a checksum set to zero in PE header.

  The checksum is updated upon signing.

  To ensure signing a binary, and removing signatures from it, is round
  trip safe - one needs to zero out the checksum.

  Otherwise it is difficult to prove that signing/unsigned/kernel.efi
  builds of the kernel are the same, which leads to different hmacs of
  it, as has been highlighted during FIPS certification.

  Upstream shim was notified about this at
  https://github.com/rhboot/shim/issues/612

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/sbsigntool/+bug/2044606/+subscriptions