[Bug 2004201] Re: is-not-revoked does not handle gzip'd kernels

[dann frazier]

This was implicitly verified when I verified bug 2004208:
  https://bugs.launchpad.net/ubuntu/+source/shim-signed/+bug/2004208/comments/7
While I wasn't able to fully complete bionic verification there, I explicitly ran the test in the SRU template on bionic/arm64 to validate this one:

ubuntu at ubuntu:~$ sudo file /boot/vmlinuz-*
/boot/vmlinuz-4.15.0-202-generic: gzip compressed data, max compression, from Unix
/boot/vmlinuz-5.4.0-137-generic:  gzip compressed data, was "vmlinuz-5.4.0-137-generic.efi.signed", last modified: Thu Jan 12 19:14:50 2023, max compression, from Unix
/boot/vmlinuz-5.4.0-139-generic:  gzip compressed data, was "vmlinuz-5.4.0-139-generic.efi.signed", last modified: Fri Jan 27 12:20:31 2023, max compression, from Unix
ubuntu at ubuntu:~$ sudo /usr/lib/shim/is-not-revoked /boot/vmlinuz-*
No signature table present
E: /boot/vmlinuz-4.15.0-202-generic: Could not find signing subject, sbverify output follows:
No signature table present
E: /boot/vmlinuz-5.4.0-137-generic: revoked key CN=Canonical Ltd. Secure Boot Signing (2017) used


** Tags removed: verification-needed verification-needed-bionic verification-needed-focal verification-needed-jammy verification-needed-kinetic
** Tags added: verification-done verification-done-bionic verification-done-focal verification-done-jammy verification-done-kinetic

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to shim-signed in Ubuntu.
https://bugs.launchpad.net/bugs/2004201

Title:
  is-not-revoked does not handle gzip'd kernels

Status in shim-signed package in Ubuntu:
  New
Status in shim-signed source package in Bionic:
  Fix Committed
Status in shim-signed source package in Focal:
  Fix Committed
Status in shim-signed source package in Jammy:
  Fix Committed
Status in shim-signed source package in Kinetic:
  Fix Committed

Bug description:
  [Impact]

  arm64 kernels are gzip'd by default, which currently breaks is-not-
  revoked:

  ubuntu at ubuntu:~$ sudo file /boot/vmlinuz-5.15.0-57-generic
  /boot/vmlinuz-5.15.0-57-generic: gzip compressed data, was "vmlinuz-5.15.0-57-generic.efi.signed", last modified: Tue Nov 29 10:47:41 2022, max compression, from Unix, original size modulo 2^32 46283136

  ubuntu at ubuntu:~$ sudo /usr/lib/shim/is-not-revoked /boot/vmlinuz-5.15.0-57-generic ~
  Invalid DOS header magic
  Can't open image /boot/vmlinuz-5.15.0-57-generic
  E: /boot/vmlinuz-5.15.0-57-generic: Could not finder signing subject, sbverify output follows:
  Invalid DOS header magic
  Can't open image /boot/vmlinuz-5.15.0-57-generic

  If I decompress the vmlinuz file in place, it works:
  ubuntu at ubuntu:~$ sudo /usr/lib/shim/is-not-revoked /boot/vmlinuz-5.15.0-57-generic ~
  Invalid DOS header magic
  Can't open image /boot/vmlinuz-5.15.0-57-generic
  E: /boot/vmlinuz-5.15.0-57-generic: Could not finder signing subject, sbverify output follows:
  Invalid DOS header magic
  Can't open image /boot/vmlinuz-5.15.0-57-generic
  ubuntu at ubuntu:~$ echo $?
  1

  [Test plan]
  Test gzipped kernels per above

  [Where problems could occur]
  Added/changed code could potentially break stuff on amd64.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/shim-signed/+bug/2004201/+subscriptions