Append secure boot utility by adding expired and rootca cert generation

[kiemonbb]

No description provided.

[kiemonbb]

Log showing sbverify correctly verifies newly generated digital signatures.
sbverify.log

[philipanda]

adding expired

Just a quick note before I review, have you considered the UEFI spec details @miczyg1 gave here? Dasharo/dasharo-issues#1863
Are the scripts generating certs that would correctly verify the mechanism that's actually expected by the UEFI spec? The test https://github.com/Dasharo/open-source-firmware-validation/blob/encrypted-rootfs-release-rebase/scripts/secure-boot/generate-images/sb-img-wrapper.sh and the script used for it https://github.com/Dasharo/open-source-firmware-validation/blob/encrypted-rootfs-release-rebase/scripts/secure-boot/generate-images/sb-img-wrapper.sh were testing something that is not true for UEFI compliant firmware.

[kiemonbb]

Yes, I'm aware of Dasharo/dasharo-issues#1863, but this PR only intended to transfer utility from the lost sb-image-wrapper.sh file . The expired cert wasn't too much of a hassle to add and as @miczyg1 said it should still fail on UEFI compliant firmware.

[philipanda]

The expired cert wasn't too much of a hassle to add and as @miczyg1 said it should still fail on UEFI compliant firmware.

It would require some more fields in the certificates and timestamping the signature, which sbsign does not support. If that's just a port then fine. As the scripts are tightly connected to OSFV tests I'd add a comment stating that the expired certs are currently not viable for testing the functionality. It would then be easier to not forget about that later.

[kiemonbb]

I'd add a comment stating that the expired certs are currently not viable for testing the functionality. It would then be easier to not forget about that later.

Added note in readme https://github.com/Dasharo/osfv-test-data/pull/20/changes#diff-b2b6a9e250b262ad7ba45030f2bb02dd4be8f08a3c8f9220b1767cfa9b9e6d3bR30

[philipanda]

Have you tried running the OSFV tests with these?