From acce9b9387cd125a50a2f0b41ac8293f1a21ae03 Mon Sep 17 00:00:00 2001 From: Oktawian Bieszke Date: Wed, 12 Aug 2026 15:46:00 +0200 Subject: [PATCH 1/4] osfv-test-data/hello-dasharo: add expired and root-ca certificate/image generation Signed-off-by: Oktawian Bieszke --- hello-dasharo/Makefile | 9 +++++++++ hello-dasharo/signing/keygen.sh | 23 ++++++++++++++++++++++- 2 files changed, 31 insertions(+), 1 deletion(-) diff --git a/hello-dasharo/Makefile b/hello-dasharo/Makefile index 9388827..72ee801 100644 --- a/hello-dasharo/Makefile +++ b/hello-dasharo/Makefile @@ -27,13 +27,22 @@ sign: hello-dasharo.efi --output hello-dasharo-signed-good.efi $< sbsign --key signing/private-key-bad.pem --cert signing/cert_bad.pem \ --output hello-dasharo-signed-bad.efi $< + sbsign --key signing/private-key-expired.pem --cert signing/cert_expired.pem \ + --output hello-dasharo-signed-expired.efi $< + sbsign --key signing/private-key-leaf.pem --cert signing/cert_chain.pem \ + --output hello-dasharo-signed-intermediate.efi $< + dist: sign rm -rf $@ mkdir $@ cp hello-dasharo.efi ./$@/ cp hello-dasharo-signed-good.efi ./$@/ cp hello-dasharo-signed-bad.efi ./$@/ + cp hello-dasharo-signed-expired.efi ./$@/ + cp hello-dasharo-signed-rootca.efi ./$@/ cp ./signing/cert_good.der ./$@/ + cp ./signing/cert_expired.der ./$@/ + cp ./signing/cert_root_ca.der ./$@/ cp hello-dasharo.efi ./$@/cert_fake.der clean: diff --git a/hello-dasharo/signing/keygen.sh b/hello-dasharo/signing/keygen.sh index df718ed..13e2adb 100755 --- a/hello-dasharo/signing/keygen.sh +++ b/hello-dasharo/signing/keygen.sh @@ -2,6 +2,8 @@ CERT_EXPIRATION_DAYS=730 CERT_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE" +LEAF_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE Leaf" +CA_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE Root CA" echo "Keys & certificates generation ..." @@ -10,6 +12,8 @@ rm -f *.der openssl genrsa -out private-key-good.pem 3027 openssl genrsa -out private-key-bad.pem 3027 +openssl genrsa -out private-key-expired.pem 3027 +openssl genrsa -out private-key-root-ca.pem 3027 openssl rsa -in private-key-good.pem -pubout -out public-key-good.pem openssl rsa -in private-key-bad.pem -pubout -out public-key-bad.pem @@ -21,5 +25,22 @@ openssl req -new -x509 -key private-key-bad.pem -out cert_bad.pem \ openssl x509 -outform der -in cert_good.pem -out cert_good.der -echo "... Done." +openssl req -new -x509 -key private-key-root-ca.pem -out cert_root_ca.pem \ + -days $CERT_EXPIRATION_DAYS -nodes -subj "$CA_SUBJECT" + +openssl x509 -outform der -in cert_root_ca.pem -out cert_root_ca.der + +openssl req -new -newkey rsa:3072 -nodes \ + -keyout private-key-leaf.pem -out req_leaf.csr \ + -subj "$LEAF_SUBJECT" +openssl x509 -req -in req_leaf.csr \ + -CA cert_root_ca.pem -CAkey private-key-root-ca.pem -CAcreateserial \ + -out cert_leaf.pem -days $CERT_EXPIRATION_DAYS +cat cert_leaf.pem cert_root_ca.pem >cert_chain.pem + +faketime '1970-01-01 19:41:00' openssl req -new -x509 -key private-key-expired.pem -out cert_expired.pem \ + -days $CERT_EXPIRATION_DAYS -nodes -subj "$CERT_SUBJECT" +openssl x509 -outform der -in cert_expired.pem -out cert_expired.der + +echo "... Done." From e8f85edd41c0e0ae8003d1cd084927a28425f0c7 Mon Sep 17 00:00:00 2001 From: Oktawian Bieszke Date: Wed, 12 Aug 2026 15:49:04 +0200 Subject: [PATCH 2/4] osfv-test-data/.gitignore: update gitignore file Signed-off-by: Oktawian Bieszke --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index a5844f6..827dcfb 100644 --- a/.gitignore +++ b/.gitignore @@ -4,3 +4,5 @@ hello-dasharo/dist hello-dasharo/*.efi hello-dasharo/signing/*.pem hello-dasharo/signing/*.der +hello-dasharo/signing/*.csr +hello-dasharo/signing/*.srl From 6e15751e13b082dfc3c6214edd57b1fc55067c43 Mon Sep 17 00:00:00 2001 From: Oktawian Bieszke Date: Thu, 13 Aug 2026 11:57:14 +0200 Subject: [PATCH 3/4] osfv-test-data/hello-dasharo: fix root CA chain creation Signed-off-by: Oktawian Bieszke --- hello-dasharo/Makefile | 8 +++--- hello-dasharo/signing/keygen.sh | 47 +++++++++++++++++++++++---------- 2 files changed, 38 insertions(+), 17 deletions(-) diff --git a/hello-dasharo/Makefile b/hello-dasharo/Makefile index 72ee801..206630a 100644 --- a/hello-dasharo/Makefile +++ b/hello-dasharo/Makefile @@ -29,8 +29,10 @@ sign: hello-dasharo.efi --output hello-dasharo-signed-bad.efi $< sbsign --key signing/private-key-expired.pem --cert signing/cert_expired.pem \ --output hello-dasharo-signed-expired.efi $< - sbsign --key signing/private-key-leaf.pem --cert signing/cert_chain.pem \ - --output hello-dasharo-signed-intermediate.efi $< + sbsign --key signing/private-key-leaf.pem \ + --cert signing/cert_leaf.pem \ + --addcert signing/cert_intermediate.pem \ + --output hello-dasharo-signed-intermediate.efi $< dist: sign rm -rf $@ @@ -39,7 +41,7 @@ dist: sign cp hello-dasharo-signed-good.efi ./$@/ cp hello-dasharo-signed-bad.efi ./$@/ cp hello-dasharo-signed-expired.efi ./$@/ - cp hello-dasharo-signed-rootca.efi ./$@/ + cp hello-dasharo-signed-intermediate.efi ./$@/ cp ./signing/cert_good.der ./$@/ cp ./signing/cert_expired.der ./$@/ cp ./signing/cert_root_ca.der ./$@/ diff --git a/hello-dasharo/signing/keygen.sh b/hello-dasharo/signing/keygen.sh index 13e2adb..acff4c3 100755 --- a/hello-dasharo/signing/keygen.sh +++ b/hello-dasharo/signing/keygen.sh @@ -2,45 +2,64 @@ CERT_EXPIRATION_DAYS=730 CERT_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE" -LEAF_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE Leaf" CA_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE Root CA" +INTERMEDIATE_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE Intermediate" +LEAF_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE Leaf" +EXPIRED_SUBJECT="/C=pl/ST=pomorskie/L=Gdańsk/O=3mdeb/OU=dasharo-team/CN=BAD_INFLUE Expired" echo "Keys & certificates generation ..." rm -f *.pem rm -f *.der -openssl genrsa -out private-key-good.pem 3027 -openssl genrsa -out private-key-bad.pem 3027 -openssl genrsa -out private-key-expired.pem 3027 -openssl genrsa -out private-key-root-ca.pem 3027 +openssl genrsa -out private-key-good.pem 3072 +openssl genrsa -out private-key-bad.pem 3072 +openssl genrsa -out private-key-expired.pem 3072 +openssl genrsa -out private-key-root-ca.pem 3072 openssl rsa -in private-key-good.pem -pubout -out public-key-good.pem openssl rsa -in private-key-bad.pem -pubout -out public-key-bad.pem openssl req -new -x509 -key private-key-good.pem -out cert_good.pem \ - -days $CERT_EXPIRATION_DAYS -nodes -subj $CERT_SUBJECT + -days $CERT_EXPIRATION_DAYS -nodes -subj "$CERT_SUBJECT" openssl req -new -x509 -key private-key-bad.pem -out cert_bad.pem \ - -days $CERT_EXPIRATION_DAYS -nodes -subj $CERT_SUBJECT + -days $CERT_EXPIRATION_DAYS -nodes -subj "$CERT_SUBJECT" openssl x509 -outform der -in cert_good.pem -out cert_good.der openssl req -new -x509 -key private-key-root-ca.pem -out cert_root_ca.pem \ - -days $CERT_EXPIRATION_DAYS -nodes -subj "$CA_SUBJECT" + -days $CERT_EXPIRATION_DAYS -nodes -subj "$CA_SUBJECT" \ + -addext "basicConstraints=critical,CA:TRUE" \ + -addext "keyUsage=critical,keyCertSign,cRLSign" openssl x509 -outform der -in cert_root_ca.pem -out cert_root_ca.der openssl req -new -newkey rsa:3072 -nodes \ - -keyout private-key-leaf.pem -out req_leaf.csr \ - -subj "$LEAF_SUBJECT" + -keyout private-key-intermediate.pem -out req_intermediate.csr \ + -subj "$INTERMEDIATE_SUBJECT" + +openssl x509 -req -in req_intermediate.csr \ + -CA cert_root_ca.pem -CAkey private-key-root-ca.pem -CAcreateserial \ + -out cert_intermediate.pem -days $CERT_EXPIRATION_DAYS \ + -extfile <(echo -e "basicConstraints=critical,CA:TRUE\nkeyUsage=critical,digitalSignature,keyCertSign,cRLSign") + +openssl x509 -outform der -in cert_intermediate.pem -out cert_intermediate.der + +openssl req -new -newkey rsa:3072 -nodes \ + -keyout private-key-leaf.pem -out req_leaf.csr \ + -subj "$LEAF_SUBJECT" openssl x509 -req -in req_leaf.csr \ - -CA cert_root_ca.pem -CAkey private-key-root-ca.pem -CAcreateserial \ - -out cert_leaf.pem -days $CERT_EXPIRATION_DAYS -cat cert_leaf.pem cert_root_ca.pem >cert_chain.pem + -CA cert_intermediate.pem -CAkey private-key-intermediate.pem -CAcreateserial \ + -out cert_leaf.pem -days $CERT_EXPIRATION_DAYS \ + -extfile <(echo -e "basicConstraints=critical,CA:FALSE\nkeyUsage=digitalSignature\nextendedKeyUsage=codeSigning") + +openssl x509 -outform der -in cert_leaf.pem -out cert_leaf.der + +cat cert_leaf.pem cert_intermediate.pem >cert_chain.pem faketime '1970-01-01 19:41:00' openssl req -new -x509 -key private-key-expired.pem -out cert_expired.pem \ - -days $CERT_EXPIRATION_DAYS -nodes -subj "$CERT_SUBJECT" + -days $CERT_EXPIRATION_DAYS -nodes -subj "$EXPIRED_SUBJECT" openssl x509 -outform der -in cert_expired.pem -out cert_expired.der echo "... Done." From ab6d2c4874509efc1208f1a2dda3386407146695 Mon Sep 17 00:00:00 2001 From: Oktawian Bieszke Date: Thu, 13 Aug 2026 11:59:00 +0200 Subject: [PATCH 4/4] osfv-test-data/hello-dasharo: update README Signed-off-by: Oktawian Bieszke --- hello-dasharo/README.md | 11 ++++++++++- hello-dasharo/signing/keygen.sh | 4 ++-- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/hello-dasharo/README.md b/hello-dasharo/README.md index d2f8e8c..bd72e2e 100644 --- a/hello-dasharo/README.md +++ b/hello-dasharo/README.md @@ -1,8 +1,10 @@ ## Hello, Dasharo Universe! - Secure Boot test program + An UEFI hello-world program, but with intentionally-added delays: pre- and post; output to capture in tests: `UEFI Hello, Dasharo Universe!` Build prerequisites for Fedora: + - mingw64-gcc - openssl - sbsigntools @@ -14,10 +16,17 @@ Building `dist/` sub-directory, containing complete set of files for BAD_INFLUE `make clean && make dist` List of files created in `dist/` sub-directory: + - `cert_fake.der` - fake certificate file with bad contents. - `cert_good.der` - proper certificate file, can be enrolled with Secure Boot menu. -- `hello-dasharo.efi` - unsigned program binary, can be executed with Secure Boot disabled. +- `cert_expired.der` - expired certificate file, can be enrolled with Secure Boot menu. +- `cert_root_ca.der` - Root CA certificate file, can be enrolled with Secure Boot menu. +- `hello-dasharo.efi` - program binary, can be executed with Secure Boot disabled. - `hello-dasharo-signed-bad.efi` - program binary signed with some other certificate. - `hello-dasharo-signed-good.efi` - program binary signed with `cert_good.der`. +- `hello-dasharo-signed-expired.efi` - program binary signed with `cert_expired.der`. +- `hello-dasharo-signed-intermediate.efi` - program binary signed with `cert_intermediate.der`. + +**Note:** The expired certificate is included for completeness. Per UEFI spec, firmware is not required to reject images signed with expired certificates (in the form that the script generates them), making them currently not viable for testing. See: https://github.com/Dasharo/dasharo-issues/issues/1863. For more information on available Makefile targets, please run `make help`. diff --git a/hello-dasharo/signing/keygen.sh b/hello-dasharo/signing/keygen.sh index acff4c3..1bae266 100755 --- a/hello-dasharo/signing/keygen.sh +++ b/hello-dasharo/signing/keygen.sh @@ -11,6 +11,8 @@ echo "Keys & certificates generation ..." rm -f *.pem rm -f *.der +rm -f *.csr +rm -f *.srl openssl genrsa -out private-key-good.pem 3072 openssl genrsa -out private-key-bad.pem 3072 @@ -56,8 +58,6 @@ openssl x509 -req -in req_leaf.csr \ openssl x509 -outform der -in cert_leaf.pem -out cert_leaf.der -cat cert_leaf.pem cert_intermediate.pem >cert_chain.pem - faketime '1970-01-01 19:41:00' openssl req -new -x509 -key private-key-expired.pem -out cert_expired.pem \ -days $CERT_EXPIRATION_DAYS -nodes -subj "$EXPIRED_SUBJECT" openssl x509 -outform der -in cert_expired.pem -out cert_expired.der