Merge ~jsquyres-cisco/ubuntu/+source/shim:pr/better-make-cert-field-values into ubuntu/+source/shim:ubuntu/devel

[Jeff Squyres]

My group recently had a somewhat-alarming day when we noticed a basically-unlabeled MOK on our machines. After several hours, we finally tracked the cert down to https://bugs.launchpad.net/ubuntu/+source/shim-signed/+bug/1880197.

This merge proposal simply updates the certificate meta data in an attempt to help future admins who notice this MOK be able to track it down and see that it is, indeed, a legitimate / necessary certificate.

[Jeff Squyres (jsquyres-cisco)]

Could someone from the review team have a look at this PR? Thanks!

[Julian Andres Klode (juliank)]

We no longer use this certificate

review: Disapprove

Unmerged commits

b74e498... by Jeff Squyres <email address hidden> on 2021-01-06

make-certs: improve locality, org, and comments

Use something slightly less generic than "SomeCity" / "SomeOrg" for
meta data given to new certs. The intent to be help a curious
sysadmin who stumbles across a MOK on their system that was created by
an ephemeral certificate have a better/easier chance of tracking down
exactly what that MOK is / is for (see
https://bugs.launchpad.net/ubuntu/+source/shim-signed/+bug/1880197).

Signed-off-by: Jeff Squyres <email address hidden>

diff --git a/make-certs b/make-certs
index 3e9293b..990884b 100755
--- a/make-certs
+++ b/make-certs
@@ -219,9 +219,8 @@ subjectKeyIdentifier=hash
 
 [req_ca_name]
 C=US
-#stateOrProvinceName=SomeState
-localityName=SomeCity
-O=SomeOrg
+localityName=Internal
+O=Ubuntu shim package build system
 EOF
 #echo $DOMAIN | awk 'BEGIN {FS="."}{for(i=NF;i>0;i--){print NF-i ".domainComponent="$i;}}' >> openssl.cnf
 cat >> openssl.cnf <<- EOF
@@ -233,7 +232,7 @@ authorityKeyIdentifier=keyid:always
 #authorityKeyIdentifier=keyid:always,issuer:always
 keyUsage=nonRepudiation,digitalSignature,keyEncipherment,dataEncipherment,keyAgreement,keyCertSign,cRLSign
 basicConstraints=critical,CA:TRUE
-nsComment="Testing CA Certificate"
+nsComment="CA Certificate from Ubuntu shim package build system"
 EOF
 if test -n "$aia" ; then
 	echo "authorityInfoAccess = ${aia}" >> openssl.cnf
@@ -254,9 +253,8 @@ default_md = $DIGEST
 
 [req_ocsp_name]
 C=US
-#stateOrProvinceName=SomeState
-localityName=SomeOrg
-O=SomeOrg
+localityName=Internal
+O=Ubuntu shim package build system
 EOF
 #echo $DOMAIN | awk 'BEGIN {FS="."}{for(i=NF;i>0;i--){print NF-i ".domainComponent="$i;}}' >> openssl.cnf
 cat >> openssl.cnf <<- EOF
@@ -270,7 +268,7 @@ keyUsage=digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment,keyAgr
 extendedKeyUsage=1.3.6.1.5.5.7.3.9
 #basicConstraints=CA:FALSE
 basicConstraints=CA:TRUE
-nsComment="Testing OCSP Certificate"
+nsComment="OCSP Certificate from Ubuntu shim package build system"
 1.3.6.1.5.5.7.48.1.5=ASN1:NULL
 EOF
 if test -n "$aia" ; then
@@ -289,9 +287,8 @@ default_md = $DIGEST
 
 [req_issued_name]
 C=US
-#stateOrProvinceName=SomeState
-localityName=SomeCity
-O=SomeOrg
+localityName=Internal
+O=Ubuntu shim package build system
 EOF
 #echo $DOMAIN | awk 'BEGIN {FS="."}{for(i=NF;i>0;i--){print NF-i ".domainComponent="$i;}}' >> openssl.cnf
 #mail = $GIVENUSER
@@ -322,10 +319,10 @@ if test -n "$eku" ; then
 fi
 if test "x$CA" = xTRUE ; then
 	echo "basicConstraints=critical,CA:TRUE" >> openssl.cnf
-	echo 'nsComment="Testing CA Certificate for '"$commonname"'"' >> openssl.cnf
+	echo 'nsComment="CA Certificate from Ubuntu shim package build system for '"$commonname"'"' >> openssl.cnf
 else
 	echo "basicConstraints=CA:FALSE" >> openssl.cnf
-	echo 'nsComment="Testing Certificate for '"$commonname"'"' >> openssl.cnf
+	echo 'nsComment="Certificate from Ubuntu shim package build system for '"$commonname"'"' >> openssl.cnf
 fi
 for value in $principals; do
 	user=`echo "$value" | cut -f1 -d@`