Merge ~ubuntu-core-dev/shim/+git/shim-signed:xnox/dual-signed into ~ubuntu-core-dev/shim/+git/shim-signed:master

[Dimitri John Ledkov]

Construct and ship dual-signed shim.

Currently using shim-canonical provided signed artefacts.

[Julian Andres Klode (juliank)]

Looks OK I guess, but is there even a point in shipping a single-signed shim if we have the dual-signed one?

review: Approve

diff --git a/CanonicalMasterCA.crt b/CanonicalMasterCA.crt
new file mode 100644
index 0000000..55c06d5
--- /dev/null
+++ b/CanonicalMasterCA.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIENDCCAxygAwIBAgIJALlBJKAYLJJnMA0GCSqGSIb3DQEBCwUAMIGEMQswCQYD
+VQQGEwJHQjEUMBIGA1UECAwLSXNsZSBvZiBNYW4xEDAOBgNVBAcMB0RvdWdsYXMx
+FzAVBgNVBAoMDkNhbm9uaWNhbCBMdGQuMTQwMgYDVQQDDCtDYW5vbmljYWwgTHRk
+LiBNYXN0ZXIgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MB4XDTEyMDQxMjExMTI1MVoX
+DTQyMDQxMTExMTI1MVowgYQxCzAJBgNVBAYTAkdCMRQwEgYDVQQIDAtJc2xlIG9m
+IE1hbjEQMA4GA1UEBwwHRG91Z2xhczEXMBUGA1UECgwOQ2Fub25pY2FsIEx0ZC4x
+NDAyBgNVBAMMK0Nhbm9uaWNhbCBMdGQuIE1hc3RlciBDZXJ0aWZpY2F0ZSBBdXRo
+b3JpdHkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC/WzoWdO4hXa5h
+7Z1WrL3e3nLz3X4tTGIPrMBtSAgRz42L+2EfJ8wRbtlVPTlU60A7sbvihTR5yvd7
+v7p6yBAtGX2tWc+m1OlOD9quUupMnpDOxpkNTmdleF350dU4Skp6j5OcfxqjhdvO
++ov3wqIhLZtUQTUQVxONbLwpBlBKfuqZqWinO8cHGzKeoBmHDnm7aJktfpNS5fbr
+yZv5K+24aEm82ZVQQFvFsnGq61xX3nH5QArdW6wehC1QGlLW4fNrbpBkT1u06yDk
+YRDaWvDq5ELXAcT+IR/ZucBUlUKBUnIfSWR6yGwk8QhwC02loDLRoBxXqE3jr6WO
+BQU+EEOhAgMBAAGjgaYwgaMwHQYDVR0OBBYEFK2RmQvCKrH1FwSMI7ZlWiaONFpj
+MB8GA1UdIwQYMBaAFK2RmQvCKrH1FwSMI7ZlWiaONFpjMA8GA1UdEwEB/wQFMAMB
+Af8wCwYDVR0PBAQDAgGGMEMGA1UdHwQ8MDowOKA2oDSGMmh0dHA6Ly93d3cuY2Fu
+b25pY2FsLmNvbS9zZWN1cmUtYm9vdC1tYXN0ZXItY2EuY3JsMA0GCSqGSIb3DQEB
+CwUAA4IBAQA/ffZ2pbODtCt60G1SGgODxBKnUJxHkszAlHeC0q5Xs5kE9TI6xlUd
+B9sSqVb62NR2IOvkw1Hbmlyckj8Yc9qUaqGZOIykiG3B/Dlx0HR2FgM+ViM11VVH
+WxodQcLTEkzc/64KkpxiChcBnHPgXrH9vNa1GRF6fs0+A35m21uoyTlIUf9T4Zwx
+U5EbOxB1Axe65oECgJRwTEa3lLA9Fc0fjgLgaAKP+/lHHX2iAcYHUcSazO3dz6Nd
+7ZK7vtH95uwfM1FzBL48crB9CPgB/5h9y5zgaTl3JUdxiLGNJ6UuqPc/X4Bplz6p
+9JkU284DDgtmxBxtvbgnd8FClL38agq8
+-----END CERTIFICATE-----
diff --git a/Makefile b/Makefile
index 2a5395d..8ee5c6c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,3 +1,5 @@
+SHIM_CANONICAL_VERSION=$(shell dpkg-query -W -f'$${Version}' shim-canonical-unsigned)
+
 check:
 	mkdir -p build
 	# Verifying that the image is signed with the correct key.
@@ -8,6 +10,27 @@ check:
 	cp /usr/lib/shim/$(SHIM_BASE) build/$(SHIM_BASE).signed
 	sbattach --attach build/detached-sig build/$(SHIM_BASE).signed
 	cmp $(SHIM_BASE).signed build/$(SHIM_BASE).signed
+	####
+	# Construct dual-signed shim
+	./download-signed shim-canonical-unsigned $(SHIM_CANONICAL_VERSION) shim-canonical signed
+	# Verify that the downloaded binary has signatures chained to Canonical Master CA
+	sbverify --cert CanonicalMasterCA.crt $(SHIM_CANONICAL_VERSION)/$(SHIM_BASE).signed
+	# Detach Canonical signature
+	sbattach --detach $(SHIM_CANONICAL_VERSION)/detached-sig-canonical $(SHIM_CANONICAL_VERSION)/$(SHIM_BASE).signed
+	rm $(SHIM_CANONICAL_VERSION)/$(SHIM_BASE).signed
+	# Compare that shims are all the same now
+	cmp /usr/lib/shim/$(SHIM_BASE) $(SHIM_CANONICAL_VERSION)/$(SHIM_BASE)
+	# Reattach Canonical signature
+	sbattach --attach $(SHIM_CANONICAL_VERSION)/detached-sig-canonical $(SHIM_CANONICAL_VERSION)/$(SHIM_BASE)
+	# Verify that attachment worked
+	sbverify --cert CanonicalMasterCA.crt $(SHIM_CANONICAL_VERSION)/$(SHIM_BASE)
+	# Attach Microsoft signature
+	sbattach --attach build/detached-sig $(SHIM_CANONICAL_VERSION)/$(SHIM_BASE)
+	# Validate that this shim is now dualsigned
+	sbverify --list $(SHIM_CANONICAL_VERSION)/$(SHIM_BASE)
+	sbverify --cert CanonicalMasterCA.crt $(SHIM_CANONICAL_VERSION)/$(SHIM_BASE)
+	sbverify --cert MicCorUEFCA2011_2011-06-27.crt $(SHIM_CANONICAL_VERSION)/$(SHIM_BASE)
+	cp $(SHIM_CANONICAL_VERSION)/$(SHIM_BASE) build/$(SHIM_BASE).dualsigned
 
 clean:
-	rm -rf build boot.csv BOOT$(EFI_ARCH).CSV
+	rm -rf build $(SHIM_CANONICAL_VERSION) $shim_boot.csv BOOT$(EFI_ARCH).CSV
diff --git a/debian/changelog b/debian/changelog
index 2df7ed5..f16a39d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+shim-signed (1.43) UNRELEASED; urgency=medium
+
+  * Add download-signed script from linux-signed package
+  * Construct and ship dual-signed shim.
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 04 Aug 2020 14:23:29 +0100
+
 shim-signed (1.42) groovy; urgency=medium
 
   * Update to the signed 15+1552672080.a4a1fbe-0ubuntu2 binary from Microsoft.
diff --git a/debian/control b/debian/control
index 59dee6b..770764f 100644
--- a/debian/control
+++ b/debian/control
@@ -2,7 +2,7 @@ Source: shim-signed
 Section: utils
 Priority: optional
 Maintainer: Steve Langasek <[e-mail]>
-Build-Depends: debhelper (>= 9), dh-exec, shim, sbsigntool (>= 0.6-0ubuntu4), po-debconf
+Build-Depends: debhelper (>= 9), dh-exec, shim, sbsigntool (>= 0.6-0ubuntu4), po-debconf, python3, python3-apt, shim-canonical-unsigned (>= 2)
 Standards-Version: 3.9.4
 Vcs-Git: https://git.launchpad.net/~ubuntu-core-dev/shim/+git/shim-signed
 Vcs-Browser: https://git.launchpad.net/~ubuntu-core-dev/shim/+git/shim-signed
diff --git a/debian/shim-signed.install b/debian/shim-signed.install
index 046d911..93d4e26 100755
--- a/debian/shim-signed.install
+++ b/debian/shim-signed.install
@@ -1,6 +1,7 @@
 #! /usr/bin/dh-exec
 
 ${SHIM_BASE}.signed /usr/lib/shim
+build/${SHIM_BASE}.dualsigned /usr/lib/shim
 openssl.cnf /usr/lib/shim/mok
 debian/source_shim-signed.py /usr/share/apport/package-hooks/
 update-secureboot-policy /usr/sbin/
diff --git a/download-signed b/download-signed
new file mode 100755
index 0000000..0793696
--- /dev/null
+++ b/download-signed
@@ -0,0 +1,183 @@
+#! /usr/bin/python3
+
+import hashlib
+import argparse
+import os
+import re
+import sys
+import tarfile
+from urllib import request
+from urllib.error import HTTPError
+from urllib.parse import (
+    urlparse,
+    urlunparse,
+    )
+
+import apt
+
+# package_name: package containing the objects we signed
+# package_version: package version containing the objects we signed
+# src_package: source package name in dists
+# signed_type: 'signed' or 'uefi' schema in the url
+
+parser = argparse.ArgumentParser()
+parser.add_argument(
+    "package_name",
+    help="package containining the objects we signed")
+parser.add_argument(
+    "package_version",
+    help="package version containing the objects we signed, or 'current'")
+parser.add_argument(
+    "src_package",
+    help="source package name in dists")
+parser.add_argument(
+    "signed_type",
+    nargs='?',
+    default='signed',
+    help="subdirectory type in the url, 'signed' or 'uefi'")
+args = parser.parse_args()
+
+
+class SignedDownloader:
+    """Download a block of signed information from dists.
+
+    Find a block of signed information as published in dists/*/signed
+    and download the contents.  Use the contained checksum files to
+    identify the members and to validate them once downloaded.
+    """
+
+    def __init__(self, package_name, package_version, src_package, signed_type='signed'):
+        self.package_name = package_name
+        self.package_version = package_version
+        self.src_package = src_package
+
+        # Find the package in the available archive repositories.  Use a _binary_
+        # package name and version to locate the appropriate archive.  Then use the
+        # URI there to look for and find the appropriate binary.
+        cache = apt.Cache()
+
+        self.package = None
+        if self.package_version == "current":
+            self.package = cache[package_name].candidate
+        else:
+            for version in cache[package_name].versions:
+                if version.version == self.package_version:
+                    self.package = version
+                    break
+
+        if not self.package:
+            raise KeyError("{0}: package version not found".format(self.package_name))
+
+        origin = self.package.origins[0]
+        pool_parsed = urlparse(self.package.uri)
+        self.package_dir = "%s/%s/%s/%s-%s/%s/" % (
+            origin.archive, 'main', signed_type,
+            self.src_package, self.package.architecture, self.package_version)
+
+        # Prepare the master url stem and pull out any username/password.  If present
+        # replace the default opener with one which offers that password.
+        dists_parsed_master = list(pool_parsed)
+        if '@' in dists_parsed_master[1]:
+            (username_password, host) = pool_parsed[1].split('@', 1)
+            (username, password) = username_password.split(':', 1)
+
+            dists_parsed_master[1] = host
+
+            # Work out the authentication domain.
+            domain_parsed = [ dists_parsed_master[0], dists_parsed_master[1], '/', None, None, None ]
+            auth_uri = urlunparse(domain_parsed)
+
+            # create a password manager
+            password_mgr = request.HTTPPasswordMgrWithDefaultRealm()
+
+            # Add the username and password.
+            # If we knew the realm, we could use it instead of None.
+            password_mgr.add_password(None, auth_uri, username, password)
+
+            handler = request.HTTPBasicAuthHandler(password_mgr)
+
+            # create "opener" (OpenerDirector instance)
+            opener = request.build_opener(handler)
+
+            # Now all calls to urllib.request.urlopen use our opener.
+            request.install_opener(opener)
+
+        self.dists_parsed = dists_parsed_master
+
+    def download_one(self, member, filename, hash_factory=None):
+        directory = os.path.dirname(filename)
+        if not os.path.exists(directory):
+            os.makedirs(directory)
+
+        dists_parsed = list(self.dists_parsed)
+        dists_parsed[2] = re.sub(r"/pool/.*", "/dists/" + self.package_dir + \
+            member, dists_parsed[2])
+        dists_uri = urlunparse(dists_parsed)
+
+        print("Downloading %s ... " % dists_uri, end='')
+        sys.stdout.flush()
+        try:
+            with request.urlopen(dists_uri) as dists, open(filename, "wb") as out:
+                hashobj = None
+                if hash_factory:
+                    hashobj = hash_factory()
+                for chunk in iter(lambda: dists.read(256 * 1024), b''):
+                    if hashobj:
+                        hashobj.update(chunk)
+                    out.write(chunk)
+                checksum = True
+                if hashobj:
+                    checksum = hashobj.hexdigest()
+        except HTTPError as e:
+            if e.code == 404:
+                print("not found")
+            else:
+                raise
+        else:
+            print("found")
+            return checksum
+        return None
+
+    def download(self, base):
+        """Download an entire signed result from dists."""
+
+        # Download the checksums and use that to download the contents.
+        sums = 'SHA256SUMS'
+        sums_local = os.path.join(base, self.package_version, sums)
+        if not self.download_one(sums, sums_local):
+            print('download-signed: {0}: not found'.format(sums))
+            sys.exit(1)
+
+        # Read the checksum file and download the files it mentions.
+        here = os.path.abspath(base)
+        with open(sums_local) as sfd:
+            for line in sfd:
+                line = line.strip()
+                (checksum_expected, member) = (line[0:64], line[66:])
+                filename = os.path.abspath(os.path.join(base, self.package_version, member))
+                if not filename.startswith(here):
+                    print('download-signed: {0}: member outside output directory'.format(member))
+                    sys.exit(1)
+
+                # Download and checksum this member.
+                checksum_actual = self.download_one(member, filename, hashlib.sha256)
+                if checksum_expected != checksum_actual:
+                    print('download-signed: {0}: member checksum invalid'.format(member))
+                    sys.exit(1)
+
+        # If this is a tarball result then extract it.
+        here = os.path.abspath(os.path.join(base, self.package_version))
+        tarball_filename = os.path.join(base, self.package_version, 'signed.tar.gz')
+        if os.path.exists(tarball_filename):
+            with tarfile.open(tarball_filename) as tarball:
+                for tarinfo in tarball:
+                    if not filename.startswith(here):
+                        print('download-signed: {0}: tarball member outside output directory'.format(member))
+                        sys.exit(1)
+                for tarinfo in tarball:
+                    print('Extracting {0} ...'.format(tarinfo.name))
+                    tarball.extract(tarinfo, base)
+
+
+downloader = SignedDownloader(**vars(args))
+downloader.download('.')