[Bug 1234649] Re: UEFI shim verification against microsoft-uefica-public.pem fails with 20131003 saucy images
Dmitrijs Ledkovs
launchpad at surgut.co.uk
Thu Oct 3 15:06:59 UTC 2013
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
33:00:00:00:08:1e:b1:7e:9c:15:fc:83:7a:00:01:00:00:00:08
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation UEFI CA 2011
Validity
Not Before: Jul 2 22:25:14 2012 GMT
Not After : Oct 2 22:25:14 2013 GMT
Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=MOPR, CN=Microsoft Windows UEFI Driver Publisher
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:e9:22:4f:b6:d3:3b:3c:16:1b:48:41:e4:9e:ee:
ed:19:cb:7b:fe:03:a6:bd:6b:f1:eb:28:7d:d6:c2:
89:1b:10:a5:bf:b3:99:7d:4c:bf:38:23:e7:62:36:
39:3d:d8:54:d7:84:24:d3:ea:e2:53:c5:5b:e3:3e:
26:a8:8c:01:c6:99:e0:ed:ab:ad:e1:31:d1:b5:a2:
1a:02:57:32:a8:52:3c:b4:93:a7:87:7b:b5:f8:b2:
fc:f4:4b:9e:c6:d7:87:6d:2b:be:36:1a:13:36:88:
8c:3d:cb:d1:5e:74:f6:71:7c:6e:0f:8c:2f:7e:cb:
f8:8d:a5:d5:e7:b3:31:f0:3f:2b:31:36:d6:1d:fe:
a3:e4:13:50:00:d1:ce:ea:3e:09:b5:fe:dc:30:b4:
1f:79:77:e5:02:83:2c:9f:c0:70:07:63:e7:e6:8c:
43:81:0b:91:c9:73:63:d9:45:b9:84:5a:07:ae:bd:
ee:6d:c4:56:74:2e:11:87:73:25:cf:95:e5:6d:25:
fb:6e:bf:a3:71:f1:55:69:1b:30:bd:e7:d2:1d:b1:
e4:01:6e:e3:6d:2f:20:87:e2:da:80:00:67:ec:58:
4a:07:09:57:0d:82:4f:82:3a:17:80:15:06:a7:7c:
62:1b:8b:e6:22:d7:a0:a6:57:e6:1f:8e:90:20:2f:
36:e7
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Extended Key Usage:
Code Signing, 1.3.6.1.4.1.311.80.2.1
X509v3 Subject Key Identifier:
C0:4C:FC:78:2F:95:15:DD:D5:65:5D:BA:FF:32:97:39:6A:93:52:A6
X509v3 Authority Key Identifier:
keyid:13:AD:BF:43:09:BD:82:70:9C:8C:D5:4F:31:6E:D5:22:98:8A:1B:D4
X509v3 CRL Distribution Points:
Full Name:
URI:http://www.microsoft.com/pkiops/crl/MicCorUEFCA2011_2011-06-27.crl
Authority Information Access:
CA Issuers - URI:http://www.microsoft.com/pkiops/certs/MicCorUEFCA2011_2011-06-27.crt
X509v3 Basic Constraints: critical
CA:FALSE
Signature Algorithm: sha256WithRSAEncryption
84:08:31:43:9e:4e:63:e8:8d:00:e1:b0:c0:67:8d:70:bb:89:
f4:66:e9:02:7a:b2:81:77:92:6d:5d:ef:81:75:b3:24:0e:72:
9f:94:3f:1e:6b:d9:4a:0f:27:c9:2e:69:6a:50:01:c0:74:7f:
6b:f7:57:4c:09:e8:48:5a:5e:b6:d7:02:42:44:dd:d7:32:36:
c2:8e:9d:fa:d5:8e:c5:09:8b:74:51:62:34:23:25:52:d9:23:
0c:1d:0d:da:e7:31:08:b0:a0:14:4b:d9:e9:26:5d:ac:56:eb:
dc:ce:75:12:cf:36:27:a6:85:8d:41:87:6e:de:19:d3:5e:0e:
27:95:7a:68:96:aa:e9:ea:15:00:98:32:74:50:fe:7c:72:38:
5a:ac:6f:ef:f0:61:6b:3d:06:6c:d0:be:7e:5a:53:7b:b1:84:
88:c6:7d:b9:f0:73:1c:30:ac:79:18:fe:97:7b:42:50:ff:bf:
be:ea:81:e1:ba:3b:8a:03:05:b9:37:4f:0d:22:45:37:81:cc:
58:23:b5:fa:ad:5e:50:e8:43:06:38:1f:83:38:2f:e0:ed:8b:
17:6a:9c:9f:f1:86:8c:c6:54:3e:7f:12:b1:f1:12:ad:c6:24:
30:fd:1b:a5:30:d8:77:a2:90:f0:d2:e0:9e:ac:ce:07:ed:37:
ec:43:9c:25
-----BEGIN CERTIFICATE-----
MIIE0TCCA7mgAwIBAgITMwAAAAgesX6cFfyDegABAAAACDANBgkqhkiG9w0BAQsF
ADCBgTELMAkGA1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcT
B1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjErMCkGA1UE
AxMiTWljcm9zb2Z0IENvcnBvcmF0aW9uIFVFRkkgQ0EgMjAxMTAeFw0xMjA3MDIy
MjI1MTRaFw0xMzEwMDIyMjI1MTRaMIGVMQswCQYDVQQGEwJVUzETMBEGA1UECBMK
V2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0
IENvcnBvcmF0aW9uMQ0wCwYDVQQLEwRNT1BSMTAwLgYDVQQDEydNaWNyb3NvZnQg
V2luZG93cyBVRUZJIERyaXZlciBQdWJsaXNoZXIwggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQDpIk+20zs8FhtIQeSe7u0Zy3v+A6a9a/HrKH3WwokbEKW/
s5l9TL84I+diNjk92FTXhCTT6uJTxVvjPiaojAHGmeDtq63hMdG1ohoCVzKoUjy0
k6eHe7X4svz0S57G14dtK742GhM2iIw9y9FedPZxfG4PjC9+y/iNpdXnszHwPysx
NtYd/qPkE1AA0c7qPgm1/twwtB95d+UCgyyfwHAHY+fmjEOBC5HJc2PZRbmEWgeu
ve5txFZ0LhGHcyXPleVtJftuv6Nx8VVpGzC959IdseQBbuNtLyCH4tqAAGfsWEoH
CVcNgk+COheAFQanfGIbi+Yi16CmV+YfjpAgLzbnAgMBAAGjggEqMIIBJjAfBgNV
HSUEGDAWBggrBgEFBQcDAwYKKwYBBAGCN1ACATAdBgNVHQ4EFgQUwEz8eC+VFd3V
ZV26/zKXOWqTUqYwHwYDVR0jBBgwFoAUE62/Qwm9gnCcjNVPMW7VIpiKG9QwUwYD
VR0fBEwwSjBIoEagRIZCaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9j
cmwvTWljQ29yVUVGQ0EyMDExXzIwMTEtMDYtMjcuY3JsMGAGCCsGAQUFBwEBBFQw
UjBQBggrBgEFBQcwAoZEaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9j
ZXJ0cy9NaWNDb3JVRUZDQTIwMTFfMjAxMS0wNi0yNy5jcnQwDAYDVR0TAQH/BAIw
ADANBgkqhkiG9w0BAQsFAAOCAQEAhAgxQ55OY+iNAOGwwGeNcLuJ9GbpAnqygXeS
bV3vgXWzJA5yn5Q/HmvZSg8nyS5palABwHR/a/dXTAnoSFpettcCQkTd1zI2wo6d
+tWOxQmLdFFiNCMlUtkjDB0N2ucxCLCgFEvZ6SZdrFbr3M51Es82J6aFjUGHbt4Z
014OJ5V6aJaq6eoVAJgydFD+fHI4Wqxv7/Bhaz0GbNC+flpTe7GEiMZ9ufBzHDCs
eRj+l3tCUP+/vuqB4bo7igMFuTdPDSJFN4HMWCO1+q1eUOhDBjgfgzgv4O2LF2qc
n/GGjMZUPn8SsfESrcYkMP0bpTDYd6KQ8NLgnqzOB+037EOcJQ==
-----END CERTIFICATE-----
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
61:08:d3:c4:00:00:00:00:00:04
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation Third Party Marketplace Root
Validity
Not Before: Jun 27 21:22:45 2011 GMT
Not After : Jun 27 21:32:45 2026 GMT
Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Corporation UEFI CA 2011
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:a5:08:6c:4c:c7:45:09:6a:4b:0c:a4:c0:87:7f:
06:75:0c:43:01:54:64:e0:16:7f:07:ed:92:7d:0b:
b2:73:bf:0c:0a:c6:4a:45:61:a0:c5:16:2d:96:d3:
f5:2b:a0:fb:4d:49:9b:41:80:90:3c:b9:54:fd:e6:
bc:d1:9d:c4:a4:18:8a:7f:41:8a:5c:59:83:68:32:
bb:8c:47:c9:ee:71:bc:21:4f:9a:8a:7c:ff:44:3f:
8d:8f:32:b2:26:48:ae:75:b5:ee:c9:4c:1e:4a:19:
7e:e4:82:9a:1d:78:77:4d:0c:b0:bd:f6:0f:d3:16:
d3:bc:fa:2b:a5:51:38:5d:f5:fb:ba:db:78:02:db:
ff:ec:0a:1b:96:d5:83:b8:19:13:e9:b6:c0:7b:40:
7b:e1:1f:28:27:c9:fa:ef:56:5e:1c:e6:7e:94:7e:
c0:f0:44:b2:79:39:e5:da:b2:62:8b:4d:bf:38:70:
e2:68:24:14:c9:33:a4:08:37:d5:58:69:5e:d3:7c:
ed:c1:04:53:08:e7:4e:b0:2a:87:63:08:61:6f:63:
15:59:ea:b2:2b:79:d7:0c:61:67:8a:5b:fd:5e:ad:
87:7f:ba:86:67:4f:71:58:12:22:04:22:22:ce:8b:
ef:54:71:00:ce:50:35:58:76:95:08:ee:6a:b1:a2:
01:d5
Exponent: 65537 (0x10001)
X509v3 extensions:
1.3.6.1.4.1.311.21.1:
.....
1.3.6.1.4.1.311.21.2:
....k..wSJ.%7.N.&{. p.
X509v3 Subject Key Identifier:
13:AD:BF:43:09:BD:82:70:9C:8C:D5:4F:31:6E:D5:22:98:8A:1B:D4
1.3.6.1.4.1.311.20.2:
.
.S.u.b.C.A
X509v3 Key Usage:
Digital Signature, Certificate Sign, CRL Sign
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Authority Key Identifier:
keyid:45:66:52:43:E1:7E:58:11:BF:D6:4E:9E:23:55:08:3B:3A:22:6A:A8
X509v3 CRL Distribution Points:
Full Name:
URI:http://crl.microsoft.com/pki/crl/products/MicCorThiParMarRoo_2010-10-05.crl
Authority Information Access:
CA Issuers - URI:http://www.microsoft.com/pki/certs/MicCorThiParMarRoo_2010-10-05.crt
Signature Algorithm: sha256WithRSAEncryption
35:08:42:ff:30:cc:ce:f7:76:0c:ad:10:68:58:35:29:46:32:
76:27:7c:ef:12:41:27:42:1b:4a:aa:6d:81:38:48:59:13:55:
f3:e9:58:34:a6:16:0b:82:aa:5d:ad:82:da:80:83:41:06:8f:
b4:1d:f2:03:b9:f3:1a:5d:1b:f1:50:90:f9:b3:55:84:42:28:
1c:20:bd:b2:ae:51:14:c5:c0:ac:97:95:21:1c:90:db:0f:fc:
77:9e:95:73:91:88:ca:bd:bd:52:b9:05:50:0d:df:57:9e:a0:
61:ed:0d:e5:6d:25:d9:40:0f:17:40:c8:ce:a3:4a:c2:4d:af:
9a:12:1d:08:54:8f:bd:c7:bc:b9:2b:3d:49:2b:1f:32:fc:6a:
21:69:4f:9b:c8:7e:42:34:fc:36:06:17:8b:8f:20:40:c0:b3:
9a:25:75:27:cd:c9:03:a3:f6:5d:d1:e7:36:54:7a:b9:50:b5:
d3:12:d1:07:bf:bb:74:df:dc:1e:8f:80:d5:ed:18:f4:2f:14:
16:6b:2f:de:66:8c:b0:23:e5:c7:84:d8:ed:ea:c1:33:82:ad:
56:4b:18:2d:f1:68:95:07:cd:cf:f0:72:f0:ae:bb:dd:86:85:
98:2c:21:4c:33:2b:f0:0f:4a:f0:68:87:b5:92:55:32:75:a1:
6a:82:6a:3c:a3:25:11:a4:ed:ad:d7:04:ae:cb:d8:40:59:a0:
84:d1:95:4c:62:91:22:1a:74:1d:8c:3d:47:0e:44:a6:e4:b0:
9b:34:35:b1:fa:b6:53:a8:2c:81:ec:a4:05:71:c8:9d:b8:ba:
e8:1b:44:66:e4:47:54:0e:8e:56:7f:b3:9f:16:98:b2:86:d0:
68:3e:90:23:b5:2f:5e:8f:50:85:8d:c6:8d:82:5f:41:a1:f4:
2e:0d:e0:99:d2:6c:75:e4:b6:69:b5:21:86:fa:07:d1:f6:e2:
4d:d1:da:ad:2c:77:53:1e:25:32:37:c7:6c:52:72:95:86:b0:
f1:35:61:6a:19:f5:b2:3b:81:50:56:a6:32:2d:fe:a2:89:f9:
42:86:27:18:55:a1:82:ca:5a:9b:f8:30:98:54:14:a6:47:96:
25:2f:c8:26:e4:41:94:1a:5c:02:3f:e5:96:e3:85:5b:3c:3e:
3f:bb:47:16:72:55:e2:25:22:b1:d9:7b:e7:03:06:2a:a3:f7:
1e:90:46:c3:00:0d:d6:19:89:e3:0e:35:27:62:03:71:15:a6:
ef:d0:27:a0:a0:59:37:60:f8:38:94:b8:e0:78:70:f8:ba:4c:
86:87:94:f6:e0:ae:02:45:ee:65:c2:b6:a3:7e:69:16:75:07:
92:9b:f5:a6:bc:59:83:58
-----BEGIN CERTIFICATE-----
MIIGEDCCA/igAwIBAgIKYQjTxAAAAAAABDANBgkqhkiG9w0BAQsFADCBkTELMAkG
A1UEBhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQx
HjAcBgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjE7MDkGA1UEAxMyTWljcm9z
b2Z0IENvcnBvcmF0aW9uIFRoaXJkIFBhcnR5IE1hcmtldHBsYWNlIFJvb3QwHhcN
MTEwNjI3MjEyMjQ1WhcNMjYwNjI3MjEzMjQ1WjCBgTELMAkGA1UEBhMCVVMxEzAR
BgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1p
Y3Jvc29mdCBDb3Jwb3JhdGlvbjErMCkGA1UEAxMiTWljcm9zb2Z0IENvcnBvcmF0
aW9uIFVFRkkgQ0EgMjAxMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AKUIbEzHRQlqSwykwId/BnUMQwFUZOAWfwftkn0LsnO/DArGSkVhoMUWLZbT9Sug
+01Jm0GAkDy5VP3mvNGdxKQYin9BilxZg2gyu4xHye5xvCFPmop8/0Q/jY8ysiZI
rnW17slMHkoZfuSCmh14d00MsL32D9MW07z6K6VROF31+7rbeALb/+wKG5bVg7gZ
E+m2wHtAe+EfKCfJ+u9WXhzmfpR+wPBEsnk55dqyYotNvzhw4mgkFMkzpAg31Vhp
XtN87cEEUwjnTrAqh2MIYW9jFVnqsit51wxhZ4pb/V6th3+6hmdPcVgSIgQiIs6L
71RxAM5QNVh2lQjuarGiAdUCAwEAAaOCAXYwggFyMBIGCSsGAQQBgjcVAQQFAgMB
AAEwIwYJKwYBBAGCNxUCBBYEFPjBa7d/d1NK8yU3HU6hJnsPIHCAMB0GA1UdDgQW
BBQTrb9DCb2CcJyM1U8xbtUimIob1DAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMA
QTALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRFZlJD
4X5YEb/WTp4jVQg7OiJqqDBcBgNVHR8EVTBTMFGgT6BNhktodHRwOi8vY3JsLm1p
Y3Jvc29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNDb3JUaGlQYXJNYXJSb29f
MjAxMC0xMC0wNS5jcmwwYAYIKwYBBQUHAQEEVDBSMFAGCCsGAQUFBzAChkRodHRw
Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpL2NlcnRzL01pY0NvclRoaVBhck1hclJv
b18yMDEwLTEwLTA1LmNydDANBgkqhkiG9w0BAQsFAAOCAgEANQhC/zDMzvd2DK0Q
aFg1KUYydid87xJBJ0IbSqptgThIWRNV8+lYNKYWC4KqXa2C2oCDQQaPtB3yA7nz
Gl0b8VCQ+bNVhEIoHCC9sq5RFMXArJeVIRyQ2w/8d56Vc5GIyr29UrkFUA3fV56g
Ye0N5W0l2UAPF0DIzqNKwk2vmhIdCFSPvce8uSs9SSsfMvxqIWlPm8h+QjT8NgYX
i48gQMCzmiV1J83JA6P2XdHnNlR6uVC10xLRB7+7dN/cHo+A1e0Y9C8UFmsv3maM
sCPlx4TY7erBM4KtVksYLfFolQfNz/By8K673YaFmCwhTDMr8A9K8GiHtZJVMnWh
aoJqPKMlEaTtrdcErsvYQFmghNGVTGKRIhp0HYw9Rw5EpuSwmzQ1sfq2U6gsgeyk
BXHInbi66BtEZuRHVA6OVn+znxaYsobQaD6QI7UvXo9QhY3GjYJfQaH0Lg3gmdJs
deS2abUhhvoH0fbiTdHarSx3Ux4lMjfHbFJylYaw8TVhahn1sjuBUFamMi3+oon5
QoYnGFWhgspam/gwmFQUpkeWJS/IJuRBlBpcAj/lluOFWzw+P7tHFnJV4iUisdl7
5wMGKqP3HpBGwwAN1hmJ4w41J2IDcRWm79AnoKBZN2D4OJS44Hhw+LpMhoeU9uCu
AkXuZcK2o35pFnUHkpv1prxZg1g=
-----END CERTIFICATE-----
--
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to shim-signed in Ubuntu.
https://bugs.launchpad.net/bugs/1234649
Title:
UEFI shim verification against microsoft-uefica-public.pem fails with
20131003 saucy images
Status in “shim-signed” package in Ubuntu:
New
Bug description:
UEFI shim verification fails (PKCS7 verification failed) with the images of 20131003 against the microsoft-uefica-public. keys present in
http://bazaar.launchpad.net/~ubuntu-bugcontrol/qa-regression-testing/master/files/head:/notes_testing/secure-boot/keys/
The following is the failure results (http://bazaar.launchpad.net/~utah/utah/dev/view/head:/utah/isotest/iso_static_validation.py)
DEBUG: Using iso at: /tmp/utah-saucy-server-amd64.iso
INFO: Preparing image: /tmp/utah-saucy-server-amd64.iso
INFO: /tmp/utah-saucy-server-amd64.iso is locally available as /tmp/utah-saucy-server-amd64.iso
INFO: Getting image type of /tmp/utah-saucy-server-amd64.iso
DEBUG: bsdtar list command: bsdtar -t -f /tmp/utah-saucy-server-amd64.iso
INFO: Image type is: server
DEBUG: Using normal image
DEBUG: bsdtar list command: bsdtar -t -v -f /tmp/utah-saucy-server-amd64.iso ./.disk/info
DEBUG: bsdtar extract command: bsdtar -x -f /tmp/utah-saucy-server-amd64.iso -O .disk/info
INFO: Arch is: amd64
INFO: Series is saucy
DEBUG: Standard name for this iso is: saucy-server-amd64.iso
DEBUG: Generating verification certificates
DEBUG: Extracting UEFI boot and kernel images
DEBUG: bsdtar list command: bsdtar -t -v -f /tmp/utah-saucy-server-amd64.iso ./EFI/BOOT/BOOTx64.EFI
DEBUG: bsdtar extract command: bsdtar -x -f /tmp/utah-saucy-server-amd64.iso -O EFI/BOOT/BOOTx64.EFI
DEBUG: bsdtar list command: bsdtar -t -v -f /tmp/utah-saucy-server-amd64.iso ./EFI/BOOT/grubx64.efi
DEBUG: bsdtar extract command: bsdtar -x -f /tmp/utah-saucy-server-amd64.iso -O EFI/BOOT/grubx64.efi
DEBUG: bsdtar list command: bsdtar -t -v -f /tmp/utah-saucy-server-amd64.iso ./install/vmlinuz
DEBUG: bsdtar extract command: bsdtar -x -f /tmp/utah-saucy-server-amd64.iso -O install/vmlinuz
DEBUG: Verifying UEFI shim
ERROR: test_efi_secure_boot_signatures (__main__.TestValidateISO)
ERROR: Traceback (most recent call last):
File "/usr/lib/python2.7/unittest/case.py", line 327, in run
testMethod()
File "/usr/share/utah/isotest/iso_static_validation.py", line 481, in test_efi_secure_boot_signatures
self.assertEqual(stdout, 'Signature verification OK\n')
File "/usr/lib/python2.7/unittest/case.py", line 511, in assertEqual
assertion_func(first, second, msg=msg)
File "/usr/lib/python2.7/unittest/case.py", line 504, in _baseAssertEqual
raise self.failureException(msg)
AssertionError: 'PKCS7 verification failed\nSignature verification failed\n' != 'Signature verification OK\n'
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/shim-signed/+bug/1234649/+subscriptions
More information about the foundations-bugs
mailing list