Comment 5 for bug 2004201

Revision history for this message
dann frazier (dannf) wrote :

This was implicitly verified when I verified bug 2004208:
  https://bugs.launchpad.net/ubuntu/+source/shim-signed/+bug/2004208/comments/7
While I wasn't able to fully complete bionic verification there, I explicitly ran the test in the SRU template on bionic/arm64 to validate this one:

ubuntu@ubuntu:~$ sudo file /boot/vmlinuz-*
/boot/vmlinuz-4.15.0-202-generic: gzip compressed data, max compression, from Unix
/boot/vmlinuz-5.4.0-137-generic: gzip compressed data, was "vmlinuz-5.4.0-137-generic.efi.signed", last modified: Thu Jan 12 19:14:50 2023, max compression, from Unix
/boot/vmlinuz-5.4.0-139-generic: gzip compressed data, was "vmlinuz-5.4.0-139-generic.efi.signed", last modified: Fri Jan 27 12:20:31 2023, max compression, from Unix
ubuntu@ubuntu:~$ sudo /usr/lib/shim/is-not-revoked /boot/vmlinuz-*
No signature table present
E: /boot/vmlinuz-4.15.0-202-generic: Could not find signing subject, sbverify output follows:
No signature table present
E: /boot/vmlinuz-5.4.0-137-generic: revoked key CN=Canonical Ltd. Secure Boot Signing (2017) used