Ubuntu
shim-signed package

  1. Bionic (18.04)
  2. Bug #2004201
  3. Comment #0

Comment 0 for bug 2004201

Revision history for this message
dann frazier (dannf) wrote :

arm64 kernels are gzip'd by default, which currently breaks is-not-revoked:

ubuntu@ubuntu:~$ sudo file /boot/vmlinuz-5.15.0-57-generic
/boot/vmlinuz-5.15.0-57-generic: gzip compressed data, was "vmlinuz-5.15.0-57-generic.efi.signed", last modified: Tue Nov 29 10:47:41 2022, max compression, from Unix, original size modulo 2^32 46283136

ubuntu@ubuntu:~$ sudo /usr/lib/shim/is-not-revoked /boot/vmlinuz-5.15.0-57-generic ~
Invalid DOS header magic
Can't open image /boot/vmlinuz-5.15.0-57-generic
E: /boot/vmlinuz-5.15.0-57-generic: Could not finder signing subject, sbverify output follows:
Invalid DOS header magic
Can't open image /boot/vmlinuz-5.15.0-57-generic

If I decompress the vmlinuz file in place, it works:
ubuntu@ubuntu:~$ sudo /usr/lib/shim/is-not-revoked /boot/vmlinuz-5.15.0-57-generic ~
Invalid DOS header magic
Can't open image /boot/vmlinuz-5.15.0-57-generic
E: /boot/vmlinuz-5.15.0-57-generic: Could not finder signing subject, sbverify output follows:
Invalid DOS header magic
Can't open image /boot/vmlinuz-5.15.0-57-generic
ubuntu@ubuntu:~$ echo $?
1