T861: add secure boot support by asklymenko · Pull Request #1223 · vyos/vyos-build

asklymenko · 2026-06-15T08:59:24Z

Change summary

Produce CI builds for VyOS shim-signed package.

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Code style update (formatting, renaming)
Refactoring (no functional changes)
Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
Other (please describe): build new package

Related Task(s)

https://vyos.dev/T861

Related PR(s)

How to test / Smoketest result

Checklist:

I have read the CONTRIBUTING document
I have linked this PR to one or more Phabricator Task(s)
My commit headlines contain a valid Task id
My change requires a change to the documentation
I have updated the documentation accordingly

coderabbitai · 2026-06-15T08:59:39Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: a852f30b-eed0-4792-a3af-11a8225727c7

📥 Commits

Reviewing files that changed from the base of the PR and between ec0afde and a7ccbf6.

📒 Files selected for processing (4)

.github/workflows/trigger_rebuild_packages.yml
scripts/package-build/shim-signed/.gitignore
scripts/package-build/shim-signed/build.py
scripts/package-build/shim-signed/package.toml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

ansible/ansible (manual)

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)

GitHub Check: codeql-analysis-call / Analyze (python)
GitHub Check: Mergify Merge Protections
GitHub Check: Summary

🧰 Additional context used

📓 Path-based instructions (2)

**/*.py

📄 CodeRabbit inference engine (AGENTS.md)

Run Pylint to check for unused-imports in Python files

Files:

scripts/package-build/shim-signed/build.py

.github/workflows/**

⚙️ CodeRabbit configuration file

.github/workflows/**: Rollout 1c (Phorge T8943, 2026-05-30) renamed default branches fleet-wide: release-train repos current -> rolling; vyos/.github and other non-release-train repos current -> production. (1) Reusable-workflow refs of the form vyos/.github/.github/workflows/<name>.yml@production are CORRECT and canonical. Do NOT suggest changing @production to @current: current is the OLD name, retained only as a temporary bake-period alias and slated for removal. Any AGENTS.md still saying "reusables pinned to @current" or "current (rolling)" is stale post-1c and must not drive review suggestions. (2) In the mirror caller pr-mirror-repo-sync.yml, permissions: contents: read is INTENTIONAL: the central reusable workflow performs all push/PR writes with the vyos-bot GitHub App installation token (minted via the get-token action), not the inherited GITHUB_TOKEN. Do NOT suggest broadening the caller's permissions to contents: write / pull-requests: write.

Files:

.github/workflows/trigger_rebuild_packages.yml

🪛 zizmor (1.25.2)

.github/workflows/trigger_rebuild_packages.yml

[info] 240-240: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🔍 Remote MCP

Additional Context for PR Review

Context on VyOS Secure Boot Initiative (T861)

Initial UEFI Secure Boot support is available (T861), and VyOS uses shim from Debian 12 (Bookworm), which is properly signed by the UEFI Secure Boot key from Microsoft. However, there is yet no signed version of shim for VyOS, thus we provide no signed image for secure boot yet.

The rolling images are currently not yet secure boot signed. VyOS is in the design and validation phase to determine how to accomplish this from a CI/CD perspective in a secure way.

What the Shim-Signed Package Does

Shim is a trivial EFI application that attempts to open and execute another application. If standard EFI calls fail because Secure Boot is enabled and the binary is not signed with an appropriate key, it validates the binary against a built-in certificate. If this succeeds and the binary or signing key are not forbidden, shim relocates and executes the binary.

Current VyOS Secure Boot Implementation

Currently, there is no signed version of shim for VyOS. If you want Secure Boot support, you can build a custom image with your own keys. During image installation, you install your MOK (Machine Owner Key) into the UEFI variables to add trust to this key.

Key Technical Considerations for Reviewers

MOK (Machine Owner Key) requirement: Users running the install mok command can set an input password to any value they choose, and they'll need this password after reboot when MOK Manager launches to permanently install the keys.
Kernel module signing: When the CI system builds a Kernel package and required third-party modules, it generates a temporary (ephemeral) key pair for signing the modules. The public key is embedded in the Kernel binary to verify loaded modules. After the Kernel CI build completes, the generated key is discarded, meaning we can no longer sign additional modules with that key.
Future Microsoft signing requirement: To fully go down the secure boot path, VyOS needs its own version of shim which needs to be signed by Microsoft. This requires code signing keys backed up, stored, and recovered only by personnel in trusted roles using at least dual-factor authorization in a physically secured environment. The private key must be protected with a hardware cryptography module (HSMs, smart cards, USB tokens, TPMs), and the operating environment must achieve security at least equal to FIPS 140-2 Level 2.

Related Commits for Context

The task includes several related commits for dependency management and CLI integration:

Adding dependency to enable UEFI secure boot support
Adding "show secure-boot [keys]" CLI command
Adding "install mok" CLI command
Displaying secure boot state in "show version" output

[::web_search::]

🔇 Additional comments (5)

scripts/package-build/shim-signed/package.toml (1)

1-11: Manifest structure is valid and follows build.py contract.

The package.toml defines the required fields (name, commit_id, scm_url) and the optional [dependencies].packages list. This will be correctly parsed and consumed by the build system (build.py lines 197-231).

scripts/package-build/shim-signed/build.py (1)

1-1: LGTM!

scripts/package-build/shim-signed/.gitignore (1)

1-1: LGTM!

.github/workflows/trigger_rebuild_packages.yml (2)

85-86: Path filter entry is correct and consistent with established pattern.

The filter key shim-signed and path pattern scripts/package-build/shim-signed/** follow the naming convention used for all other packages (e.g., lines 26-27, 28-29).

240-242: Dispatch trigger is correct and matches filter output.

The conditional check and dispatch call both reference shim-signed, consistent with the path filter key (line 85) and the package name in package.toml. Pattern is identical to the 29 other package triggers (e.g., lines 124-126).

📝 Walkthrough

Summary by CodeRabbit

Chores
- Added build configuration and CI/CD workflow automation for the shim-signed package, including path change detection to trigger downstream builds and package manifest definitions with dependency declarations.

Walkthrough

Adds a shim-signed package build configuration under scripts/package-build/shim-signed/ with a TOML manifest, a symlink to the shared build.py, and a .gitignore. The CI trigger workflow gains a path filter and dispatch block to rebuild the package on changes to that directory.

Changes

shim-signed package onboarding

Layer / File(s)	Summary
Package manifest and build scaffold `scripts/package-build/shim-signed/package.toml`, `scripts/package-build/shim-signed/build.py`, `scripts/package-build/shim-signed/.gitignore`	`package.toml` declares the `shim-signed` package with `commit_id = "rolling"`, `scm_url` pointing to `vyos/shim-signed`, and three entries under `[dependencies].packages`. `build.py` is a symlink to `../build.py`. `.gitignore` excludes the `/shim-signed/` output directory.
CI path filter and dispatch `.github/workflows/trigger_rebuild_packages.yml`	Adds `shim-signed: scripts/package-build/shim-signed/**` to the `dorny/paths-filter` step (line 85–86) and an `if`-gated `workflow_dispatch` block (lines 240–243) that fires `build-package.yml` with `package_name: shim-signed`.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title describes the main objective of the PR — adding secure boot support — which aligns with the CI build setup for the shim-signed package across all modified files.
Description check	✅ Passed	The description directly relates to the changeset, stating 'Produce CI builds for VyOS shim-signed package' and linking to task T861, matching the workflow and package configuration changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

✨ Simplify code

Create PR with simplified code

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sever-sever

Add shim binaries for secure boot.
I wonder if we can dehardcode the amd64 architect in the future.

c-po

Change looks good

asklymenko added 2 commits June 12, 2026 20:47

T861: add secure boot support. Build shim-signed package

d6d31d5

T861: add secure boot support. Build shim-signed package

a7ccbf6

asklymenko requested review from c-po, dmbaturin and sever-sever June 15, 2026 08:59

mergify Bot added the rolling label Jun 15, 2026

mergify Bot assigned asklymenko Jun 15, 2026

sever-sever approved these changes Jun 15, 2026

View reviewed changes

c-po approved these changes Jun 16, 2026

View reviewed changes

c-po merged commit b871f49 into vyos:rolling Jun 16, 2026
9 of 10 checks passed

vyos-bot Bot added mirror-initiated This PR initiated for mirror sync workflow mirror-completed and removed mirror-initiated This PR initiated for mirror sync workflow labels Jun 16, 2026

Navigation Menu

Uh oh!

T861: add secure boot support - #1223

T861: add secure boot support#1223
c-po merged 2 commits into
vyos:rollingfrom
asklymenko:rolling

asklymenko commented Jun 15, 2026

Uh oh!

coderabbitai Bot commented Jun 15, 2026 •

edited

Loading

Additional Context for PR Review

Context on VyOS Secure Boot Initiative (T861)

What the Shim-Signed Package Does

Current VyOS Secure Boot Implementation

Key Technical Considerations for Reviewers

Related Commits for Context

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

sever-sever left a comment

Uh oh!

c-po left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

asklymenko commented Jun 15, 2026

Change summary

Types of changes

Related Task(s)

Related PR(s)

How to test / Smoketest result

Checklist:

Uh oh!

coderabbitai Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Additional Context for PR Review

Context on VyOS Secure Boot Initiative (T861)

What the Shim-Signed Package Does

Current VyOS Secure Boot Implementation

Key Technical Considerations for Reviewers

Related Commits for Context

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

sever-sever left a comment

Choose a reason for hiding this comment

Uh oh!

c-po left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented Jun 15, 2026 •

edited

Loading