grub is not validating kernel if i embed a GPG public key in grub and sign kernel with GPG private key
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
grub2 (Ubuntu) |
Opinion
|
Undecided
|
Unassigned |
Bug Description
Hello,
I am embedding custom GPG public key in grub and sign (detached) the 4.15.0-46-generic kernel with GPG private key. The grub is not validating the kernel. I am getting an error "/vmlinuz-
However this process used to work fine on 4.15.0-45-generic kernel. UEFI used to verify shim (custom SSL signed) and shim (embedded with SSL cert) used to verify grub (signed with custom SSL key). Grub would validate kernel using embeddded custom GPG public key. Kernel would be signed with custom GPG private key.
Is there any commits that went in grub which broke this feature? Is grub no more validating kernel with embedded key in it? Does it always uses UEFI keys to validate kernel? or does it give control to shim to verify the kernel?
Any inputs on this?
Status changed to 'Confirmed' because the bug affects multiple users.