Ubuntu
sbsigntool package

  1. Bug #2003701
  2. Comment #0

Comment 0 for bug 2003701

Revision history for this message
Dimitri John Ledkov (xnox) wrote :

When signing UEFI applications, the signature includes signing timestamp.

Kernels, upon kexec, check that message signature is within the validity of the X.509 signing certificate.

When using original canonical kernel team test key, I no longer can kexec kernels, as the test key has expired.

UEFI specifications in general ignore signing time.

IMHO we should remove / not include signing timestamp in the UEFI signatures to avoid this.