Please provide dual-signed shim chained to both MS & Canonical certificates

[Dimitri John Ledkov]

Please provide dual-signed shim chained to both MS & Canonical certificates

Implementation provided as:
 - shim-canonical => to submit shim for signing (ideally this portion of code should be merged into the src:shim package, when we rebuild it from scratch next)

 - shim-signed => to construct dual-signed shim

This also makes it easier to test shim uploads, as a PPA built of shim-canonical, produces signed shim, for which one can import a certificate and use straight away.

See:
https://code.launchpad.net/~xnox/ubuntu/+source/shim-signed/+git/shim-signed/+merge/386190

https://launchpad.net/ubuntu/groovy/+queue?queue_state=0&queue_text=shim-canonical

This work is required for UC20 1.0 release

[Steve Langasek (vorlon)]

Regarding shim-canonical, this looks to me like it should be a one-off, and future signing requests should be done through the shim package itself. Can you raise an MP for that?

Also, is it really the Ubuntu online signing key that you want to be signing this shim, and not the UC20 online signing key?

[Dimitri John Ledkov (xnox)]

Will raise the MP for the shim.

I want it with both keys, both in the archive with Ubuntu key; and in UC20 with UC20 key. For example openSUSE/SUSE are providing that, and I would like us be on par.

Once this is in the shim package it will be useful for testing, and also very useful for UEFI VMs deployed with Openstack, Maas, LXD, multipass.