Foxboron/sbctl

📋 Changes

• Fixed a bug where `sbctl verify` would choke on any non-PE executables.
• `sbctl sign -s` will not save files before checking if we can sign them.
• Misc dependency updates

📋 What's Changed

• Initial yubikey backend keytype support by @tomis007 in https://github.com/Foxboron/sbctl/pull/418
• CI: missing libpcsclite pkg by @pheiduck in https://github.com/Foxboron/sbctl/pull/445

✨ New Contributors

• @tomis007 made their first contribution in https://github.com/Foxboron/sbctl/pull/418
• Full Changelog: https://github.com/Foxboron/sbctl/compare/0.17...0.18

📋 Changes

• Ensure we don't wrongly compare input/output files when signing
• Added `--json` supprt to `sbctl verify`
• Ensure `sbctl setup` with no arguments returns a helpful output
• Import latest Microsoft keys for KEK and db databases
• Ensure we print the path of the file when encountering an invalid PE file
• Misc fixups in tests
• Misc typo fixes in prints

📋 What's Changed

• build.yml: download artifacts using a wildcard by @pheiduck in https://github.com/Foxboron/sbctl/pull/392
• Fix input/output file comparison when signing by @bkrochta in https://github.com/Foxboron/sbctl/pull/393
• sbctl setup migrate: fix typo by @TheConner in https://github.com/Foxboron/sbctl/pull/396
• Verified JSON support by @cybik in https://github.com/Foxboron/sbctl/pull/402
• fix: print an error on setup without args by @acuteenvy in https://github.com/Foxboron/sbctl/pull/412
• various fixes by @pheiduck in https://github.com/Foxboron/sbctl/pull/419
• Typo fix by @stmille in https://github.com/Foxboron/sbctl/pull/430
• certs: import 2023 Microsoft keys by @K900 in https://github.com/Foxboron/sbctl/pull/432

✨ New Contributors

• @TheConner made their first contribution in https://github.com/Foxboron/sbctl/pull/396
• @cybik made their first contribution in https://github.com/Foxboron/sbctl/pull/402
• @stmille made their first contribution in https://github.com/Foxboron/sbctl/pull/430
• Full Changelog: https://github.com/Foxboron/sbctl/compare/0.16...0.17

📋 Changes

• Updated `go-uefi` dependency
• Ensure `sbctl` reads `--config` even if `/etc/sbctl/sbctl.conf` is present
• Fixed a bug where `sbctl` would abort if the TPM eventlog contains the same byte multiple times
• Fixed a landlock bug where `enroll-keys --export` did not work
• Fixed a bug where an ESP mounted to multiple paths would not be detected
• Exporting keys without efivars present work again
• `sbctl sign` will now use the saved output path if the signed file is enrolled
• `enroll-keys --append` will now work without `--force`.

📋 What's Changed

• sbctl.8: fix typo in the man page by @acuteenvy in https://github.com/Foxboron/sbctl/pull/350
• Allow exporting keys without efivars present and update CI staticcheck by @Cornelicorn in https://github.com/Foxboron/sbctl/pull/363
• Morten/fix signing by @Foxboron in https://github.com/Foxboron/sbctl/pull/360
• fix esp detection with multiple mountpoints and failing udev info by @Foxboron in https://github.com/Foxboron/sbctl/pull/358
• Read output file path from db if output not specified by @bkrochta in https://github.com/Foxboron/sbctl/pull/377
• fix: allow -a/--append without force by @tippfehlr in https://github.com/Foxboron/sbctl/pull/378
• quirks: Add MS-7D70 as unaffected by @matteodev8 in https://github.com/Foxboron/sbctl/pull/382
• add usr/share/**/*.efi* to paths for pacman hook by @nebrassy in https://github.com/Foxboron/sbctl/pull/385
• + 3 more

✨ New Contributors

• @acuteenvy made their first contribution in https://github.com/Foxboron/sbctl/pull/350
• @bkrochta made their first contribution in https://github.com/Foxboron/sbctl/pull/377
• @tippfehlr made their first contribution in https://github.com/Foxboron/sbctl/pull/378
• @matteodev8 made their first contribution in https://github.com/Foxboron/sbctl/pull/382
• @nebrassy made their first contribution in https://github.com/Foxboron/sbctl/pull/385
• @ZLima12 made their first contribution in https://github.com/Foxboron/sbctl/pull/389
• Full Changelog: https://github.com/Foxboron/sbctl/compare/0.15.4...0.16

📋 Changes

• Fixed an issue where `sign-all` did not report a non-zero exit code when something failed
• Fixed and issue where we couldn't write to a file with landlock
• Fixed an issue where `--json` would print the human readable output and the json
• Fixes landlock for UKI/bundles by disabling the sandbox feature
• Some doc fixups that mentioned `/usr/share/`

📋 What's Changed

• 91-sbctl.install: Unconditionally remove file from database by @chenxiaolong in https://github.com/Foxboron/sbctl/pull/341
• sbctl: Fix human readable output being printed when using `--json` by @chenxiaolong in https://github.com/Foxboron/sbctl/pull/342
• Ensure landlock works for signing entries by @Foxboron in https://github.com/Foxboron/sbctl/pull/344

✨ New Contributors

• @chenxiaolong made their first contribution in https://github.com/Foxboron/sbctl/pull/341
• Full Changelog: https://github.com/Foxboron/sbctl/compare/0.15.3...0.15.4

📋 Changes

• Fixed a mistake where the `db_additions` setting in `sbctl.conf` was not wired up to `sbctl setup`.
• Relaxed the check for an existing install in `sbctl setup` form looking after `/var/lib/sbctl` to check for `/var/lib/sbctl/keys`.
• Fixed a bug where dmi information was not read for quirk detection when landlock was enabled.
• Fixed a bug where `sbctl create-keys` did not have access to `/var/lib` under landlock.
• Fixed a bug where `sbctl setup` didn't have access to `/usr/share`.

📋 Changes

• Fixed a bug where `sbctl setup` aborts early because `/var/lib/sbctl` already exists.

📋 Changes

• Fixed an issue where `sbctl migrate` did not work without `--disable-landlock`.
• Fixed an issue where `bundles.db` would be written to `files.json` deleting list of files.

📦 Landlock support

• `sbctl` will try to sandbox all commands with [landlock](https://landlock.io).
• Landlock is a unpriviledged sandbox, similar to OpenBSD pledge, that allows
• `sbctl` to declare the directories and files we are reading/writing a head. This
• feature is enabled by default and can be disabled by setting `landlock: false`
• in the new config file, or by passing `--disable-landlock` flag.
• The landlock feature is run with "best effort" and will degrade it's feature set
• on unsupported kernels before turning it off completely.
• Please note that any file permission issues might be because of landlock.
• + 2 more

📦 Move from `/usr/share/secureboot` to `/var/lib/sbctl` and `sbctl migrate`

• > [!IMPORTANT]
• > Please run `sbctl setup --migrate --disable-landlock`. See https://github.com/Foxboron/sbctl/issues/333
• `sbctl` has moved from using `/usr/share/secureboot` to `/var/lib/sbctl`. The
• useage of `/usr` was mostly for legacy reasons but there wasn't any motivation
• to fix this until now.
• To help with the migration `sbctl migrate` has been implemented. It will move
• all the files from the old location to `/var/lib/sbctl` and rename files
• accordingly.
• + 4 more

📦 Configuration file and `sbctl setup`

• A new way to setup sbctl has been introduced, along with a declarative
• configuration file . The default config file location is `/etc/sbctl/sbctl.conf`
• and will be read on startup if available. If the file is not present `sbctl`
• will use default settings.
• The new `sbctl setup --setup` commnd will do a complete `sbctl` installation
• based off on the new configuration file. If the file is not passed through
• `--config` or read from `/etc/sbctl/sbctl.conf` it will use the default settings
• to create and enroll Secure Boot certificates.
• + 35 more

📦 TPM key files

• `sbctl` now support creation of TPM key files using
• [`go-tpm-keyfiles`](https://github.com/Foxboron/go-tpm-keyfiles). These keys are
• mostly compatible with how other TPM2 TSS keyfiles are created. This key type
• can be used by passing on of several keytype flags to `create-keys` or
• `rotate-keys`, or by specifying the type in the new configuration file.
• The flags for `create-keys` and `rotate-keys` are
• `--keytype` - Set keytype for all keys
• `--pk-keytype` - Set PK key type
• + 23 more

🐛 `sbctl debug`

• To help with debugging efforts `sbctl debug` has been implemented. It will dump
• most of the `efivarfs`, the configuration, state information and version
• information into a tarball which can be uploaded.

♻️ Major refactoring

• Almost all of the core key handling and key hierarchy code in `sbctl` has been
• reworked to better support different key types. This has lead to a great deal of
• internal changes and refactoring. Some stuff might be subtly broken because of
• limited ability to test everything.
• However in the future it will be easier to create unit-tests for `sbctl` that
• will make it more stable in the long run.

📋 What's Changed

• nit(91-sbctl.install): consistent syntax for tests by @MithicSpirit in https://github.com/Foxboron/sbctl/pull/310
• Update the mkinitcpio post hook to return 0 when no keys are found by @punoko in https://github.com/Foxboron/sbctl/pull/312
• fix: close file by @testwill in https://github.com/Foxboron/sbctl/pull/313
• [mkinitcpio] do not add to database by @bseibold in https://github.com/Foxboron/sbctl/pull/315
• Rework sbctl backend by @Foxboron in https://github.com/Foxboron/sbctl/pull/323
• contrib: support trailing commas in sbctl setup output by @behrmann in https://github.com/Foxboron/sbctl/pull/328
• Implement sbctl setup by @Foxboron in https://github.com/Foxboron/sbctl/pull/329
• sbctl: implement landlock sandboxing by @Foxboron in https://github.com/Foxboron/sbctl/pull/330
• + 2 more

✨ New Contributors

• @MithicSpirit made their first contribution in https://github.com/Foxboron/sbctl/pull/310
• @punoko made their first contribution in https://github.com/Foxboron/sbctl/pull/312
• @testwill made their first contribution in https://github.com/Foxboron/sbctl/pull/313
• @bseibold made their first contribution in https://github.com/Foxboron/sbctl/pull/315
• @behrmann made their first contribution in https://github.com/Foxboron/sbctl/pull/328
• Full Changelog: https://github.com/Foxboron/sbctl/compare/0.14...0.15

📋 Changes

• `export-enrolled-keys` will export all enrolled keys on the system to a directory
• `list-enrolled-keys` will list the enrolled keys on the system
• `sign-all` won't abort when it encounters a file it can't sign.
• The `kernel-install` hook won't try to sign things if there are no signing keys available.
• The `kernel-install` hook will now only remove things if they actually did exist on the system.
• The `mkinitcpio` hook now only sign the built kernel/UKI instead of all the `sbctl` files.

📋 What's Changed

• 91-sbctl.install: don't sign without signing keys by @ajakk in https://github.com/Foxboron/sbctl/pull/188
• Mention COPR package by @dngray in https://github.com/Foxboron/sbctl/pull/274
• Add openSUSE to Installation in README by @photosheep in https://github.com/Foxboron/sbctl/pull/279
• sign-all don't stop signing if one file does not exist anymore by @jvllmr in https://github.com/Foxboron/sbctl/pull/280
• Update the mkinitcpio post hook to only sign the kernel/UKI which is currently being built instead of all the files in the sbctl database by @into-the-v0id in https://github.com/Foxboron/sbctl/pull/285
• ci.yaml: use github container registry by @pheiduck in https://github.com/Foxboron/sbctl/pull/288
• only remove entries if they are there by @hboetes in https://github.com/Foxboron/sbctl/pull/294
• Add list-enrolled-keys command by @jimmykarily in https://github.com/Foxboron/sbctl/pull/296
• + 4 more

✨ New Contributors

• @ajakk made their first contribution in https://github.com/Foxboron/sbctl/pull/188
• @dngray made their first contribution in https://github.com/Foxboron/sbctl/pull/274
• @photosheep made their first contribution in https://github.com/Foxboron/sbctl/pull/279
• @jvllmr made their first contribution in https://github.com/Foxboron/sbctl/pull/280
• @into-the-v0id made their first contribution in https://github.com/Foxboron/sbctl/pull/285
• @pheiduck made their first contribution in https://github.com/Foxboron/sbctl/pull/288
• @hboetes made their first contribution in https://github.com/Foxboron/sbctl/pull/294
• @jimmykarily made their first contribution in https://github.com/Foxboron/sbctl/pull/296
• + 2 more

📦 `mkinitcpio` hook

• `contrib/mkinitcpio/sbctl` now contains a hook for `mkinitcpio`.
• Similar to recent `mkinitcpio` changes, `sbctl` will now also sign when dkms modules change.

🐛 Fix `create-keys` flags

• `--export,-e` and `--database-path,-d` now works properly and doesn't overwrite the `create-keys` variables internally.

📋 What's Changed

• Update documentation for custom dbx by @Cornelicorn in https://github.com/Foxboron/sbctl/pull/253
• Check and return Open errs by @quite in https://github.com/Foxboron/sbctl/pull/254
• keys.go: drop the keyUsage bitfield by @dkwo in https://github.com/Foxboron/sbctl/pull/255
• Update README.md by @scardracs in https://github.com/Foxboron/sbctl/pull/256
• `create-keys` allows for specifying an export directory by @cosmastech in https://github.com/Foxboron/sbctl/pull/259
• tests/utils/certs.go: drop keyUsage bitfield by @dkwo in https://github.com/Foxboron/sbctl/pull/261
• Update 91-sbctl.install by @cvlc12 in https://github.com/Foxboron/sbctl/pull/266
• BUGFIX: f.StringVarP() was clearing the exportPath/databasePath strings by @spillner in https://github.com/Foxboron/sbctl/pull/267
• + 3 more

✨ New Contributors

• @quite made their first contribution in https://github.com/Foxboron/sbctl/pull/254
• @dkwo made their first contribution in https://github.com/Foxboron/sbctl/pull/255
• @scardracs made their first contribution in https://github.com/Foxboron/sbctl/pull/256
• @cosmastech made their first contribution in https://github.com/Foxboron/sbctl/pull/259
• @cvlc12 made their first contribution in https://github.com/Foxboron/sbctl/pull/266
• @spillner made their first contribution in https://github.com/Foxboron/sbctl/pull/267
• @tblancher made their first contribution in https://github.com/Foxboron/sbctl/pull/270
• @Joseph-DiGiovanni made their first contribution in https://github.com/Foxboron/sbctl/pull/271
• + 1 more

📋 What's Changed

• dmi: Test all used DMI fields by @dawidpotocki in https://github.com/Foxboron/sbctl/pull/208
• Add packages section to README by @jloeser in https://github.com/Foxboron/sbctl/pull/209
• Allow enrolling custom db and KEK certs by @Cornelicorn in https://github.com/Foxboron/sbctl/pull/217
• enroll-keys: implement --export by @Foxboron in https://github.com/Foxboron/sbctl/pull/223
• Add support for loading certificates from dbDefault by @Foxboron in https://github.com/Foxboron/sbctl/pull/222
• Add asciidoc dependency to README by @flanfly in https://github.com/Foxboron/sbctl/pull/227
• feat(enroll-keys): add partial enrollment of keys by @RiSKeD in https://github.com/Foxboron/sbctl/pull/231
• Fix typo by @swsnr in https://github.com/Foxboron/sbctl/pull/230
• + 7 more

✨ New Contributors

• @jloeser made their first contribution in https://github.com/Foxboron/sbctl/pull/209
• @Cornelicorn made their first contribution in https://github.com/Foxboron/sbctl/pull/217
• @flanfly made their first contribution in https://github.com/Foxboron/sbctl/pull/227
• @RiSKeD made their first contribution in https://github.com/Foxboron/sbctl/pull/231
• @svenschwermer made their first contribution in https://github.com/Foxboron/sbctl/pull/246
• @K900 made their first contribution in https://github.com/Foxboron/sbctl/pull/247
• Full Changelog: https://github.com/Foxboron/sbctl/compare/0.11...0.12

📋 Changes

• [F0001](https://github.com/Foxboron/sbctl/wiki/FQ0001)
• UKIs generated by sbctl now has correct section alignment.
• `enroll-keys` with `--microsoft` will now also enroll the KEK.
• `sbctl` now has a filesystem abstraction layer which allows writing proper end-to-end tests of all `efivarfs` interactions and filesystem interaction.

📋 What's Changed

• pacman: Add 'extramodules' target to hook by @memchr in https://github.com/Foxboron/sbctl/pull/191
• Fix POSIX sh comparison by @swsnr in https://github.com/Foxboron/sbctl/pull/183
• Update README.md by @vanillajonathan in https://github.com/Foxboron/sbctl/pull/193
• Fix arbitrary sizes in UKI generation by @eNV25 in https://github.com/Foxboron/sbctl/pull/194
• enroll-keys: Enroll Microsoft KEK along with their other keys by @alois31 in https://github.com/Foxboron/sbctl/pull/192
• Always include vendor keys in status output by @swsnr in https://github.com/Foxboron/sbctl/pull/205
• status: Warn about firmware quirks by @dawidpotocki in https://github.com/Foxboron/sbctl/pull/189
• Add trailing newline to JSON output by @dawidpotocki in https://github.com/Foxboron/sbctl/pull/206

✨ New Contributors

• @memchr made their first contribution in https://github.com/Foxboron/sbctl/pull/191
• @swsnr made their first contribution in https://github.com/Foxboron/sbctl/pull/183
• @vanillajonathan made their first contribution in https://github.com/Foxboron/sbctl/pull/193
• @alois31 made their first contribution in https://github.com/Foxboron/sbctl/pull/192
• @dawidpotocki made their first contribution in https://github.com/Foxboron/sbctl/pull/189
• Full Changelog: https://github.com/Foxboron/sbctl/compare/0.10...0.11

📋 Changes

• [Linux Windows Dual Boot with Windows Bitlocker ](https://github.com/Foxboron/sbctl/wiki/Linux-Windows-Dual-Boot-with-Windows-Bitlocker)
• [HPE Server include factory db key](https://github.com/Foxboron/sbctl/wiki/HPE-Server-include-factory-db-key)

📋 What's Changed

• Minor typo fix by @pschichtel in https://github.com/Foxboron/sbctl/pull/113
• Fix typo in eventlog warning by @mattiabiondi in https://github.com/Foxboron/sbctl/pull/120
• Fix minor typo by @cosandr in https://github.com/Foxboron/sbctl/pull/124
• read key from private key file by @tpeacock19 in https://github.com/Foxboron/sbctl/pull/126
• Fix typo by @potatoattack in https://github.com/Foxboron/sbctl/pull/130
• Remove hardcoded architecture in filename by @WhyNotHugo in https://github.com/Foxboron/sbctl/pull/133
• Fail `enroll-keys` if any key file does not exist by @WhyNotHugo in https://github.com/Foxboron/sbctl/pull/134
• Go needs `git` installed by @WhyNotHugo in https://github.com/Foxboron/sbctl/pull/140
• + 3 more

✨ New Contributors

• @pschichtel made their first contribution in https://github.com/Foxboron/sbctl/pull/113
• @mattiabiondi made their first contribution in https://github.com/Foxboron/sbctl/pull/120
• @cosandr made their first contribution in https://github.com/Foxboron/sbctl/pull/124
• @tpeacock19 made their first contribution in https://github.com/Foxboron/sbctl/pull/126
• @potatoattack made their first contribution in https://github.com/Foxboron/sbctl/pull/130
• Full Changelog: https://github.com/Foxboron/sbctl/compare/0.8...0.9

🗑️ sbsigntools removal

• Because of this `sbctl` now implements all secure boot operations through `go-uefi` and no longer relies on `sbsigntools`, hopefully this removes some classes of bugs due to key enrollment.

♻️ `cmd/sbctl` refactor and json output

• `sbctl list-files --json` should be a lot easier to parse with `jq` then going through normal string parsing.
• Please do note that the json structure might change and not all commands have been covered yet.