talm

1
// This Source Code Form is subject to the terms of the Mozilla Public
2
// License, v. 2.0. If a copy of the MPL was not distributed with this
3
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
4

5
// Package database generates SecureBoot auto-enrollment database.
6
package database
7

8
import (
9
	"crypto/sha256"
10

11
	"github.com/foxboron/go-uefi/efi"
12
	"github.com/foxboron/go-uefi/efi/signature"
13
	"github.com/foxboron/go-uefi/efi/util"
14
	"github.com/google/uuid"
15

16
	"github.com/aenix-io/talm/internal/pkg/secureboot/pesign"
17
	"github.com/siderolabs/talos/pkg/machinery/constants"
18
)
19

20
// Entry is a UEFI database entry.
21
type Entry struct {
22
	Name     string
23
	Contents []byte
24
}
25

26
// Generate generates a UEFI database to enroll the signing certificate.
27
//
28
// ref: https://blog.hansenpartnership.com/the-meaning-of-all-the-uefi-keys/
29
func Generate(enrolledCertificate []byte, signer pesign.CertificateSigner) ([]Entry, error) {
30
	// derive UUID from enrolled certificate
31
	uuid := uuid.NewHash(sha256.New(), uuid.NameSpaceX500, enrolledCertificate, 4)
32

33
	efiGUID := util.StringToGUID(uuid.String())
34

35
	// Create ESL
36
	db := signature.NewSignatureDatabase()
37
	if err := db.Append(signature.CERT_X509_GUID, *efiGUID, enrolledCertificate); err != nil {
38
		return nil, err
39
	}
40

41
	// Sign the ESL, but for each EFI variable
42
	signedDB, err := efi.SignEFIVariable(signer.Signer(), signer.Certificate(), "db", db.Bytes())
43
	if err != nil {
44
		return nil, err
45
	}
46

47
	signedKEK, err := efi.SignEFIVariable(signer.Signer(), signer.Certificate(), "KEK", db.Bytes())
48
	if err != nil {
49
		return nil, err
50
	}
51

52
	signedPK, err := efi.SignEFIVariable(signer.Signer(), signer.Certificate(), "PK", db.Bytes())
53
	if err != nil {
54
		return nil, err
55
	}
56

57
	return []Entry{
58
		{Name: constants.SignatureKeyAsset, Contents: signedDB},
59
		{Name: constants.KeyExchangeKeyAsset, Contents: signedKEK},
60
		{Name: constants.PlatformKeyAsset, Contents: signedPK},
61
	}, nil
62
}
63