Gecko [ theprintave.ca ]

Linux webserver 6.8.0-49-generic #49~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Wed Nov 6 17:42:15 UTC 2 x86_64
Apache/2.4.52 (Ubuntu)
Server IP : 192.168.1.1 & Your IP : 13.58.133.140
Domains : Cant Read [ /etc/named.conf ]
User : www-data

Name	Size	Permission	Date
mok	[ DIR ]	drwxr-xr-x	2024-09-18 19:48
BOOTX64.CSV	108 B	-rw-r--r--	2024-04-04 12:54
fbx64.efi	86.27 KB	-rw-r--r--	2024-04-04 12:54
is-not-revoked	1.58 KB	-rwxr-xr-x	2024-01-24 09:14
mmx64.efi	836.21 KB	-rw-r--r--	2024-04-04 12:54
shimx64.efi	934.61 KB	-rw-r--r--	2024-04-04 12:54
shimx64.efi.dualsigned	945.89 KB	-rw-r--r--	2024-04-04 12:54
shimx64.efi.signed	944.01 KB	-rw-r--r--	2024-04-04 12:54
shimx64.efi.signed.latest	944.01 KB	-rw-r--r--	2024-04-04 12:54
shimx64.efi.signed.previous	933.26 KB	-rw-r--r--	2024-04-04 12:54

Rename

#!/bin/bash
set -e
# we need to set lastpipe so we can read the signers into the signers array below
shopt -s lastpipe

exit=0

quiet=""
if [ "$1" = "-q" ]; then
	quiet=true
	shift
fi

compress_type() {
	local file="$1"
	magic="$(od -x -N2 "$file" | head -1 | cut -d' ' -f2)"
	case $magic in
		8b1f)
			echo "gzip"
			;;
		*)
			echo "none"
			;;
	esac
}

for signed_binary in "$@"; do
	if [ ! -e "$signed_binary" ]; then
		echo "E: $signed_binary: file not found">&2
		exit=1
		continue
	fi

if [ "$(compress_type "$signed_binary")" = "gzip" ]; then
		_signed_binary="$(mktemp)"
		trap 'rm -f "$_signed_binary"' EXIT
		gunzip < "$signed_binary" > "$_signed_binary"
	else
		_signed_binary="$signed_binary"
	fi
	sbverify --list "$_signed_binary" | grep subject: | grep -E -o "CN=([^/]|\\/)*" | readarray -t signers
	if [ -z "$signers" ]; then
		echo "E: $signed_binary: Could not find signing subject, sbverify output follows:">&2
		sbverify --list "$_signed_binary" >&2
		exit=1
		continue
	fi

for signer in "${signers[@]}"; do
		revoked=$(grep -xF "$signer" << EOF
CN=Canonical Ltd. Secure Boot Signing
CN=Canonical Ltd. Secure Boot Signing (2017)
CN=Canonical Ltd. Secure Boot Signing (ESM 2018)
CN=Canonical Ltd. Secure Boot Signing (2019)
CN=Canonical Ltd. Secure Boot Signing (Ubuntu Core 2019)
CN=Canonical Ltd. Secure Boot Signing (2021 v1)
CN=Canonical Ltd. Secure Boot Signing (2021 v2)
CN=Canonical Ltd. Secure Boot Signing (2021 v3)
EOF
	) || true

if [ "$revoked" ]; then
			if [ -z "$quiet" ]; then
				echo "E: $signed_binary: revoked key $revoked used">&2
			fi
			exit=1
		fi
    done
done
exit $exit