SLES Expanded Support platform 8

[jsegitz]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/jsegitz/shim-review/tree/SUSE-ES8-202607

---

What is the SHA256 hash of your final SHIM binary?

---

Output from sha256sum:

70a2e7068f0a1a5b8e6dc31d365b05b65e86f0dd29d77bcfe0c81e6d43b467c1  shimia32.efi

84ee8b3df6e4a86f498f397088f72e44698fae3a3bc06a9dd9c91180e1bbc116  shimia32.nx.efi

88f49db97279d01968440f09e20d4ae34f4b98058641ae3d3dbd0d837c6c8443  shimx64.efi

5926b0596291e28998742e216925cf062748fd2900167db971d5f6920e265c03  shimx64.nx.efi

Output from pesign --hash --padding --in=...:

380ec0904ff492d438df83b5371c87db3d97581556c516520068818296bb303f shimia32.efi

95211b41d6dacfc3968ca52a4bb8c3a3f35497d138aa41a332f458be589c364e shimia32.nx.efi

5c5cb95d510ec94edbaf1cdaa2b7c115a37e6884b276047f75f26ba952bb9fb8 shimx64.efi

c0251d5d6831ba0880985208e506421df933abe166a0bf7df5169a4995df3423 shimx64.nx.efi

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

#410

---

If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?

---

#419

[joseph-zeronsoftn]

Disclaimer: I am a community reviewer, not an official reviewer.

Submitted commit: https://github.com/jsegitz/shim-review/tree/327d96d5580b3d16030f8894cef515c9654fdf0a

Reproduced Build

• The hash is the same.

70a2e7068f0a1a5b8e6dc31d365b05b65e86f0dd29d77bcfe0c81e6d43b467c1  shimia32.efi
84ee8b3df6e4a86f498f397088f72e44698fae3a3bc06a9dd9c91180e1bbc116  shimia32.nx.efi
88f49db97279d01968440f09e20d4ae34f4b98058641ae3d3dbd0d837c6c8443  shimx64.efi
5926b0596291e28998742e216925cf062748fd2900167db971d5f6920e265c03  shimx64.nx.efi

PE INFO:

• The nx file has an .NX flag.

shimia32.efi:

shimia32.efi:     file format pei-i386
Characteristics 0x306
	executable
	line numbers stripped
	32 bit words
	debugging information removed
Time/Date		Mon Aug 10 12:29:23 2026
Magic			010b	(PE32)
MajorLinkerVersion	2
MinorLinkerVersion	30
SizeOfCode		0006c000
SizeOfInitializedData	00038000
SizeOfUninitializedData	00000000
AddressOfEntryPoint	00005000
BaseOfCode		00005000
BaseOfData		00075000
ImageBase		00000000
SectionAlignment	00001000
FileAlignment		00001000
MajorOSystemVersion	0
MinorOSystemVersion	0
MajorImageVersion	0
MinorImageVersion	0
MajorSubsystemVersion	0
MinorSubsystemVersion	0
Win32Version		00000000
SizeOfImage		000aa000
SizeOfHeaders		00001000
CheckSum		000cbd7d
Subsystem		0000000a	(EFI application)
DllCharacteristics	00000000
SizeOfStackReserve	00000000
SizeOfStackCommit	00000000
SizeOfHeapReserve	00000000
SizeOfHeapCommit	00000000
LoaderFlags		00000000
NumberOfRvaAndSizes	00000010

shimia32.nx.efi:

shimia32.nx.efi:     file format pei-i386
Characteristics 0x306
	executable
	line numbers stripped
	32 bit words
	debugging information removed
Time/Date		Mon Aug 10 12:29:23 2026
Magic			010b	(PE32)
MajorLinkerVersion	2
MinorLinkerVersion	30
SizeOfCode		0006c000
SizeOfInitializedData	00038000
SizeOfUninitializedData	00000000
AddressOfEntryPoint	00005000
BaseOfCode		00005000
BaseOfData		00075000
ImageBase		00000000
SectionAlignment	00001000
FileAlignment		00001000
MajorOSystemVersion	0
MinorOSystemVersion	0
MajorImageVersion	0
MinorImageVersion	0
MajorSubsystemVersion	0
MinorSubsystemVersion	0
Win32Version		00000000
SizeOfImage		000aa000
SizeOfHeaders		00001000
CheckSum		000cbe7d
Subsystem		0000000a	(EFI application)
DllCharacteristics	00000100
					NX_COMPAT
SizeOfStackReserve	00000000
SizeOfStackCommit	00000000
SizeOfHeapReserve	00000000
SizeOfHeapCommit	00000000
LoaderFlags		00000000
NumberOfRvaAndSizes	00000010

shimx64.efi:

shimx64.efi:     file format pei-x86-64
Characteristics 0x206
	executable
	line numbers stripped
	debugging information removed
Time/Date		Mon Aug 10 12:29:23 2026
Magic			020b	(PE32+)
MajorLinkerVersion	2
MinorLinkerVersion	30
SizeOfCode		0000000000066000
SizeOfInitializedData	0000000000073000
SizeOfUninitializedData	0000000000000000
AddressOfEntryPoint	0000000000025000
BaseOfCode		0000000000025000
ImageBase		0000000000000000
SectionAlignment	00001000
FileAlignment		00001000
MajorOSystemVersion	0
MinorOSystemVersion	0
MajorImageVersion	0
MinorImageVersion	0
MajorSubsystemVersion	0
MinorSubsystemVersion	0
Win32Version		00000000
SizeOfImage		000df000
SizeOfHeaders		00001000
CheckSum		000fb435
Subsystem		0000000a	(EFI application)
DllCharacteristics	00000000
SizeOfStackReserve	0000000000000000
SizeOfStackCommit	0000000000000000
SizeOfHeapReserve	0000000000000000
SizeOfHeapCommit	0000000000000000
LoaderFlags		00000000
NumberOfRvaAndSizes	00000010

shimx64.nx.efi:

shimx64.nx.efi:     file format pei-x86-64
Characteristics 0x206
	executable
	line numbers stripped
	debugging information removed
Time/Date		Mon Aug 10 12:29:23 2026
Magic			020b	(PE32+)
MajorLinkerVersion	2
MinorLinkerVersion	30
SizeOfCode		0000000000066000
SizeOfInitializedData	0000000000073000
SizeOfUninitializedData	0000000000000000
AddressOfEntryPoint	0000000000025000
BaseOfCode		0000000000025000
ImageBase		0000000000000000
SectionAlignment	00001000
FileAlignment		00001000
MajorOSystemVersion	0
MinorOSystemVersion	0
MajorImageVersion	0
MinorImageVersion	0
MajorSubsystemVersion	0
MinorSubsystemVersion	0
Win32Version		00000000
SizeOfImage		000df000
SizeOfHeaders		00001000
CheckSum		000fb535
Subsystem		0000000a	(EFI application)
DllCharacteristics	00000100
					NX_COMPAT
SizeOfStackReserve	0000000000000000
SizeOfStackCommit	0000000000000000
SizeOfHeapReserve	0000000000000000
SizeOfHeapCommit	0000000000000000
LoaderFlags		00000000
NumberOfRvaAndSizes	00000010

Shim SBAT

• SBAT(shim.sles_es,3) has not changed from the previous submission.

shimia32.efi:

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.sles_es,3,SLES Expanded Support platform,shim,16.1-2.el8,mail:security@suse.com

shimia32.nx.efi:

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.sles_es,3,SLES Expanded Support platform,shim,16.1-2.el8,mail:security@suse.com

shimx64.efi:

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.sles_es,3,SLES Expanded Support platform,shim,16.1-2.el8,mail:security@suse.com

shimx64.nx.efi:

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.sles_es,3,SLES Expanded Support platform,shim,16.1-2.el8,mail:security@suse.com

Certificate

• This is a CA certificate. CA constraint is set.
• [For reference only] The certificate expires in 2037, and NIST recommends discontinuing the use of 2048-bit RSA by 2030. Of course, other submissions have also already been approved with similar certificates.

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1 (0x1)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN = SLE Expanded Support Secure Boot CA, C = DE, L = Nuremberg, O = SUSE Linux Products GmbH, emailAddress = res-maintenance@suse.de
        Validity
            Not Before: Nov 30 15:54:45 2015 GMT
            Not After : Oct 25 15:54:45 2037 GMT
        Subject: CN = SLE Expanded Support Secure Boot CA, C = DE, L = Nuremberg, O = SUSE Linux Products GmbH, emailAddress = res-maintenance@suse.de
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c2:0f:8c:4e:10:f9:09:85:ce:7b:30:f6:ea:79:
                    e6:97:70:3a:90:e3:17:d0:84:d4:a5:f0:37:08:c3:
                    2e:a3:75:2e:ce:e6:a8:3e:d6:ec:16:00:21:3c:23:
                    5f:27:95:53:67:fe:fb:63:04:f6:3d:1b:ad:3b:16:
                    5a:3c:ba:bb:c5:d0:d3:8c:2a:74:2b:55:8c:e4:e1:
                    d0:31:fc:5e:4d:59:a9:1c:28:95:df:25:22:45:42:
                    c9:de:d8:4d:4e:bd:0b:e8:f2:00:f6:a7:62:48:d5:
                    7d:d0:87:e7:42:00:fa:b8:0c:19:3e:72:50:fe:55:
                    67:e9:cb:81:00:57:de:5c:1e:72:8c:cd:8f:af:fc:
                    17:f8:0b:9a:76:60:ee:74:e1:af:c0:d4:c0:59:e0:
                    56:24:2e:16:56:b9:18:58:33:d0:86:c6:9d:35:e1:
                    31:85:08:31:35:69:65:ff:c2:1e:ec:82:64:af:8e:
                    b6:b4:9d:75:01:bc:14:97:4d:ef:33:c1:b8:40:f9:
                    c0:d6:c9:af:3b:ce:29:bf:5f:64:99:90:ac:f4:5a:
                    7f:f2:ce:21:28:49:b9:3b:18:6e:09:c1:31:bd:74:
                    25:46:e6:75:6c:6d:0a:5c:15:f0:37:e5:70:1b:f7:
                    59:06:21:9e:b2:0d:02:67:ed:8a:24:f3:38:a6:99:
                    59:f7
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier: 
                A3:D8:7A:D0:57:00:8A:75:54:30:9B:06:D6:0C:C9:A7:F4:1D:B1:22
            X509v3 Authority Key Identifier: 
                keyid:A3:D8:7A:D0:57:00:8A:75:54:30:9B:06:D6:0C:C9:A7:F4:1D:B1:22
                DirName:/CN=SLE Expanded Support Secure Boot CA/C=DE/L=Nuremberg/O=SUSE Linux Products GmbH/emailAddress=res-maintenance@suse.de
                serial:01
            X509v3 Key Usage: critical
                Digital Signature, Certificate Sign, CRL Sign
    Signature Algorithm: sha256WithRSAEncryption
    Signature Value:
        2b:29:d0:70:80:94:56:81:2f:0f:ec:38:1c:b5:98:20:9e:c6:
        73:5b:4a:85:77:19:15:44:6c:57:69:18:2a:7c:b9:8c:18:e4:
        62:34:04:ac:4c:84:60:e8:6e:b5:6c:ab:80:d7:14:d2:9d:8c:
        de:b7:8a:83:71:20:0e:45:c4:ef:9b:5f:6e:d6:12:ac:0b:55:
        fd:72:20:35:72:67:49:fb:22:8f:31:fc:56:f6:65:1b:2c:70:
        9c:cf:ed:67:48:61:b8:d6:77:84:ec:5b:ba:13:b2:af:a2:c9:
        fa:10:15:f8:a4:15:62:c3:43:48:34:f7:f4:1d:83:a6:02:a7:
        42:6b:ef:83:c3:2d:dd:db:e4:da:eb:81:e2:35:04:99:b5:ad:
        02:b4:a8:03:d0:0f:bc:b8:f0:a8:68:d9:64:7e:b0:77:78:44:
        07:21:80:f1:d8:5c:7d:22:55:aa:10:a7:66:3f:ef:5f:1b:f0:
        c8:5c:6a:ac:ab:81:7d:cf:d0:1b:a1:ca:45:09:55:49:93:95:
        77:fa:5a:0c:2b:71:bc:b0:cb:9f:9f:1d:c0:e9:9a:f5:a0:de:
        b3:82:23:68:bd:e1:74:99:bb:b5:fb:9e:5c:ef:5f:d7:02:d6:
        45:87:1d:28:68:19:e6:7b:2f:98:99:50:5c:c7:96:57:c9:bd:
        76:b9:12:b2

Grub SBAT

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
grub,5,Free Software Foundation,grub,2.02,https//www.gnu.org/software/grub/
grub.rh,2,Red Hat,grub2,2.02-170.el8_10.2,mailto:secalert@redhat.com
grub.sll,2,SUSE,grub2,2.02-170.el8_10.2,mailto:security@suse.com

• grub,5 is included.
• It is trivial, but the : is missing in https//www.gnu.org/....