wrouesnel / netboot / 37394099508

45%

main: 45%

Build Type

push

github

Committed by wrouesnel

Commit Message

pixiecore: delegate Secure Boot signing to a remote signing service

With --secureboot-delegate-url, Pixiecore doesn't hold a signing key.
It POSTs each UEFI image to an HTTPS signing service, with
X-Pixiecore-Mac and X-Pixiecore-Image-Type (ipxe or kernel), and serves
the signed image the service returns. So the service decides, per
machine, whether and how to sign.

- iPXE is signed for the machine when it's fetched over TFTP, and
  signing starts when Pixiecore offers the machine a boot, so it's
  usually ready by the time the machine asks. Kernels are signed for
  the machine when they're served.
- The kernel URL token (ksig) now also covers the MAC address, so a
  machine can't get a kernel signed for another machine.
- Responses must be the image that was sent (same Authenticode digest)
  with a new signature, checked by the new uefisign.CheckSigned.
  Failures are logged, with the service's error message, and the image
  is served unsigned.
- Concurrent and recent requests for the same image and machine share
  one signing request. Failures aren't cached.
- TLS: --secureboot-delegate-ca-cert trusts a CA for the service. mTLS:
  --secureboot-delegate-client-cert/-client-key, or
  --secureboot-delegate-client-tpm for the TPM client certificate that
  --api-client-tpm uses. --secureboot-delegate-timeout limits requests.
- It can't be used with --secureboot-key or --secureboot-tpm.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

211 of 237 new or added lines in 9 files covered. (89.03%)

6 existing lines in 1 file now uncovered.

2108 of 4719 relevant lines covered (44.67%)

6.12 hits per line