Restore KEK 2011 signed DBX binary paths that were recently removed, while flagging them for obsolescence

[Pete Batard (pbatard)]

Description

• The recent reorganisation of the signed DBX binaries in 92b433e had the unfortunate effect of breaking downstream workflows, that relied on the presence of the DXBUpdate.bin binaries in their previous location/names. This is discussed in [Feature]: Revert the main DBX path/names to what it was before the SignedByKEK#### split #463 as well as UEFI DBX Update error pbatard/rufus#3039.
• To give some time for these workflow to be updated, the KEK 2011 signed objects that existed at the time of the removal are restored, while being being flagged as obsolete and planned for deletion at a later date as it will not be updated further. In the depreciation notice we also point to using the new .auth2 binaries from either SignedByKEK2011 or SignedByKEK2023.
• Note that it was not possible to use symlinks, as the GitHub API does not resolve symlinks URLs (the download URL it provides is the one of the symlink text), and also, because some workflows depend on being able to read the date from the commit that modifies the target of the symlink, whereas the GitHub API only ever returns the date the symlink was created.
• However, we also additionally create a SignedByKEKLatest symlink, that currently points to SignedByKEK2023, so that workflows that want to anticipate KEK 2023 expiration in 11 years years can start using that symlinked reference as a semi-immutable means of accessing the latest DBX binaries.
• Addresses [Feature]: Revert the main DBX path/names to what it was before the SignedByKEK#### split #463.

Impact

• Impacts functionality? → No. It restores functionality that was lost post 92b433e.
• Impacts security? → No. The files being restored are the same as the ones that existed prior to 92b433e and we encourage Microsoft to validate that the SHA-256 of each of the 4 file that was restored is the same as the one from the files from https://github.com/microsoft/secureboot_objects/tree/02bed0f7e6f94645a52336e70972fc17276a25ad:

  $ sha256sum PostSignedObjects/DBX/*/*.bin
  2089e3125e611376cb44326b5765674255443b2484f88de97251939d18055f68 *PostSignedObjects/DBX/amd64/DBXUpdate.bin
  84adfda4e9fe145f06154186760c92545b308f02bbc8231d52ef2b8061abae2f *PostSignedObjects/DBX/arm/DBXUpdate.bin
  ec68522271e9ac6c936c8731ce0d74417f8ed39296e85ab0e5801af195459214 *PostSignedObjects/DBX/arm64/DBXUpdate.bin
  28c9c939f8fc7eee848b105947b5e1645ec6fd4a59537b93a37f6324f116d4c7 *PostSignedObjects/DBX/x86/DBXUpdate.bin
  

• Breaking change? → No. It restores existing functionality.
• Includes tests? → No. Outside of validating that the content being restored is the same as what was removed, no tests are needed.
• Includes documentation? Yes. A README.md was added in the restored directory to flag its obsolescence and planned removal for a later date, to give time to worfklow that depend on these files to update.

Note that, because they are flagged as obsolete, the restored DBXUpdate.bin files do NOT need to be updated, even if the SignedByKEK2011 or SignedByKEK2023 .auth2 files are.

How This Was Tested

Validated that the previous GitHub API URLs for the files that were removed were restored and served content.

Integration Instructions

N/A

[Pete Batard (pbatard)]

@microsoft-github-policy-service agree