TencentOS Linux 4 shim-15.8 x64 and aarch64

[costinchen]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/costinchen/shim-review/tree/tencentos-4-shim-15.8-x86_64-aarch64-20240930

---

What is the SHA256 hash of your final SHIM binary?

---

a82578d410cdc75513a3870977e9c66a46fc98cfc4b9f0fc9def135ee6fa74fc  shimaa64.efi
faa7300b0daf818403ad4578d2ff875360f2f0f5a30c338d211ac9d4279dd4da  shimx64.efi

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

N/A

---

If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?

---

#440

[steve-mcintyre]

There's a real problem here:

1. openssl-add-ecdsa-and-ec-support-for-shim.patch: This patch adds support for ECDSA and EC >algorithms in shim's bundled openssl.
2. shim-support-sm2-and-sm3-algorithm.patch: This patch adds support for the SM2 and SM3 >algorithms in shim, by adding sm3-related arguments to shim's main functions.

By applying these two patches, we can enable shim support for the SM2 and SM3 algorithms on >TencentOS Server 4. The SM2 algorithm is an asymmetric key algorithm that uses fewer bytes than RSA >while providing enhanced security. The SM3 algorithm is a hashing algorithm which is more secure >than algorithms like SHA-256. Together with the keys generated by our HSM that support SMx >algorithms, we can achieve secure boot using SM (ShangMi) algorithms on TencentOS Server 4. This is >crucial as our TS4 needs to support the entire chain of SM algorithms, including during the early >stages of booting.

We cannot accept changes this large as patches at shim-review time. This klnd of thing needs to be submitted for upstream submission into shim.

[costinchen]

OK, we will try to submit a PR to upstream shim first

[steve-mcintyre]

Marking this as blocked based on those patches going upstream.

[steve-mcintyre]

Patch discussion in rhboot/shim#697

[costinchen]

Hi，since the upstream has closed our PR and rejected our patches, we would like to close this issue as well. Is that ok?
Additionally, #440 is independent and unrelated with those patches, could you help review that one?
Thanks a lot.

[steve-mcintyre]

Closing this review for now, as suggested.