shim-15.8 for Viasat

[pejdavies1606]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/Viasat/shim-review/releases/tag/viasat-shim-x64-20241118

---

What is the SHA256 hash of your final SHIM binary?

---

ad18f6eb26fff69de7d162967512ac3af5accdb9dbbae52152fc76b4a8f8a255

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

#252

---

If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?

---

#252

[steve-mcintyre]

Contacts have previously been verified in #252

[dennis-tseng99]

I tried to build shim binary, but I'm sorry I cannot find the Dockerfile. Although in your README.md, you have already showed the build procedure, is it possible to build by docker build . ? Why do you use that case ? Thanks.

[pejdavies1606]

I tried to build shim binary, but I'm sorry I cannot find the Dockerfile. Although in your README.md, you have already showed the build procedure, is it possible to build by docker build . ? Why do you use that case ? Thanks.

Docker is no longer available due to licensing restrictions.

[aronowski]

The shim is not reproducible, and the build process will need fixes.

Attempting to download the WSL image at https://cloud-images.ubuntu.com/wsl/noble/20240905/ubuntu-noble-wsl-amd64-24.04lts.rootfs.tar.gz results in an exception, since the server replies with a 404. Furthermore, I tried to do some further analysis on what can go wrong later on, and the package installation is likely to fail with the hardcoded git=1:2.43.0-1ubuntu7.1 installation:

E: Version '1:2.43.0-1ubuntu7.1' for 'git' was not found

Please note that I tried to set up a similar build environment (Windows installation with WSL2 and Python 3), and it kind of works (suboptimally), but I can't speak for other reviewers. Maybe another container runtime, which wouldn't be restricted by licensing, would be more accessible for others.