Updating the "shim" package in fedora 44 (16.1-8?)

Ask Fedora
1

Hello, a certificate by Microsoft that is used to sign the efi shim is going to expire on June 27 (If I’m reading correctly). Reading this post: social.kernel.org it seems this shouldn’t affect the majority of systems since they don’t check if the certificate is expired. Edit: See also What you need to know about the Microsoft Secure Boot certificate expiration: Don’t Panic! - Fedora Magazine and Microsoft UEFI CA rotation: What it means for Ubuntu users and vendors - Project Discussion - Ubuntu Community Hub
Checking on my fedora 44 system, the shim is signed with the old certificate, and not the new one from 2023:

root@fedora:~# sbverify --list /boot/efi/EFI/fedora/shim.efi
warning: data remaining[898512 vs 1026520]: gaps between PE/COFF sections?
signature 1
image signature issuers:
 - /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
image signature certificates:
 - subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows UEFI Driver Publisher
   issuer:  /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
 - subject: /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011
   issuer:  /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation Third Party Marketplace Root
$ rpm -q shim-x64
shim-x64-16.1-5.x86_64

Looking at the shim package, it was updated to be signed by the new certificate in the rawhide branch (shim-16.1-7), and in the f44 branch the spec was updated to be rebuilt for f44 as 16.1-8 (0406f12f3514), but that package version doesn’t exist? dnf update doesn’t offer a new version.
I very much don’t know how the process of how builds work, but I think it is worth having 16.1-8 (or any version really with the upstream update) actually published soon so people will have a chance to update before the certificate expires (which again, shouldn’t actually affect systems).

2

How to check which key(s) signed the shim

sudo dnf install pesign -y
sudo pesign -S -i /boot/efi/EFI/fedora/shimx64.efi
4

I’m not sure what your post is trying to tell the @yedaya.

As far as I can tell the sbverify is the right command to show the certs that sign the shim.

5

You can fetch other shim versions from https://koji.fedoraproject.org/koji/packageinfo?packageID=14502

Some of them are signed with the new Microsoft certificate and some are even dual signed with both certificates.

6

sbverify is the better tool for this as shown in the original post.

7

Right, thanks for pointing that out. Is there some process where this gets in to the “update stream” for f44 automatically? As in anyone updating on f44 will get it without going to f45, or is that not a thing.

8

The fedora magazine article linked in the first post shows one useful command that might help. Checking with ls -l /boot/efi/EFI/fedora I see that most of the files are dated Nov 5 2025. I also see with dnf that I have the shim packages version 16.1-5

$ dnf list --installed shim*
Installed packages (available for reinstall, available for upgrade)
shim-ia32.x86_64 16.1-5 <unknown>
shim-x64.x86_64  16.1-5 <unknown>

In the magazine article they show the command below and as can be seen I have both signing keys (2011 & 2023) on my system.

$ mokutil --db --short
46def63b5c Microsoft Corporation UEFI CA 2011
580a6f4cc4 Microsoft Windows Production PCA 2011
b5eeb4a670 Microsoft UEFI CA 2023
3fb39e2b8b Microsoft Option ROM UEFI CA 2023
9

I think this might explain it: Shim-16.1 updates in updates-testing - #2 by decathorpe, I guess that the process of pushing it to stable is manual.

10

Try the command above to see exactly what keys are installed.
mokutil --db --short

11

I have both the 2011 and the 2023 keys installed

12

Then there is no reason to be concerned. The new signing keys are installed and available so even when the older one expires the system will just continue as normal.

13

Doesn’t the shim need to be signed by the new key for that?
I will say that I’m not worried since I’m assuming that uefi will just ignore the expiration anyway as said by the blogposts I added to the original post.

14

I found this Making sure you're not a bot! but its not on update in bodhi.

15

Nothing will happen on the magic date.
Which I think is why the shim has not been pushed for f44.

16

I think I got what you mean, once the shim is updated to only be signed by the new key I have to have it, which I do so all is well. Thanks

17

So that would be the second useful command from the Fedoramagazine.org article?