Shim-16.1 aarch64 for Cisco

[imedusa]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information (update: taking part in reviewing other shim requests).
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed ) - N/A
• any extra patches to shim via your own git tree or as files - N/A
• any extra patches to grub via your own git tree or as files - N/A
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/cisco/sto-uefi-secure-bootloader/releases/tag/cisco-shim-aarch64-20251124
https://github.com/cisco/sto-uefi-secure-bootloader/releases/tag/cisco-shim-aarch64-20251203
https://github.com/cisco/sto-uefi-secure-bootloader/releases/tag/cisco-shim-aarch64-20260105

---

What is the SHA256 hash of your final SHIM binary?

---

77e7d0f1dce3ee93a00e47513ff90f61024670bc4973d25d8c6b706b6d03418b

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

411 - shim15.8 for x86_64 - accepted

---

If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?

---

menarasi@cisco.com - new security contact has been added
vannguye@cisco.com - security contact is already verified - #354 (comment)

[steve-mcintyre]

Contact verification needed, can't progrees until we have a key for menarasi@cisco.com

[imedusa]

@steve-mcintyre I have added PGP key fingerprint for my email menarasi@cisco.com
https://keyserver.ubuntu.com/pks/lookup?search=0xA8C2AE124A319689&fingerprint=on&op=index

Updated the release tag: https://github.com/cisco/sto-uefi-secure-bootloader/releases/tag/cisco-shim-aarch64-20251203

[MuthuvelKuppusamy]

Build is not working as expected, please refer the below error.

[imedusa]

@MuthuvelKuppusamy sorry regarding the delay, i was on a winter break. I have updated Makefile to add --platform=linux/arm64 flag for cross-platform builds, which might have been causing the issue you just saw above.

sha256sum remains the same, i built it again so as to check the clean build, hence the build.log is updated. Could you try the makefile build again? Thanks.

[MuthuvelKuppusamy]

Still getting below error while building.

[imedusa]

@MuthuvelKuppusamy i observe the lines
-e "s,@@UNAME@@,Linux x86_64 x86_64 x86_64 GNU/Linux," \ in the image you attached.
Its supposed to be

#14 0.132 sed	-e "s,@@VERSION@@,16.1," \
#14 0.132 	-e "s,@@UNAME@@,Linux aarch64 aarch64 aarch64 GNU/Linux," \
#14 0.132 	-e "s,@@COMMIT@@,master," \

as seen on my build.log.

Can you drop the commands you are trying to run?

Im unable to repro this issue. Also the steps i run is:

make build-no-cache
make copy

could you try this please?

[imedusa]

@steve-mcintyre I have added PGP fingerprint for my email, can verification be done from your end? #513 (comment)

[imedusa]

@SherifNagy would you be able to help me with email verification please? Thanks.