{"action":"opened","issue":{"url":"https://api.github.com/repos/rhboot/shim-review/issues/40","repository_url":"https://api.github.com/repos/rhboot/shim-review","labels_url":"https://api.github.com/repos/rhboot/shim-review/issues/40/labels{/name}","comments_url":"https://api.github.com/repos/rhboot/shim-review/issues/40/comments","events_url":"https://api.github.com/repos/rhboot/shim-review/issues/40/events","html_url":"https://github.com/rhboot/shim-review/issues/40","id":376782131,"node_id":"MDU6SXNzdWUzNzY3ODIxMzE=","number":40,"title":"shim-15 for Kaspersky Lab","user":{"login":"alexey-ve","id":44024813,"node_id":"MDQ6VXNlcjQ0MDI0ODEz","avatar_url":"https://avatars3.githubusercontent.com/u/44024813?v=4","gravatar_id":"","url":"https://api.github.com/users/alexey-ve","html_url":"https://github.com/alexey-ve","followers_url":"https://api.github.com/users/alexey-ve/followers","following_url":"https://api.github.com/users/alexey-ve/following{/other_user}","gists_url":"https://api.github.com/users/alexey-ve/gists{/gist_id}","starred_url":"https://api.github.com/users/alexey-ve/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexey-ve/subscriptions","organizations_url":"https://api.github.com/users/alexey-ve/orgs","repos_url":"https://api.github.com/users/alexey-ve/repos","events_url":"https://api.github.com/users/alexey-ve/events{/privacy}","received_events_url":"https://api.github.com/users/alexey-ve/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-11-02T12:00:35Z","updated_at":"2018-11-02T12:00:35Z","closed_at":null,"author_association":"NONE","body":"Make sure you have provided the following information:\r\n\r\n - [x] link to your code branch cloned from rhboot/shim-review in the form user/repo@tag  \r\nhttps://github.com/KasperskyLab/shim-review/tree/KasperskyLab-shim-x86_64-20181102\r\n - [x] completed README.md file with the necessary information  \r\nhttps://github.com/KasperskyLab/shim-review/blob/KasperskyLab-shim-x86_64-20181102/README.md\r\n - [x] shim.efi to be signed  \r\nhttps://github.com/KasperskyLab/shim-review/blob/KasperskyLab-shim-x86_64-20181102/shimx64.efi\r\n - [x] public portion of your certificate embedded in shim (the file passed to VENDOR_CERT_FILE)  \r\nhttps://github.com/KasperskyLab/shim/blob/shim_15_kl_patch_tag/KLBOOTEV_2018.cer\r\n - [x] any extra patches to shim via your own git tree or as files  \r\nhttps://github.com/KasperskyLab/shim/tree/shim_15_kl_patch_tag\r\n - [x] any extra patches to grub via your own git tree or as files  \r\nN/A\r\n - [x] build logs  \r\nhttps://github.com/KasperskyLab/shim-review/blob/KasperskyLab-shim-x86_64-20181102/build.log\r\n\r\n\r\n###### What organization or people are asking to have this signed:\r\nKaspersky Lab.\r\n\r\n###### What product or service is this for:\r\nKaspersky Lab's products.\r\n\r\n###### What is the origin and full version number of your shim?\r\nhttps://github.com/rhboot/shim/tree/15\r\n\r\n###### What's the justification that this really does need to be signed for the whole world to be able to boot it:\r\nKaspersky Shim is a common component for some of Kaspersky Lab's products.\r\nIt loads a universal plugin manager for various features: Full disk encryption, Rescue Disk and Early boot protection component.\r\n\r\n###### How do you manage and protect the keys used in your SHIM?\r\nPrivate key is stored in hardware module with controlled access.\r\n\r\n###### Do you use EV certificates as embedded certificates in the SHIM?\r\nYes.\r\n\r\n###### What is the origin and full version number of your bootloader (GRUB or other)?\r\nGRUB or Linux kernel is not used.\r\n\r\nThis build of shim will be used to load and verify our custom preboot components.\r\nWindows loader will be launched after that.\r\n\r\n###### If your SHIM launches any other components, please provide further details on what is launched\r\nFull disk encryption, Rescue Disk, Early boot protection component.\r\n\r\n###### How do the launched components prevent execution of unauthenticated code?\r\nAll our components are signed with authenticode signatures and always verified during loading.\r\nWindows loader is signed by Microsoft, it launched with LoadImage/StartImage and will be verified by firmware when SecureBoot is on.\r\n\r\n###### Does your SHIM load any loaders that support loading unsigned kernels (e.g. GRUB)?\r\nNo.\r\n\r\n###### What kernel are you using? Which patches does it includes to enforce Secure Boot?\r\nWe launch Windows loader and kernel.\r\n\r\n###### What changes were made since your SHIM was last signed?\r\nThis is first submission.\r\n\r\n###### What is the hash of your final SHIM binary?\r\n414065ca4238bfff0ce2601ac4ac924bc8da98b0b75c0a81cde78f05f5de869a"}}
{"actor":{"display_login":"alexey-ve"}}