You are not logged in.
Pages: 1
I'm trying to boot arch using the provided ipxe file https://archlinux.org/releng/netboot/
I formated my usb drive and copied the file :
sudo mkfs.fat -F 32 /dev/sda1
udisksctl mount --block-device /dev/sda1
mkdir -p /run/media/nicolas/A857-4067/EFI/BOOT
cp ipxe-arch.efi /run/media/nicolas/A857-4067/EFI/BOOT/BOOTx64.EFI
umount /run/media/nicolas/A857-4067
The UEFI boot successfully into the USB drive. I chose a mirror and selected 'boot to arch'. The program downloaded the vmlinuz-linux and the sig file.
Then the error message :
Could not verify: Permission denied (http://ipxe.org/0216eb8f)
The wiki refers to x509 certificate, but the mirror server only serves HTTP. I think it is misleading.
Offline
the stub you download from https://archlinux.org/releng/netboot/ is pretty much just a bootstrap to download the most recent script from https://ipxe.archlinux.org/releng/netbo … linux.ipxe (yes, according to
strings ipxe-arch.efi it does use https - but if you get into the menu you already past that stage)
as you can see within the script all mirrors are http only urls - nothin TLS here
for the sake of trying i tried it myself and got to the same error when verifying the the kernel with its signature
so - let's investigate what kind of a signature we have
according to
file vmlinuz-linux.ipxe.sig we got a DER encoded pkcs#7 signature
let's parse that with openssl
openssl pkcs7 -inform der -in vmlinuz-linux.ipxe.sig -print
PKCS7:
type: pkcs7-signedData (1.2.840.113549.1.7.2)
d.sign:
version: 1
md_algs:
algorithm: sha256 (2.16.840.1.101.3.4.2.1)
parameter: <ABSENT>
contents:
type: pkcs7-data (1.2.840.113549.1.7.1)
d.data: <ABSENT>
cert:
cert_info:
version: 2
serialNumber: 0x4176B8AC676565E88C5B26FB19D1BFCB3C0EA7E0
signature:
algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)
parameter: NULL
issuer: C=DE, CN=Pierre Schmitz/emailAddress=pierre@archlinux.de
validity:
notBefore: Jun 30 17:04:32 2026 GMT
notAfter: Jun 27 17:04:32 2036 GMT
subject: C=DE, CN=Pierre Schmitz/emailAddress=pierre@archlinux.de
key: X509_PUBKEY:
algor:
algorithm: rsaEncryption (1.2.840.113549.1.1.1)
parameter: NULL
public_key: (0 unused bits)
0000 - 30 82 02 0a 02 82 02 01-00 cc 9b 7f db b0 0.............
000e - 7b a3 be 14 f5 18 47 8c-9c 04 37 01 26 9d {.....G...7.&.
001c - 10 3a c5 03 49 2c 3d 73-91 09 b1 32 49 ff .:..I,=s...2I.
002a - 41 c3 93 e7 05 5b d3 9d-87 19 d1 b3 13 8f A....[........
0038 - 09 8c ab a8 4f c5 12 eb-0c c8 0c b2 ca b6 ....O.........
0046 - 75 0d 5a a9 ad 37 a0 72-ac 2a 81 94 a6 2c u.Z..7.r.*...,
0054 - dc 01 a7 e8 0f 0e dd 74-26 e3 50 33 b2 05 .......t&.P3..
0062 - 22 cd 29 dc 21 3a 27 2b-8b 58 95 a3 9f e6 ".).!:'+.X....
0070 - 49 b9 56 b5 43 07 e0 f3-4c 0e bf f0 8b 91 I.V.C...L.....
007e - 01 16 3f 9a 25 b3 7a 38-56 ba 05 0b 32 40 ..?.%.z8V...2@
008c - 29 de 27 55 17 fc 25 2c-a4 fb 81 e4 6b 5b ).'U..%,....k[
009a - 9d b6 ac 38 cc 4c 83 b5-aa 26 67 ae b5 67 ...8.L...&g..g
00a8 - 10 47 df e3 c0 a0 4d 8d-f9 57 0c 3c 2d f2 .G....M..W.<-.
00b6 - 4c e0 52 e1 1b 9a 6d 45-38 3e 8b 5f 15 73 L.R...mE8>._.s
00c4 - 2b 58 67 c1 2e ec 46 2b-72 15 1f df 6b a1 +Xg...F+r...k.
00d2 - fd 92 14 6e f5 f6 8d 19-0c eb 55 2e e6 82 ...n......U...
00e0 - 10 0a 38 57 2c 22 62 a3-b4 a8 02 8a 06 51 ..8W,"b......Q
00ee - f4 5c 4b dd 38 01 b8 2a-e1 c5 14 a4 0d d5 .\K.8..*......
00fc - 44 c5 45 0f 72 65 77 1f-74 d0 67 31 84 56 D.E.rew.t.g1.V
010a - dd 0a 5b 3d f3 1c ac 55-03 62 f8 47 5b 83 ..[=...U.b.G[.
0118 - 7f 74 7e 49 84 a2 f4 2c-3b ef ae 7d 0d af .t~I...,;..}..
0126 - 50 b9 38 96 d9 4a 5d ad-ae 23 e6 25 42 69 P.8..J]..#.%Bi
0134 - 30 14 61 71 1b ad e9 91-fa 16 43 56 2e 66 0.aq......CV.f
0142 - af 35 5f 10 f5 ca 4c d6-a5 c6 d2 cf f2 1f .5_...L.......
0150 - 64 5a 05 0d be 2d ee d8-74 a5 6b 73 2d 39 dZ...-..t.ks-9
015e - 4a 26 09 a1 a6 50 a2 fc-6b c5 01 b3 24 38 J&...P..k...$8
016c - 3d 3a e5 a2 33 8f 60 8c-11 d6 df 69 66 b8 =:..3.`....if.
017a - ad 42 e2 8e c1 fe c7 fa-e6 a6 4e 0a 46 4e .B........N.FN
0188 - db 36 a0 2c 27 fc c7 12-84 87 f7 ed 6d da .6.,'.......m.
0196 - 67 84 1a 4b 15 b5 2a 5d-3d 3b 55 ee 6b 5f g..K..*]=;U.k_
01a4 - 6e 88 51 44 fa 0b e3 7f-75 12 31 5d c9 95 n.QD....u.1]..
01b2 - d3 e8 96 39 af c8 b1 ba-3c d6 83 9e 6e b8 ...9....<...n.
01c0 - 87 66 5e 7a e7 d1 5c 79-a7 b6 c0 0f 09 a0 .f^z..\y......
01ce - 16 93 ef f9 b7 ad 14 97-38 fc 82 e2 10 01 ........8.....
01dc - 59 b5 f4 79 18 37 7e 18-8e 6e e6 d3 7c 7e Y..y.7~..n..|~
01ea - f8 43 5a 1e 2c 21 02 94-1c 7c 37 8b 2e b6 .CZ.,!...|7...
01f8 - fa 0c 03 44 b8 43 65 6e-52 f1 5a 07 a5 72 ...D.CenR.Z..r
0206 - 37 9c 39 02 03 01 00 01- 7.9.....
issuerUID: <ABSENT>
subjectUID: <ABSENT>
extensions:
object: X509v3 Key Usage (2.5.29.15)
critical: FALSE
value:
0000 - 03 02 07 80 ....
object: X509v3 Extended Key Usage (2.5.29.37)
critical: FALSE
value:
0000 - 30 0a 06 08 2b 06 01 05-05 07 03 03 0...+.......
object: X509v3 Subject Key Identifier (2.5.29.14)
critical: FALSE
value:
0000 - 04 14 08 82 97 70 a9 0b-03 b2 1b 71 e7 .....p.....q.
000d - 9c 82 df c2 b6 13 5e f6-db ......^..
sig_alg:
algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)
parameter: NULL
signature: (0 unused bits)
0000 - 7f 58 6d fe f7 06 a7 85-3b ba ce 2c 55 63 0c .Xm.....;..,Uc.
000f - 37 79 78 37 63 a3 c7 19-fb 6f ca 57 41 b1 bc 7yx7c....o.WA..
001e - f0 46 60 ca f7 b0 01 1c-b3 37 d2 2b c5 fa 91 .F`......7.+...
002d - ec 48 fe cf c9 f7 be f8-97 85 29 e2 6f e8 a1 .H........).o..
003c - 3e 5b 2b 66 03 30 12 1e-31 76 50 94 f7 9a 9d >[+f.0..1vP....
004b - b0 55 bf fd c7 3c af 38-0c 13 0a b4 cc 60 c3 .U...<.8.....`.
005a - 4e a4 ae bb a1 bd 5e b0-57 da 57 5d ed 70 fd N.....^.W.W].p.
0069 - f9 0e 9a 8a 91 c1 bb 5c-8f 0b 4d 90 b0 01 ab .......\..M....
0078 - 91 d9 d8 f6 ef 98 10 f0-e1 0c a3 83 fe 1a 46 ..............F
0087 - 2a d0 64 97 b8 75 51 38-09 a6 ec a3 70 ae af *.d..uQ8....p..
0096 - ab 84 73 6b 7b d4 b3 d6-68 85 36 99 fc 36 ba ..sk{...h.6..6.
00a5 - 34 69 19 05 2b cc 3c 38-d7 10 68 da d0 a9 a2 4i..+.<8..h....
00b4 - a2 87 40 53 73 bc 03 2a-82 ae 74 3e 10 1f 8e ..@Ss..*..t>...
00c3 - 48 af 8d c3 5f 45 64 25-b9 86 22 c8 fb c8 5c H..._Ed%.."...\
00d2 - ca 22 0b 33 cd a4 25 17-82 dc ea 9b 9e 05 7b .".3..%.......{
00e1 - 95 bc 82 b1 9c 97 e1 3c-d5 34 18 1d fe 59 eb .......<.4...Y.
00f0 - 11 27 7f c5 e1 40 17 cb-be fb d0 6f 39 9c 6f .'...@.....o9.o
00ff - 40 c3 b9 c4 94 81 38 6e-7b 3d ff b4 d8 87 ca @.....8n{=.....
010e - e0 bd 68 a1 28 06 e0 0e-e1 9c 7a f8 1a 45 b6 ..h.(.....z..E.
011d - 7f 36 0d 30 fb 8b 5a dc-64 0b ca de ba 08 a6 .6.0..Z.d......
012c - 1b e9 f1 9b 20 e9 73 31-2d 39 54 68 44 de 78 .... .s1-9ThD.x
013b - 83 43 bc 6b 8f 8e cd 0e-10 cb 89 5e 06 2b 15 .C.k.......^.+.
014a - 1a 26 af 8f 3f 25 6a 53-62 6a 7d 34 65 30 c8 .&..?%jSbj}4e0.
0159 - 34 44 92 62 15 af 83 f8-7b f8 58 51 49 d5 c1 4D.b....{.XQI..
0168 - da bb 66 2c 8e 04 43 34-54 81 16 54 29 79 68 ..f,..C4T..T)yh
0177 - 00 e5 5f 4b 42 fc 67 56-4b 0e 10 8c 1b 3f d7 .._KB.gVK....?.
0186 - e6 15 10 ca c3 2c d5 20-82 cf 02 a7 c0 c4 da .....,. .......
0195 - df c6 fd af 03 98 d9 52-1b 88 10 96 32 22 ae .......R....2".
01a4 - 6d 34 94 f4 ef 3a 71 ed-e8 11 e1 5e 79 31 30 m4...:q....^y10
01b3 - 66 cd a5 18 33 e8 be 63-63 8d 94 67 f9 94 bf f...3..cc..g...
01c2 - eb c0 ac 63 7f dd 52 05-8d 23 27 81 84 7a 39 ...c..R..#'..z9
01d1 - cc e2 9b 7f a6 e5 23 76-5d f6 61 1e 90 6b 3a ......#v].a..k:
01e0 - c6 d1 34 d8 09 5d 0a 01-50 59 32 13 c8 72 21 ..4..]..PY2..r!
01ef - 55 90 24 46 8c c6 16 cb-3c 54 c0 5d 41 a8 f8 U.$F....<T.]A..
01fe - 6c 10 l.
crl:
<ABSENT>
signer_info:
version: 1
issuer_and_serial:
issuer: C=DE, CN=Pierre Schmitz/emailAddress=pierre@archlinux.de
serial: 0x4176B8AC676565E88C5B26FB19D1BFCB3C0EA7E0
digest_alg:
algorithm: sha256 (2.16.840.1.101.3.4.2.1)
parameter: <ABSENT>
auth_attr:
<ABSENT>
digest_enc_alg:
algorithm: rsaEncryption (1.2.840.113549.1.1.1)
parameter: NULL
enc_digest:
0000 - 99 ee 8b 40 3f ba 1f 9e-bc 25 2d b1 26 5e 7f ...@?....%-.&^.
000f - 9b 91 4a 49 a8 d1 9f 7b-5b 0a e0 96 b8 4e 06 ..JI...{[....N.
001e - 32 39 11 18 a8 2a 16 e8-fd ed 1c 19 c3 70 65 29...*.......pe
002d - 8e b3 4c 48 62 8f bb fd-27 93 3d e3 07 89 01 ..LHb...'.=....
003c - c9 88 6f ac c2 0e f7 2a-f0 6e 6b aa bc 9e c3 ..o....*.nk....
004b - 79 84 30 0f c7 e6 68 4a-fc 10 7a 7e 5b f1 f2 y.0...hJ..z~[..
005a - 7e 52 72 a6 63 5e cf 8b-4d 0a cc e7 3c 89 59 ~Rr.c^..M...<.Y
0069 - 66 ee 9c 18 46 20 02 56-76 e0 0d 76 10 0b d4 f...F .Vv..v...
0078 - 8e 67 05 f5 02 f7 29 d3-a5 96 4e 67 48 5e c0 .g....)...NgH^.
0087 - 78 eb 13 9b 09 43 bf 1b-94 23 03 90 67 35 64 x....C...#..g5d
0096 - 1e bf d8 7e bf 3d 96 44-fa a5 5e c9 3f 75 42 ...~.=.D..^.?uB
00a5 - ae 10 48 7c 57 e9 cb 4d-6c e0 67 47 90 44 7d ..H|W..Ml.gG.D}
00b4 - ad 3b 20 82 dc bd f3 12-50 bf 36 79 03 6c 6c .; .....P.6y.ll
00c3 - 6e 72 fb 05 be c7 2a 00-ac 03 6e 03 ad 1d ae nr....*...n....
00d2 - da 2d 49 d7 c5 8b d6 14-4d d1 36 bf 90 29 e4 .-I.....M.6..).
00e1 - 7b 7e 29 60 cf 17 2f 8c-ad be 49 1b bf 51 fa {~)`../...I..Q.
00f0 - a6 ff 1c 81 a1 e2 21 ed-13 6c 52 7a e4 32 47 ......!..lRz.2G
00ff - cc 2e 09 ec e0 31 35 bb-98 fb 82 18 eb 4e bd .....15......N.
010e - ac 46 6f 48 1a 10 03 3e-65 34 16 7d 99 c5 f7 .FoH...>e4.}...
011d - 34 68 73 b5 4f e3 f6 56-79 96 e4 4a 73 3e bb 4hs.O..Vy..Js>.
012c - 5f f9 8e a1 c1 40 f9 2b-25 9b aa 9a 77 2b 53 _....@.+%...w+S
013b - 82 80 6d ef cb 73 11 9f-b0 50 10 55 b2 7b 9e ..m..s...P.U.{.
014a - f8 58 4a 7f 8f 89 07 64-01 88 c9 a1 f5 80 c5 .XJ....d.......
0159 - bb 1a 75 b8 9c 4b ae b1-6f 7b 01 f6 fd 61 d0 ..u..K..o{...a.
0168 - 0d 67 0d 8c 41 a4 b6 e2-08 e5 b7 41 1b d7 56 .g..A......A..V
0177 - 17 6f bc 85 e5 8e 7e fd-2e ec d8 01 7d ca 06 .o....~.....}..
0186 - 59 c7 33 d2 6e 07 7c 7f-90 9c 70 a2 8c 78 5f Y.3.n.|...p..x_
0195 - 54 10 bb 2a 8f db 12 86-37 8a 22 23 b2 c3 f8 T..*....7."#...
01a4 - 7d 0f 82 c6 15 5c 02 44-70 fa 21 e3 01 56 89 }....\.Dp.!..V.
01b3 - 24 84 55 15 b5 f4 12 a8-8e 85 ec fb c9 f6 1c $.U............
01c2 - 34 d4 42 57 af 65 06 ec-7f d9 7d c5 02 c0 69 4.BW.e....}...i
01d1 - 35 9d 5e e6 5c 8f 1f 59-1f b6 83 e6 76 35 b3 5.^.\..Y....v5.
01e0 - fc eb 5e d1 57 0c 33 7e-d6 53 20 a6 60 3e c5 ..^.W.3~.S .`>.
01ef - 84 87 08 a7 56 d0 4a 55-00 6d 0b f4 ee d8 18 ....V.JU.m.....
01fe - ca b5 ..
unauth_attr:
<ABSENT>
-----BEGIN PKCS7-----
MIIILgYJKoZIhvcNAQcCoIIIHzCCCBsCAQExDTALBglghkgBZQMEAgEwCwYJKoZI
hvcNAQcBoIIFaTCCBWUwggNNoAMCAQICFEF2uKxnZWXojFsm+xnRv8s8DqfgMA0G
CSqGSIb3DQEBCwUAMEoxCzAJBgNVBAYTAkRFMRcwFQYDVQQDDA5QaWVycmUgU2No
bWl0ejEiMCAGCSqGSIb3DQEJARYTcGllcnJlQGFyY2hsaW51eC5kZTAeFw0yNjA2
MzAxNzA0MzJaFw0zNjA2MjcxNzA0MzJaMEoxCzAJBgNVBAYTAkRFMRcwFQYDVQQD
DA5QaWVycmUgU2NobWl0ejEiMCAGCSqGSIb3DQEJARYTcGllcnJlQGFyY2hsaW51
eC5kZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMybf9uwe6O+FPUY
R4ycBDcBJp0QOsUDSSw9c5EJsTJJ/0HDk+cFW9OdhxnRsxOPCYyrqE/FEusMyAyy
yrZ1DVqprTegcqwqgZSmLNwBp+gPDt10JuNQM7IFIs0p3CE6JyuLWJWjn+ZJuVa1
Qwfg80wOv/CLkQEWP5ols3o4VroFCzJAKd4nVRf8JSyk+4Hka1udtqw4zEyDtaom
Z661ZxBH3+PAoE2N+VcMPC3yTOBS4RuabUU4PotfFXMrWGfBLuxGK3IVH99rof2S
FG719o0ZDOtVLuaCEAo4VywiYqO0qAKKBlH0XEvdOAG4KuHFFKQN1UTFRQ9yZXcf
dNBnMYRW3QpbPfMcrFUDYvhHW4N/dH5JhKL0LDvvrn0Nr1C5OJbZSl2triPmJUJp
MBRhcRut6ZH6FkNWLmavNV8Q9cpM1qXG0s/yH2RaBQ2+Le7YdKVrcy05SiYJoaZQ
ovxrxQGzJDg9OuWiM49gjBHW32lmuK1C4o7B/sf65qZOCkZO2zagLCf8xxKEh/ft
bdpnhBpLFbUqXT07Ve5rX26IUUT6C+N/dRIxXcmV0+iWOa/Isbo81oOebriHZl56
59Fceae2wA8JoBaT7/m3rRSXOPyC4hABWbX0eRg3fhiObubTfH74Q1oeLCEClBx8
N4sutvoMA0S4Q2VuUvFaB6VyN5w5AgMBAAGjQzBBMAsGA1UdDwQEAwIHgDATBgNV
HSUEDDAKBggrBgEFBQcDAzAdBgNVHQ4EFgQUCIKXcKkLA7Ibceecgt/CthNe9tsw
DQYJKoZIhvcNAQELBQADggIBAH9Ybf73BqeFO7rOLFVjDDd5eDdjo8cZ+2/KV0Gx
vPBGYMr3sAEcszfSK8X6kexI/s/J9774l4Up4m/ooT5bK2YDMBIeMXZQlPeanbBV
v/3HPK84DBMKtMxgw06krruhvV6wV9pXXe1w/fkOmoqRwbtcjwtNkLABq5HZ2Pbv
mBDw4Qyjg/4aRirQZJe4dVE4Cabso3Cur6uEc2t71LPWaIU2mfw2ujRpGQUrzDw4
1xBo2tCpoqKHQFNzvAMqgq50PhAfjkivjcNfRWQluYYiyPvIXMoiCzPNpCUXgtzq
m54Fe5W8grGcl+E81TQYHf5Z6xEnf8XhQBfLvvvQbzmcb0DDucSUgThuez3/tNiH
yuC9aKEoBuAO4Zx6+BpFtn82DTD7i1rcZAvK3roIphvp8Zsg6XMxLTlUaETeeIND
vGuPjs0OEMuJXgYrFRomr48/JWpTYmp9NGUwyDREkmIVr4P4e/hYUUnVwdq7ZiyO
BEM0VIEWVCl5aADlX0tC/GdWSw4QjBs/1+YVEMrDLNUggs8Cp8DE2t/G/a8DmNlS
G4gQljIirm00lPTvOnHt6BHhXnkxMGbNpRgz6L5jY42UZ/mUv+vArGN/3VIFjSMn
gYR6Oczim3+m5SN2XfZhHpBrOsbRNNgJXQoBUFkyE8hyIVWQJEaMxhbLPFTAXUGo
+GwQMYICizCCAocCAQEwYjBKMQswCQYDVQQGEwJERTEXMBUGA1UEAwwOUGllcnJl
IFNjaG1pdHoxIjAgBgkqhkiG9w0BCQEWE3BpZXJyZUBhcmNobGludXguZGUCFEF2
uKxnZWXojFsm+xnRv8s8DqfgMAsGCWCGSAFlAwQCATANBgkqhkiG9w0BAQEFAASC
AgCZ7otAP7ofnrwlLbEmXn+bkUpJqNGfe1sK4Ja4TgYyOREYqCoW6P3tHBnDcGWO
s0xIYo+7/SeTPeMHiQHJiG+swg73KvBua6q8nsN5hDAPx+ZoSvwQen5b8fJ+UnKm
Y17Pi00KzOc8iVlm7pwYRiACVnbgDXYQC9SOZwX1Avcp06WWTmdIXsB46xObCUO/
G5QjA5BnNWQev9h+vz2WRPqlXsk/dUKuEEh8V+nLTWzgZ0eQRH2tOyCC3L3zElC/
NnkDbGxucvsFvscqAKwDbgOtHa7aLUnXxYvWFE3RNr+QKeR7filgzxcvjK2+SRu/
Ufqm/xyBoeIh7RNsUnrkMkfMLgns4DE1u5j7ghjrTr2sRm9IGhADPmU0Fn2Zxfc0
aHO1T+P2VnmW5EpzPrtf+Y6hwUD5KyWbqpp3K1OCgG3vy3MRn7BQEFWye574WEp/
j4kHZAGIyaH1gMW7GnW4nEuusW97Afb9YdANZw2MQaS24gjlt0Eb11YXb7yF5Y5+
/S7s2AF9ygZZxzPSbgd8f5CccKKMeF9UELsqj9sShjeKIiOyw/h9D4LGFVwCRHD6
IeMBVokkhFUVtfQSqI6F7PvJ9hw01EJXr2UG7H/ZfcUCwGk1nV7mXI8fWR+2g+Z2
NbP8617RVwwzftZTIKZgPsWEhwinVtBKVQBtC/Tu2BjKtQ==
-----END PKCS7-----
openssl pkcs7 -inform der -in vmlinuz-linux.ipxe.sig -print_certs -text -noout
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
41:76:b8:ac:67:65:65:e8:8c:5b:26:fb:19:d1:bf:cb:3c:0e:a7:e0
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=DE, CN=Pierre Schmitz/emailAddress=pierre@archlinux.de
Validity
Not Before: Jun 30 17:04:32 2026 GMT
Not After : Jun 27 17:04:32 2036 GMT
Subject: C=DE, CN=Pierre Schmitz/emailAddress=pierre@archlinux.de
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (4096 bit)
Modulus:
00:cc:9b:7f:db:b0:7b:a3:be:14:f5:18:47:8c:9c:
04:37:01:26:9d:10:3a:c5:03:49:2c:3d:73:91:09:
b1:32:49:ff:41:c3:93:e7:05:5b:d3:9d:87:19:d1:
b3:13:8f:09:8c:ab:a8:4f:c5:12:eb:0c:c8:0c:b2:
ca:b6:75:0d:5a:a9:ad:37:a0:72:ac:2a:81:94:a6:
2c:dc:01:a7:e8:0f:0e:dd:74:26:e3:50:33:b2:05:
22:cd:29:dc:21:3a:27:2b:8b:58:95:a3:9f:e6:49:
b9:56:b5:43:07:e0:f3:4c:0e:bf:f0:8b:91:01:16:
3f:9a:25:b3:7a:38:56:ba:05:0b:32:40:29:de:27:
55:17:fc:25:2c:a4:fb:81:e4:6b:5b:9d:b6:ac:38:
cc:4c:83:b5:aa:26:67:ae:b5:67:10:47:df:e3:c0:
a0:4d:8d:f9:57:0c:3c:2d:f2:4c:e0:52:e1:1b:9a:
6d:45:38:3e:8b:5f:15:73:2b:58:67:c1:2e:ec:46:
2b:72:15:1f:df:6b:a1:fd:92:14:6e:f5:f6:8d:19:
0c:eb:55:2e:e6:82:10:0a:38:57:2c:22:62:a3:b4:
a8:02:8a:06:51:f4:5c:4b:dd:38:01:b8:2a:e1:c5:
14:a4:0d:d5:44:c5:45:0f:72:65:77:1f:74:d0:67:
31:84:56:dd:0a:5b:3d:f3:1c:ac:55:03:62:f8:47:
5b:83:7f:74:7e:49:84:a2:f4:2c:3b:ef:ae:7d:0d:
af:50:b9:38:96:d9:4a:5d:ad:ae:23:e6:25:42:69:
30:14:61:71:1b:ad:e9:91:fa:16:43:56:2e:66:af:
35:5f:10:f5:ca:4c:d6:a5:c6:d2:cf:f2:1f:64:5a:
05:0d:be:2d:ee:d8:74:a5:6b:73:2d:39:4a:26:09:
a1:a6:50:a2:fc:6b:c5:01:b3:24:38:3d:3a:e5:a2:
33:8f:60:8c:11:d6:df:69:66:b8:ad:42:e2:8e:c1:
fe:c7:fa:e6:a6:4e:0a:46:4e:db:36:a0:2c:27:fc:
c7:12:84:87:f7:ed:6d:da:67:84:1a:4b:15:b5:2a:
5d:3d:3b:55:ee:6b:5f:6e:88:51:44:fa:0b:e3:7f:
75:12:31:5d:c9:95:d3:e8:96:39:af:c8:b1:ba:3c:
d6:83:9e:6e:b8:87:66:5e:7a:e7:d1:5c:79:a7:b6:
c0:0f:09:a0:16:93:ef:f9:b7:ad:14:97:38:fc:82:
e2:10:01:59:b5:f4:79:18:37:7e:18:8e:6e:e6:d3:
7c:7e:f8:43:5a:1e:2c:21:02:94:1c:7c:37:8b:2e:
b6:fa:0c:03:44:b8:43:65:6e:52:f1:5a:07:a5:72:
37:9c:39
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Key Usage:
Digital Signature
X509v3 Extended Key Usage:
Code Signing
X509v3 Subject Key Identifier:
08:82:97:70:A9:0B:03:B2:1B:71:E7:9C:82:DF:C2:B6:13:5E:F6:DB
Signature Algorithm: sha256WithRSAEncryption
Signature Value:
7f:58:6d:fe:f7:06:a7:85:3b:ba:ce:2c:55:63:0c:37:79:78:
37:63:a3:c7:19:fb:6f:ca:57:41:b1:bc:f0:46:60:ca:f7:b0:
01:1c:b3:37:d2:2b:c5:fa:91:ec:48:fe:cf:c9:f7:be:f8:97:
85:29:e2:6f:e8:a1:3e:5b:2b:66:03:30:12:1e:31:76:50:94:
f7:9a:9d:b0:55:bf:fd:c7:3c:af:38:0c:13:0a:b4:cc:60:c3:
4e:a4:ae:bb:a1:bd:5e:b0:57:da:57:5d:ed:70:fd:f9:0e:9a:
8a:91:c1:bb:5c:8f:0b:4d:90:b0:01:ab:91:d9:d8:f6:ef:98:
10:f0:e1:0c:a3:83:fe:1a:46:2a:d0:64:97:b8:75:51:38:09:
a6:ec:a3:70:ae:af:ab:84:73:6b:7b:d4:b3:d6:68:85:36:99:
fc:36:ba:34:69:19:05:2b:cc:3c:38:d7:10:68:da:d0:a9:a2:
a2:87:40:53:73:bc:03:2a:82:ae:74:3e:10:1f:8e:48:af:8d:
c3:5f:45:64:25:b9:86:22:c8:fb:c8:5c:ca:22:0b:33:cd:a4:
25:17:82:dc:ea:9b:9e:05:7b:95:bc:82:b1:9c:97:e1:3c:d5:
34:18:1d:fe:59:eb:11:27:7f:c5:e1:40:17:cb:be:fb:d0:6f:
39:9c:6f:40:c3:b9:c4:94:81:38:6e:7b:3d:ff:b4:d8:87:ca:
e0:bd:68:a1:28:06:e0:0e:e1:9c:7a:f8:1a:45:b6:7f:36:0d:
30:fb:8b:5a:dc:64:0b:ca:de:ba:08:a6:1b:e9:f1:9b:20:e9:
73:31:2d:39:54:68:44:de:78:83:43:bc:6b:8f:8e:cd:0e:10:
cb:89:5e:06:2b:15:1a:26:af:8f:3f:25:6a:53:62:6a:7d:34:
65:30:c8:34:44:92:62:15:af:83:f8:7b:f8:58:51:49:d5:c1:
da:bb:66:2c:8e:04:43:34:54:81:16:54:29:79:68:00:e5:5f:
4b:42:fc:67:56:4b:0e:10:8c:1b:3f:d7:e6:15:10:ca:c3:2c:
d5:20:82:cf:02:a7:c0:c4:da:df:c6:fd:af:03:98:d9:52:1b:
88:10:96:32:22:ae:6d:34:94:f4:ef:3a:71:ed:e8:11:e1:5e:
79:31:30:66:cd:a5:18:33:e8:be:63:63:8d:94:67:f9:94:bf:
eb:c0:ac:63:7f:dd:52:05:8d:23:27:81:84:7a:39:cc:e2:9b:
7f:a6:e5:23:76:5d:f6:61:1e:90:6b:3a:c6:d1:34:d8:09:5d:
0a:01:50:59:32:13:c8:72:21:55:90:24:46:8c:c6:16:cb:3c:
54:c0:5d:41:a8:f8:6c:10I'm no expert at that black magic - manual verify does succeed - but only with an extra option
openssl smime -verify -inform der -in vmlinuz-linux.ipxe.sig -content vmlinuz-linux -CAfile signer.pem -out /dev/null
Verification failure
40C4FBC38F7F0000:error:10800075:PKCS7 routines:PKCS7_verify:certificate verify error:crypto/pkcs7/pk7_smime.c:298:Verify error: unsuitable certificate purpose
openssl smime -verify -inform der -in vmlinuz-linux.ipxe.sig -content vmlinuz-linux -CAfile signer.pem -out /dev/null -noverify
Verification successfulthe "-noverify" option means: "Do not verify the signers certificate of a signed message."
according to the error message "usuitable certificate purpose" this hints to an issue with the used certificate itself
tl;dr: the actual signature itself is ok - but the certificate which vouches for the used key has an issue itself
you can get away by use "drop to ipxe shell" and run
imgtrust --allow
kernel ${mirrorurl}iso/${release}/arch/boot/x86_64/vmlinuz-linux
initrd ${mirrorurl}iso/${release}/arch/boot/x86_64/initramfs-linux.img
imgargs vmlinuz-linux initrd=initramfs-linux.img archiso_http_srv=${mirrorurl}iso/${release}/ archisobasedir=arch ${extrabootoptions}
bootyourself but without the imgverify lines to ignore the actual verification (and also omit the cms_verify=y paramter)
might can take a bit if you're not used to us layout
the first line "imgtrust --allow" is to disable the verify lock that's set at the very beginning of the ipxe script - otherwise you run into https://ipxe.org/err/020081
also the trailing slash after ${release}/ is important - otherwise the path will become corrupted /archlinux/iso/2026.07.01arch/x86_64 ... failing to load the squash image
another option is to build an ipxe efi image yourself with all that verify crap stripped out (important the line at the very start: imgtrust) - or: setup your network to provide proper pxe and serve a script yourself instead of abuse ipxe to boot from an usb thumbdrive (rather use ventoy and the full image for that)
Last edited by cryptearth (Yesterday 22:02:30)
Offline
Pages: 1