Bug 1264197

Summary:	grub2-efi may be signed with the wrong certificate
Product:	Red Hat Enterprise Linux 7	Reporter:	Gordon Messmer <gordon.messmer>
Component:	grub2	Assignee:	Peter Jones <pjones>
Status:	CLOSED NOTABUG	QA Contact:	Release Test Team <release-test-team-automation>
Severity:	high	Docs Contact:
Priority:	high
Version:	7.2	CC:	lszubowi
Target Milestone:	beta
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-10-12 18:15:55 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Gordon Messmer 2015-09-17 20:24:50 UTC

Description of problem:
I have observed this only on CentOS, but it seems likely that it affects Enterprise Linux as well.

grub2-efi-2.02-0.17.el7_1.4.x86_64.rpm appears to be signed with the wrong certificate. None of the systems which I previously had in Secure Boot mode would boot following the update. The "pesign" tool reports that the new version is signed by "Red Hat Test Certificate"

[root@vagrant ~]# pesign --show-signature --in /var/tmp/grub2-16/boot/efi/EFI/centos/grubx64.efi
---------------------------------------------
certificate address is 0x7fb81b3cb808
Content was not encrypted.
Content is detached; signature cannot be verified.
The signer's common name is Red Hat Inc.
No signer email address.
Signing time: Thu Mar 26, 2015
There were certs or crls included.
---------------------------------------------
[root@vagrant ~]# pesign --show-signature --in /var/tmp/grub2-17/boot/efi/EFI/centos/grubx64.efi
---------------------------------------------
certificate address is 0x7fde869bd808
Content was not encrypted.
Content is detached; signature cannot be verified.
The signer's common name is Red Hat Test Certificate
No signer email address.
Signing time: Tue Sep 15, 2015
There were certs or crls included.
---------------------------------------------

Version-Release number of selected component (if applicable):
grub2-efi-2.02-0.17.el7_1.4.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Update
2. Reboot

Actual results:
UEFI boots and displays an error rather than the GRUB2 prompt/menu.

Expected results:

Additional info:

Comment 2 Gordon Messmer 2015-09-18 22:25:39 UTC

CentOS says that their problem is local.  Please close this ticket.  I don't seem to be able to do so.