shim 15.8 for CentOS Stream 10

[bstinsonmhk]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/CentOS/shim-review/releases/tag/centos-stream-10-shim-x86-20241120

---

What is the SHA256 hash of your final SHIM binary?

---

1f79899df33ba605e65a2eb431cf23f48a2c3832cf2220f74eb295b469c4ba3d shimx64.efi

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

#399 (Abandoned)

---

If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?

---

Contact info was verified in #399

---

Other Comments

---

I plan to submit a new CentOS Stream 9 review after this one. To address some of the commentary in the previous review: we don't have plans to add additional sbat entries to grub2, so the entries listed in the review represent the current state.

[steve-mcintyre]

Contacts verified previously in #399

[steve-mcintyre]

Please link to tags on yoursubmissions here, not commit hashes

[arrfab]

I see that @bstinsonmhk adusted branch name and tag : https://github.com/CentOS/shim-review/releases/tag/centos-stream-10-shim-x86-20241120

Myself I just rebuilt through Dockerfile (with podman) shim and I confirm that checksums match :

STEP 20/20: RUN sha256sum ./usr/share/shim/15.8-3.el10.centos/x64/shimx64.efi /shimx64.efi
1f79899df33ba605e65a2eb431cf23f48a2c3832cf2220f74eb295b469c4ba3d  ./usr/share/shim/15.8-3.el10.centos/x64/shimx64.efi
1f79899df33ba605e65a2eb431cf23f48a2c3832cf2220f74eb295b469c4ba3d  /shimx64.efi

[aronowski]

The application form is incomplete and missing some questions - please rebase it to the newest README.md revision.