Your message dated Fri, 24 Jul 2026 14:18:08 +0000
with message-id <[email protected]>
and subject line Bug#1141851: fixed in sbsigntool 0.9.4-3.2+deb13u1
has caused the Debian Bug report #1141851,
regarding sbsigntool: Please fix intermediate certificate verification in
Debian 13 ("trixie")
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1141851: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1141851
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: sbsigntool
Version: 0.9.4-3.2
Severity: important
Dear Maintainer,
there is a nasty and longstanding bug in sbverify: Verification of
intermediate certificates returns true, even if there's no match, even
if no signer's certificate was passed at all.
In unstable, this was fixed in 0.9.4-6:
| * Add patch from upstream to fix certificate validation with
| intermediates.
In my opinion, this should be addressed in stable as well (actually also
oldstable but bookworm already moved to the downstream distribution).
Kind regards,
Christoph
-- System Information:
Debian Release: 13.5
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500,
'stable'), (1, 'proposed-updates')
Architecture: amd64 (x86_64)
Kernel: Linux 6.12.94 (SMP w/8 CPU threads)
Kernel taint flags: TAINT_WARN
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages sbsigntool depends on:
ii libc6 2.41-12+deb13u3
ii libssl3t64 3.5.6-1~deb13u2
ii libuuid1 2.41-5
sbsigntool recommends no packages.
sbsigntool suggests no packages.
-- no debconf information
signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---
Source: sbsigntool
Source-Version: 0.9.4-3.2+deb13u1
Done: Steve McIntyre <[email protected]>
We believe that the bug you reported is fixed in the latest version of
sbsigntool, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Steve McIntyre <[email protected]> (supplier of updated sbsigntool package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 14 Jul 2026 22:29:10 +0200
Source: sbsigntool
Architecture: source
Version: 0.9.4-3.2+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Debian EFI Team <[email protected]>
Changed-By: Steve McIntyre <[email protected]>
Closes: 1141851
Changes:
sbsigntool (0.9.4-3.2+deb13u1) trixie; urgency=medium
.
* Backport the "certificate validation with intermediates" fix for
trixie. Closes: #1141851
Checksums-Sha1:
2052a273b11f9e62fa2182501bd231d3fe841ea8 2077 sbsigntool_0.9.4-3.2+deb13u1.dsc
50c01f540b28768e0b60c8206b475ae85d426d75 9800
sbsigntool_0.9.4-3.2+deb13u1.debian.tar.xz
1b7ef504e08230584d15c3b34776115000f92343 7083
sbsigntool_0.9.4-3.2+deb13u1_source.buildinfo
Checksums-Sha256:
0a5ceb6616365777212ed3d4d64b101c624468dd34365719b39ab8aa921bdd79 2077
sbsigntool_0.9.4-3.2+deb13u1.dsc
b594b53e7e3f79d43675559809eac8ed8ee596eafe9dce0e7c5281e9b04c4ed4 9800
sbsigntool_0.9.4-3.2+deb13u1.debian.tar.xz
ca757f101a511d4623df538eb34d2916106edb104c0048eac8e99162c35b0242 7083
sbsigntool_0.9.4-3.2+deb13u1_source.buildinfo
Files:
c71113b7e2ebc64a3ef29d9778da2e35 2077 utils optional
sbsigntool_0.9.4-3.2+deb13u1.dsc
e0d13ae403adf9be87efd855d90ad373 9800 utils optional
sbsigntool_0.9.4-3.2+deb13u1.debian.tar.xz
a2ea53107f29f93e869a482c87543bcc 7083 utils optional
sbsigntool_0.9.4-3.2+deb13u1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJFBAEBCgAvFiEEzrtSMB1hfpEDkP4WWHl5VzRCaE4FAmphahERHDkzc2FtQGRl
Ymlhbi5vcmcACgkQWHl5VzRCaE6Azg/8CZVDl+brrYMBYcyeLpAfc3F93qf2JUm/
kDZJYHXqJDrFPFCo/CqWmHoulG7JAh7glBSC0ICqsWxxtCSql4qQ+wHagNwCmUiR
xMcT+6DChFkMxAeZzUdprQaOXsHwqbvTYTN71xNRE4XjaG2BY6IlCnWZyzGskwNu
aP3MR14KMK7bbpDRqFNmb0icWGqJpsg3/budmtm8hJMeW8JwfC91k1JsazZ68uPf
51Vys8iAd9RkVeHJZAGZHMShxEAcq2JupJdQoDL9CoFcT/RnRUy4DKmUam2+beOe
3DJQNIziIy42NlJbKDYz+mtxK3WRHx8T2c+o1lUwwyfgNv7xXLS7JvO6TflHxeVD
++TVEvIN486jHVBmvtwO29iLANLEnPfdtivfV5VcHbrAjkwZg5Ij15HBJCzv3AQZ
FzNeI4LwyxyxQikRJ61m+JdmgSpbEgZBCFHOGNF5YuXBQQmhJHhJ3eSS9nxsFQsy
nqcu5dFSxPKcjaBsu4w6aK+dwP1uxx/wmKdjNUCHXGPIPgJB6puPAArGNM/CnA9I
GpqwQp/gCGA67it69uNDTq7MrGPVhsrkvfVf+D7gsu9TR3E/XsmT25owBIbnnewL
5ZsmA/tTjVPTd7kEINBvlOXB+rhzpM059ANwaBSbZXH5CmuKC+h9k4+ruUeHIz8a
VSlcbuW4GCY=
=4Lwb
-----END PGP SIGNATURE-----
pgpp2UdJKJVf6.pgp
Description: PGP signature
--- End Message ---
