From d98fb76fd86548bc583a8d32de3a2cabe7e40a60 Mon Sep 17 00:00:00 2001
From: James Le Cuirot <jlecuirot@microsoft.com>
Date: Fri, 10 Jul 2026 15:27:26 +0100
Subject: [PATCH] build_library: Update our temporary Secure Boot CA
 certificate

As a reminder, this is what we're using for official releases until we
get a formally signed certificate from Microsoft.

Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
---
 build_library/flatcar-sb-dev-ca.pem         | 26 +++++++++++++++++++++
 build_library/flatcar-sb-dev-shim-2025.cert | 22 -----------------
 build_library/vm_image_util.sh              |  2 +-
 3 files changed, 27 insertions(+), 23 deletions(-)
 create mode 100644 build_library/flatcar-sb-dev-ca.pem
 delete mode 100644 build_library/flatcar-sb-dev-shim-2025.cert

diff --git a/build_library/flatcar-sb-dev-ca.pem b/build_library/flatcar-sb-dev-ca.pem
new file mode 100644
index 00000000000..aecb08ea99e
--- /dev/null
+++ b/build_library/flatcar-sb-dev-ca.pem
@@ -0,0 +1,26 @@
+-----BEGIN CERTIFICATE-----
+MIIEcDCCA1igAwIBAgICCSkwDQYJKoZIhvcNAQELBQAwPTE7MDkGA1UEAxMyRmxh
+dGNhciBDb250YWluZXIgTGludXggU2VjdXJlIEJvb3QgRGV2ZWxvcG1lbnQgQ0Ew
+HhcNMjYwNDE2MTUxMDU4WhcNMjkwNDE1MTUxMTIyWjBCMUAwPgYDVQQDEzdGbGF0
+Y2FyIENvbnRhaW5lciBMaW51eCBTZWN1cmUgQm9vdCBEZXZlbG9wbWVudCBTaWdu
+aW5nMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAp4oT51XJzxR4De7f
+Jk8PejbWvNIWa/6I5IpxebDhnncLerJe6AvHc1o7MXLPFmzLv5VIf7YL0p82kSYN
+WaOHcC/AaRirI7C8wv4g/2yshAmIM6kj2uCRuun7At5qCi2XatrblJXRQ8FWzdKT
+KYNlHgJvYhjzZtBWvofKmsx9QeOkyhnwr3Ox5SJIxQZqUVhbqCtMGf0qV8LhVa4H
+4HCbHE3EvuTGslk5WjtYYG2Xc+xzboC/6Nt6mWw3Yo8Xm+4PkBrVQaDFovDQPPJ8
+ed6fC4ZpY+gqYy6lpab6viAy/VCp3RYcw1hGJqPann2qP1ccjRvp0LnPMNpSwrF1
+jOwKZKUoJpaaSs0Oufa1aSAJcVtM1quE3QKPmRf3BRqYbiyR+I2qEp2jcm06UhIb
+k8ezNRMaUZiSWjgmSh35ZIeZoNxdg2xSBaHP4ljyQDcWbfbGYWEzqV6KaKgmRzDV
+PUui3aD4krj6MMPe8rh8HdkRCSgO+V6caVQ2Hbmm7gnq9559POJnng/xGlas3s7z
+r+gNOx7mqrStcmss0j3CcV2kLBwogam6coCmADf7OcsIg281eR7fNVlq0A1xgz3a
+WMvfAVEKZYwOdxy+04CPlQ92y8sV5lpxDGunbsiyAa37xcpT0JLOj7pAl3Vptt7s
+1tQ5qgaxrewrqJWWPfxUkZC58wECAwEAAaN1MHMwDAYDVR0TAQH/BAIwADATBgNV
+HSUEDDAKBggrBgEFBQcDAzAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0OBBYEFGjs3Wiz
+K4rYpR1kvupxpjLcVJgrMB8GA1UdIwQYMBaAFG302uD2fNi02ks5Z4g9C8hX/oew
+MA0GCSqGSIb3DQEBCwUAA4IBAQADQUE+9ucysmLgYoMYgRMGf6hVvh2CgaoN720Z
+YiU6mTP0rAkfh7aGO8j6pZrYf6+g/RNHZaDcVJl9dZQ6ZAasZNYyVxrVutTCbaKI
+UHm26rI0hWIBntIVmTFQNQQ6beG2tOQjzj5u80WDvnCnZJTat3e69H6A4o50aEWi
+95/ZlvLYfT60ex/uEpGo/iCEyTynnFQ3F38pIBP4EePOxwNSC4kM7OCn/lHHGm1d
+E2jUnHOmXj0gZo72JHpV0VUVkkKD3Bmo/vIBsrlGWIILzavT82ng+fkc25ulJzFK
+zXxg/SQExpXtlCDh8p+/jO3jzkf4CZDEM4nr6hkF+TTUou0a
+-----END CERTIFICATE-----
diff --git a/build_library/flatcar-sb-dev-shim-2025.cert b/build_library/flatcar-sb-dev-shim-2025.cert
deleted file mode 100644
index db8b89984a2..00000000000
--- a/build_library/flatcar-sb-dev-shim-2025.cert
+++ /dev/null
@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIEPDCCAySgAwIBAgICCSkwDQYJKoZIhvcNAQELBQAwPTE7MDkGA1UEAxMyRmxhdGNhciBDb250
-YWluZXIgTGludXggU2VjdXJlIEJvb3QgRGV2ZWxvcG1lbnQgQ0EwHhcNMjUwMzIwMTE1NzI5WhcN
-MjgwMzIwMTE1NzI5WjBRMSAwHgYDVQQKExdGbGF0Y2FyIENvbnRhaW5lciBMaW51eDEtMCsGA1UE
-AxMkRmxhdGNhciBDb250YWluZXIgTGludXggU2hpbSBTaWduaW5nMIICIjANBgkqhkiG9w0BAQEF
-AAOCAg8AMIICCgKCAgEA1/GCCSfkqRgSgSqphcfkBgRVxhdhYwlTm4DMeIet/15kPEQ8h8zGm5Js
-DhYYBKJfeGCM36/pBFT61KcpOTcxuEg2VKm2zOLsGfxymZjWln1Y3nUPiWx6AY/CRM6g2vYgXYIj
-x40aJN73usdRmdk6mVssKMMokkYFuH7eOxgWCkGtBbu/UZ/MU0VfdAc12EIuk/K4LMjSFpOitH2x
-mAvFobB8YAYzwhVybNl8etXUS+I3HjCUAwl0ly/fv4Pjb8LODI22jkPV/2X1OxG59wHOxsiNSBvd
-8szcYAH49iHg2bMVljsjtnEA7b51r4I6HJWlvTOc9Z3+jVz9mPXVlh6GEOzSVMBV7KsxkWeQdoUf
-8cQm+tqdfG2xVJUAWCil7xZAk1/l5C2fWgkRHX7fmF71ZDWW240iJvKRuA1/MlU5HlZfQk0EjgYv
-VZpwklpygn5bHbzquFlqwDhmtypULfTZ/NHnf1ygRuzwi7n/RTlZMziveNIj/yJBXoXdHlta8yDo
-VfV8G/m19z+YPW3gET2H1UwU656axcw7wUspndmuZySqqHl0yTDi/B1s8lT8+VxK4dol+GVIvys3
-zD6/K5J11YbsGydogBWSjir60ObWzloPLd8cQ0OXwHddZy5fFrfHgoTfrCacAOvcYynmwoHLHwwQ
-RVtC/X7MH4R2fIcvtAUCAwEAAaMyMDAwCQYDVR0TBAIwADATBgNVHSUEDDAKBggrBgEFBQcDAzAO
-BgNVHQ8BAf8EBAMCAb4wDQYJKoZIhvcNAQELBQADggEBAGdP0xWGtfrCwPTL/m/2dJDx0VWnMf7C
-sAHNmlTji7d7bO7tI7h5RVj664z2GUgjpYlnCMAiDqutG3Uksrxq59lXaV2q4em4clZtnIWPwJ5V
-UcySW5VePkTekJHzS27KjNG/l6audfutM6GkKIMjMxJE1M/a5v+FsHF9taFEJrjJDPRD7gi/c75H
-sqW8C0hwcm/6/+yaoQte6ufTZu1TFacbXPEp0cZ4JHjxILYxXNIn6x2PUFMFo1XLhjOAIC67AaUk
-/qNhqmhxD3yYhagamvPKN9mV0qlqv1tw61XYvJwL5eDfSgtQXCiZlXjQWu+lysF3p2pH7lyGdzGr
-19/6sbQ=
------END CERTIFICATE-----
diff --git a/build_library/vm_image_util.sh b/build_library/vm_image_util.sh
index 21e4591d8b4..b02de02755f 100644
--- a/build_library/vm_image_util.sh
+++ b/build_library/vm_image_util.sh
@@ -724,7 +724,7 @@ _write_qemu_uefi_secure_conf() {
     local _sb_extra_db_certs=()
     if [[ -z ${SBSIGN_DB_CERT:-} ]]; then
         # Default behavior: include the temporary dev shim cert alongside DB.crt
-        _sb_extra_db_certs=( --add-db "${owner}" "${BUILD_LIBRARY_DIR}/flatcar-sb-dev-shim-2025.cert" )
+        _sb_extra_db_certs=( --add-db "${owner}" "${BUILD_LIBRARY_DIR}/flatcar-sb-dev-ca.pem" )
     fi
     virt-fw-vars \
         --input "${flash_in}" \