Shim 16.1 x86_64 for XenServer 9 (20251016)

[rosslagerwall]

Confirm the following are included in your repo, checking each box:

• completed README.md file with the necessary information
• shim.efi to be signed
• public portion of your certificate(s) embedded in shim (the file passed to VENDOR_CERT_FILE)
• binaries, for which hashes are added to vendor_db ( if you use vendor_db and have hashes allow-listed )
• any extra patches to shim via your own git tree or as files
• any extra patches to grub via your own git tree or as files
• build logs
• a Dockerfile to reproduce the build of the provided shim EFI binaries

---

What is the link to your tag in a repo cloned from rhboot/shim-review?

---

https://github.com/xenserver/shim-review/tree/xenserver-shim-x86_64-20251016

---

What is the SHA256 hash of your final SHIM binary?

---

1ee16ab634fbde69f933a89bba241da9750c30d4a87479f1c5223b82c9848b58

---

What is the link to your previous shim review request (if any, otherwise N/A)?

---

N/A

---

If no security contacts have changed since verification, what is the link to your request, where they've been verified (if any, otherwise N/A)?

---

N/A

[steve-mcintyre]

Sending contact verification mails now...

[andyhhp]

Ticonderoga mineralogy LSD circumnavigated perfectest NeWSes footfalls pies soupiest taunted

[rosslagerwall]

Contact verification response:

rhizome bedroll Hogan specialized down publican fudged spotlighted centrals drowned

[steve-mcintyre]

contact verification complete

[steve-mcintyre]

We've had discussion in the shim and shim-review teams in the past about SB and Xen. With loading the Xen hypervisor before Linux, we'll need to look at the security aspects there too, of course. (As you mention in xenserver-secure-boot.md). This is likely going to take some time, be aware.!