From 65ed66f64139c1890c2de89de933ecca34bce580 Mon Sep 17 00:00:00 2001 From: Sofia Boldyreva Date: Tue, 21 Jan 2025 19:32:49 +0100 Subject: [PATCH] Update config, add cert --- config.yaml | 114 +++++++++++++++++++++++++++++++ files/almalinuxsecurebootca0.cer | Bin 0 -> 1787 bytes 2 files changed, 114 insertions(+) create mode 100644 files/almalinuxsecurebootca0.cer diff --git a/config.yaml b/config.yaml index e69de29..9797fd4 100644 --- a/config.yaml +++ b/config.yaml @@ -0,0 +1,114 @@ +actions: + - replace: + - target: "grub.macros" + find: "Provides: %{name}-efi = %{evr} \\" + replace: | + Requires: %{efi_esp_dir}/shim%%(echo %{1} | cut -d- -f2).efi \ + Provides: %{name}-efi = %{evr} \ + Provides: almalinux(grub2-sig-key) = 202303 \ + %{expand:%%ifarch x86_64 \ + Conflicts: shim-x64 <= 15.6-1.el8.alma \ + Conflicts: shim-ia32 <= 15.6-1.el8.alma \ + %%endif} \ + count: 1 + - target: "grub.macros" + find: "ln -sf ../efi/EFI/%{efi_vendor}/grubenv \\\\\\" + replace: "ln -sf ../efi/EFI/%{efidir}/grubenv \\\\\\" + count: 1 + - target: "sbat.csv.in" + find: "grub.rh,2,Red Hat,grub2,@@VERSION_RELEASE@@,mailto:secalert@redhat.com" + replace: | + grub.rh,2,Red Hat,grub2,@@RHEL_VERSION_RELEASE@@,mailto:secalert@redhat.com + grub.almalinux,2,AlmaLinux,grub2,@@VERSION_RELEASE@@,mailto:security@almalinux.org + count: 1 + - target: "spec" + find: "%undefine _hardened_build" + replace: | + %global efi_vendor almalinux + %global efidir almalinux + %global efi_esp_dir /boot/efi/EFI/%{efidir} + + %undefine _hardened_build + - target: "spec" + find: | + %define old_sb_cer %{SOURCE14} + %define old_sb_key redhatsecureboot301 + %define sb_ca %{SOURCE15} + %define sb_cer %{SOURCE16} + %define sb_key redhatsecureboot502 + replace: | + %define old_sb_cer %{SOURCE13} + %define old_sb_key almalinuxsecurebootca0 + %define sb_ca %{SOURCE13} + %define sb_cer %{SOURCE13} + %define sb_key almalinuxsecurebootca0 + count: 1 + - target: "spec" + find: | + %define old_sb_cer %{SOURCE17} + %define sb_cer %{SOURCE18} + %define sb_key redhatsecureboot702 + replace: | + %define old_sb_cer %{SOURCE13} + %define sb_cer %{SOURCE13} + %define sb_key almalinuxsecurebootca0 + count: 1 + - target: "spec" + find: | + # generate with do-rebase + %include %{SOURCE2} + replace: | + # AlmaLinux: keep upstream EVR for RHEL SBAT entry + %define rhel_version_release $(echo %{version}-%{release} | sed 's/\.alma.*//') + + # generate with do-rebase + %include %{SOURCE2} + count: 1 + - target: "spec" + find: "sed -e "s,@@VERSION@@,%{version},g" -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \" + replace: "sed -e "s,@@VERSION@@,%{version},g" -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" -e "s,@@RHEL_VERSION_RELEASE@@,%{rhel_version_release},g" \" + count: 1 + - target: "spec" + find: "%files common -f grub.lang" + replace: | + %if 0%{with_efi_arch} + %posttrans %{package_arch} + if [ -d /sys/firmware/efi ] && [ ! -f %{efi_esp_dir}/grub.cfg ]; then + grub2-mkconfig -o %{efi_esp_dir}/grub.cfg || : + fi + %endif + + %if 0%{with_alt_efi_arch} + %posttrans %{alt_package_arch} + if [ -d /sys/firmware/efi ] && [ ! -f %{efi_esp_dir}/grub.cfg ]; then + grub2-mkconfig -o %{efi_esp_dir}/grub.cfg || : + fi + %endif + + %files common -f grub.lang + + - delete_line: + - target: "spec" + lines: + - | + Source13: redhatsecurebootca3.cer + Source14: redhatsecureboot301.cer + Source15: redhatsecurebootca5.cer + Source16: redhatsecureboot502.cer + Source17: redhatsecureboot601.cer + Source18: redhatsecureboot701.cer + + - modify_release: + - suffix: ".alma.1" + enabled: true + + - changelog_entry: + - name: "Eduard Abdullin" + email: "eabdullin@almalinux.org" + line: + - "Debrand for AlmaLinux" + + - add_files: + - type: "source" + name: "almalinuxsecurebootca0.cer" + number: 13 diff --git a/files/almalinuxsecurebootca0.cer b/files/almalinuxsecurebootca0.cer new file mode 100644 index 0000000000000000000000000000000000000000..6a4e99b9ed921c4af3db55a619260f1ab76110dc GIT binary patch literal 1787 zcmb7Edpy%?9NzEu+YQ4qp+X~z$hNhS)Qi`TME^-dksg&-Xq2Cz{bpoK?*v3Lr+#1l0EMjD_^(GTMD zB!UPL)n5=TknqD$I+(55K`6BGoxr#aQ34*7AqwMDg9H&mfiQx~@Sw6ns4M2o1LnrM zj*bAGgM!g7R1KZf5ID|pa&dAA1xdG2GSJgV;wS_sr+Fwqoly#ygx9gdLs&@Wya0v} z3LG4SP65Uf7hwvK$&cd3bH#kr3{2A~=u->>#eywd37;Auj^GLf30#RlB%EMPEi-l+ zkwox{5{U(2T$BpTN6nIqJ))wy{sLj#R%$>H)k_p74EruH#z6j)0c5b{#3zMt7(@o^ zW7O-~undMU6>I1J?%P(;)EDTd~@7#vAD%qZ-ufkhh?j~ zapii8FZ6l4l2j4>$6Kvd%=FCfQ#Hi8bqZPzauDLVg0k(jF6nNqtfiz|Wxur8bX2ad zdVcV5sacnCY_nO@_S&kodX}Gu=_h9qjw-&C&Q?YW8|~hwL@-lYMZxo*mT|n_rq!Dq zNO?Kr*Z&ajuCl*+CptA}bH}3+sZUn7lNIOqU@O10Y8v~wWKcZqMh{nDsrrHAqC?Fn zC5Od?^TaPN9vZwE>ENKiT9WIkzve%`+%Pg-+wtWhW?EoI?ykMo1m;;krtqoqrdY(Z z>AG~nTPIVAdtr9e$os^OcI}Pat4B7uw#bZr_Ev0CoO20G4yS!W8C%*eNtWAYpL#d* zedparl{a8zs7XrL79O+)cgO3rRq(Xe?bv+=_YavC&C0sI{5@^Isw>gKnC3h)7Af**$k{YWr>DKj@ce|HuYY$w-4X7busAnE?sO0 z%rpc&tP$2Q5p}pRNtx`QBY$$Hy}hi^EzC7xG%sfQ5Hy0tA}}ElkTi6P2EzaYC>lh= zl7Kdzs16YhM?esDptRPfdPAw7JRwLkg(U+Y4UdZT1n$5IPa2Kec@%;nJOpT9#`r7@ z85u`PBr&nB4i2&3%Ye=kMLRG8g8%`Ki%23t2=LQLO~*2UT1>u3z97|AGoqg0iKFNf zr^ZU-duM1WW2`Y49;^^`UC`BhARRwieNz#L243SBz!P*O|5I1;uO$Gbj#^URPsEFj znJ5J48Yh#m)_^Ae=Lv|2+!#zIQG$c)nJj+~w#N#V{a95^486KX5gC+(`LS(LuYLx& zmK=g#7W3C{btC1qgXHu|&hAt1mVpg9@qz7)LQjirTbE=%tB>VaJ{w|W+SRlqtM=qq z`BZ#(0JZP>i7X28yp;YFwn*+V^|hB(LiOc)PaARBXXK%~jS_tFjUyY$QX;*+r0V45 zkE=pT=tBm1C+#j}43w`s`%TdlzpX-LE<>U=F6|4*<{yn&V-xIkW##-D?u9_i{=os1 zQ~fq=HHqcUdPH1KbNZa$#kq3WF+jPXnVa;%`a)vjg(LknHdCYpovzocJ`VZSGQKX% z9VuvTNmoc+L-8N(4b3q2QAF;sQhj@I*nzv-=TicK8=0_FUZQQx>WuhjaYMX_P|t&zHv TseG#v;Fg#3=RT@0&At3@_pP4Z literal 0 HcmV?d00001