From dccff92d14a2b7e48595acbdf3e3c7fa0d498828 Mon Sep 17 00:00:00 2001
From: eabdullin <eabdullin@almalinux.org>
Date: Thu, 13 Aug 2026 17:05:01 +0300
Subject: [PATCH] Restore AlmaLinux SecureBoot pesign key name for a10s

kernel-6.12.0-257.el10 pulled in RHEL-169468, which replaced the static
%define pesign_name_0 blocks with the runtime get_pesign_name() helper.
The auto-fix in 4e06176 dropped the two AlmaLinux replace rules that
targeted those blocks without adding a replacement, so pesign_name_0 is
now resolved at build time.

That resolution cannot work on AlmaLinux: get_pesign_name() looks for a
distro-named cert with matching content next to the generic
secureboot-*.cer files (CentOS ships centossecureboot801.cer), and
almalinux-sb-certs installs only the generic names. It therefore falls
back to "secureboot-kernel-<arch>", which the sign node does not know,
and rpm-sign exits non-zero in %build.

Pin the key name again at the new call sites, for both the kernel image
and the UKI. Fixes SecureBoot signing on x86_64, x86_64_v2, aarch64,
ppc64le and s390x (build 75517, build 74402).
---
 config.yaml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/config.yaml b/config.yaml
index 7519473..1198886 100644
--- a/config.yaml
+++ b/config.yaml
@@ -384,6 +384,24 @@ actions:
               Source480: %{name}-x86_64_v2-rt-rhel.config
               Source481: %{name}-x86_64_v2-rt-debug-rhel.config
         count: 1
+
+      # Upstream (RHEL-169468) derives the pesign cert name at build time from
+      # the cert file, expecting a distro-named cert next to the generic
+      # secureboot-*.cer ones (CentOS ships centossecureboot801.cer).
+      # almalinux-sb-certs ships only the generic names, so the discovery falls
+      # back to "secureboot-kernel-<arch>", which the sign node does not know
+      # and rpm-sign fails. Pin the AlmaLinux key name explicitly.
+      # Do not drop these two rules: without them SecureBoot signing breaks on
+      # x86_64, aarch64, ppc64le and s390x.
+      - target: "spec"
+        find: "    pesign_name_0=$(get_pesign_name %{secureboot_key_0})"
+        replace: "    pesign_name_0=almalinuxsecureboot0"
+        count: 1
+      - target: "spec"
+        find: "        pesign_name_uki_0=$(get_pesign_name %{secureboot_key_uki_0})"
+        replace: "        pesign_name_uki_0=almalinuxsecureboot0"
+        count: 1
+
   - run_script:
       - script: "create_symlinks.sh"