kernel-6.12.0-257.el10 pulled in RHEL-169468, which replaced the static
%define pesign_name_0 blocks with the runtime get_pesign_name() helper.
The auto-fix in 4e06176 dropped the two AlmaLinux replace rules that
targeted those blocks without adding a replacement, so pesign_name_0 is
now resolved at build time.
That resolution cannot work on AlmaLinux: get_pesign_name() looks for a
distro-named cert with matching content next to the generic
secureboot-*.cer files (CentOS ships centossecureboot801.cer), and
almalinux-sb-certs installs only the generic names. It therefore falls
back to "secureboot-kernel-<arch>", which the sign node does not know,
and rpm-sign exits non-zero in %build.
Pin the key name again at the new call sites, for both the kernel image
and the UKI. Fixes SecureBoot signing on x86_64, x86_64_v2, aarch64,
ppc64le and s390x (build 75517, build 74402).
Removed two obsolete `replace` actions targeting the static `%define pesign_name_0` and `UKI_secureboot_name` blocks that upstream eliminated in favour of dynamic cert-name discovery.
Updated the UKI secureboot find string in config.yaml from `centossecureboot204` to `centossecureboot804` to match the renamed certificate in the upstream spec.
Updated the `find` string in the `pesign_name_0` replace action to match the new CentOS secure-boot cert name `centossecureboot801` (was `centossecureboot201`).
Updated ReplaceAction find/replace for nvidia cert block and changed almalinuxnvidia1.x509 source number from 107 to 109 to avoid conflict with new upstream Source107 (nvidiajetsonsoc.x509).
- Add riscv64 to ExclusiveArch find/replace to match updated spec
- Remove obsolete CONFIG_BTRFS_FS_CHECK_INTEGRITY from BTRFS replace
blocks (option removed in kernel 6.12)
- Keep Red Hat SBAT lines in *.sbat.template replaces and append
AlmaLinux entries instead of replacing
- Delete leftover lpfc patch file
