From 2f362cfe449369e12f2ffed620c901f5bf135701 Mon Sep 17 00:00:00 2001
From: Sofia Boldyreva <mooresofia81@gmail.com>
Date: Mon, 3 Feb 2025 11:01:27 +0100
Subject: [PATCH] Initial commit

---
 config.yaml                   |  78 ++++++++++++++++++++++++++++++++++
 files/almalinux-sb-cert-1.der | Bin 0 -> 1787 bytes
 files/almalinux-sb-cert-2.der | Bin 0 -> 1792 bytes
 files/almalinux-sb-cert-3.der | Bin 0 -> 970 bytes
 files/sbat.almalinux.csv      |   1 +
 5 files changed, 79 insertions(+)
 create mode 100644 config.yaml
 create mode 100644 files/almalinux-sb-cert-1.der
 create mode 100644 files/almalinux-sb-cert-2.der
 create mode 100644 files/almalinux-sb-cert-3.der
 create mode 100644 files/sbat.almalinux.csv

diff --git a/config.yaml b/config.yaml
new file mode 100644
index 0000000..df1de32
--- /dev/null
+++ b/config.yaml
@@ -0,0 +1,78 @@
+actions:
+  - replace:
+      - target: ".shim-unsigned-x64.metadata"
+        find: "e6f506462069aa17d2e8610503635c20f3a995c3 SOURCES/redhatsecurebootca5.cer"
+        replace: "cdec924ca437a4509dcb178396996ddf92c11183 SOURCES/shim-15.8.tar.bz2"
+        count: 1
+      - target: "spec"
+        find: "%global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/'))"
+        replace: "%global efidir almalinux"
+        count: 1
+      - target: "spec"
+        find: "BuildRequires:	dos2unix findutils"
+        replace: |
+              BuildRequires:	dos2unix findutils
+              BuildRequires:	efitools
+        count: 1
+      - target: "spec"
+        find: "%build"
+        replace: |
+              %build
+              # Prepare vendor_db.esl file
+              openssl x509 -inform DER -in %{SOURCE101} -out 01.pem
+              openssl x509 -inform DER -in %{SOURCE102} -out 02.pem
+              openssl x509 -inform DER -in %{SOURCE103} -out 03.pem
+              cert-to-efi-sig-list -g 9DD8A2AC-0977-4AEF-99A0-E794FD2A31FE 01.pem 01.esl
+              cert-to-efi-sig-list -g 33D81FE3-5EC0-44F8-AB02-C9DA554F63D8 02.pem 02.esl
+              cert-to-efi-sig-list -g 50413300-1AC7-49DA-B755-BB0D93E634B6 03.pem 03.esl
+              cat 01.esl 02.esl 03.esl > vendor_db.esl
+        count: 1
+      - target: "spec"
+        find: |
+              if [ -s "%{SOURCE1}" ]; then
+              	MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "
+              fi
+              if [ -s "%{SOURCE2}" ]; then
+              	MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2} "
+              fi
+        replace: |
+              if [ -s vendor_db.esl ]; then
+              	MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=../vendor_db.esl"
+              fi
+              if [ -s "%{SOURCE2}" ]; then
+                MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}"
+              fi
+        count: 2
+
+  - modify_release:
+    - suffix: ".alma.1"
+      enabled: true
+
+  - delete_line:
+      - target: "spec"
+        lines:
+          - "Source1:	redhatsecurebootca5.cer"
+          - "Source3:	sbat.redhat.csv"
+
+  - changelog_entry:
+      - name: "Eduard Abdullin"
+        email: "eabdullin@almalinux.org"
+        line:
+          - "Use AlmaLinux OS cert and SBAT entry"
+
+  - add_files:
+      - type: "source"
+        name: "sbat.almalinux.csv"
+        number: 3
+      - type: "source"
+        name: "almalinux-sb-cert-1.der"
+        number: 101
+      - type: "source"
+        name: "almalinux-sb-cert-2.der"
+        number: 102
+      - type: "source"
+        name: "almalinux-sb-cert-3.der"
+        number: 103
+
+  - delete_files:
+      - file_name: "sbat.redhat.csv"
\ No newline at end of file
diff --git a/files/almalinux-sb-cert-1.der b/files/almalinux-sb-cert-1.der
new file mode 100644
index 0000000000000000000000000000000000000000..6a4e99b9ed921c4af3db55a619260f1ab76110dc
GIT binary patch
literal 1787
zcmb7Edpy%?9NzEu+YQ4qp+X~z$h<!#p$oRjtthe5I<;n4v1uk{onoRAK8{FoFx^gc
z)hd-rIu)nr?ozG9NGF_fI7Am`6X*En{BeH&J@5N`pZ9&<&+mDF3_l2DxOH*_hG3YC
zc63{K)Mc`VR1X->NhS)Qi`TME^-dksg&-Xq2Cz{bpoK?*v3Lr+#1l0EMjD_^(GTMD
zB!UPL)n5=TknqD$I+(55K`6BGoxr#aQ34*7AqwMDg9H&mfiQx~@Sw6ns4M2o1LnrM
zj*bAGgM!g7R1KZf5ID|pa&dAA1xdG2GSJgV;wS_sr+Fwqoly#ygx9gdLs&@Wya0v}
z3LG4SP65Uf7hwvK$&cd3bH#kr3{2A~=u->>#eywd37;Auj^GLf30#RlB%EMPEi-l+
zkwox{5{U(2T$BpTN6nIqJ))wy{sLj#R%$>H)k_p74EruH#z6j)0c5b{#3zMt7(@o^
zW7O-~undMU6>I1J?%P(;)EDT<J`&<=PqZm?Eh+Gdc^{X>d~@7#vAD%qZ-ufkhh?j~
zapii8FZ6l4l2j4>$6Kvd%=FCfQ#Hi8bqZPzauDLVg0k(jF6nNqtfiz|Wxur8bX2ad
zdVcV5sacnCY_nO@_S&kodX}Gu=_h9qjw-&C&Q?YW8|~hwL@-lYMZxo*mT|n_rq!Dq
zNO?Kr*Z&ajuCl*+CptA}bH}3+sZUn7lNIOqU@O10Y8v~wWKcZqMh{nDsrrHAqC?Fn
zC5Od?^TaPN9vZwE>ENKiT9WIkzve%`+%Pg-+wtWhW?EoI?ykMo1m;;krtqoqrdY(Z
z>AG~nTPIVAdtr9e$os^OcI}Pat4B7uw#bZr_Ev0CoO20G4yS!W8C%*eNtWAYpL#d*
zedparl{a8zs7XrL79O+)cgO3rRq(Xe?bv+=_YavC&C0sI{5@^Is<rr7Q~oQL=9Ko_
zd&TbxFV50?)oW08?yPU9{?yXi;q$0tf$3uhOWxNtF#$EN9$(nj61mrZXRg<?fO5Aq
z{IFK_+_a`mJHJLPzOu2$``0#6NiXkuM_k_1)xDklhX*R_Aot#YOpZ%PWJx`Hvwv(+
zUSn91q<LmM;ZwJ8FJ8nt5r4k_e%;mzeMQkS+dKS(UD8v&r=*?B&+x(vVcja{*!1E*
zR`nr|@2-+JzzBqaj>w>gKnC3h)7Af**$k{YWr>DKj@ce|HuYY$w-4X7busAnE?sO0
z%rpc&tP$2Q5p}pRNtx`QBY$$Hy}hi^EzC7xG%sfQ5Hy0tA}}ElkTi6P2EzaYC>lh=
zl7Kdzs16YhM?esDptRPfdPAw7JRwLkg(U+Y4UdZT1n$5IPa2Kec@%;nJOpT9#`r7@
z85u`PBr&nB4i2&3%Ye=kMLRG8g8%`Ki%23t2=LQLO~*2UT1>u3z97|AGoqg0iKFNf
zr^ZU-duM1WW2`Y49;^^`UC`BhARRwieNz#L243SBz!P*O|5I1;uO$Gbj#^URPsEFj
znJ5J48Yh#m)_^Ae=Lv|2+!#zIQG$c)nJj+~w#N#V{a95^486KX5gC+(`LS(LuYLx&
zmK=g#7W3C{btC1qgXHu|&hAt1mVpg9@qz7)LQjirTbE=%tB>VaJ{w|W+SRlqtM=qq
z`BZ#(0JZP>i7X28yp;YFwn*+V^|hB(LiOc)PaARBXXK%~jS_tFjUyY$QX;*+r0V45
zkE=pT=tBm1C+#j}43w`s`%TdlzpX-LE<>U=F6|4*<{yn&V-xIkW##-D?u9_i{=os1
zQ~fq=HHqcUdPH1KbNZa$#kq3WF+jPXnVa;%`a)vjg(LknHdCYpovzocJ`VZSGQKX%
z9VuvTNmoc+L-8N(4b3q2QAF;sQhj@I<v<*0Ht?VN<knFg<}yq{?haG<fv+xMZkq1G
zfMeB!j>*nzv-=TicK8=0<z{!5STDIQowYE}{M!p%v*XagiZ@#a*rpBp-pFlw$j1cA
zMbdL^7Fn6pu1Ds+4F;K(`~A_^c|ytX^;TAfXxKtf>_FUZQQx>WuhjaYMX_P|t&zHv
TseG#v;Fg#3=RT@0&At3@_pP4Z

literal 0
HcmV?d00001

diff --git a/files/almalinux-sb-cert-2.der b/files/almalinux-sb-cert-2.der
new file mode 100644
index 0000000000000000000000000000000000000000..fad6c2c357de17fd29136a8d35fe9f379c257fed
GIT binary patch
literal 1792
zcma)6do)yA9Cpr}dBn`1na~4A=_SJ+8q%tmJ9%A?Fp@{f$jH=~na<1@D#a*Lx0Ie&
z(u8#Bsf9`@R#c4Ctu86<RgxZhEkzG<&xCIGkGs}g>zsAg_wDuj&iC8D{cWHo4FEOr
zL_>ff7&eMjgTTG)n1gR`F0qv5l@9<KX^c&}S9(7Uf((dyU>(~4j3E&gBP0gAn9rsI
zst!=7#9(2fK+ZM-bR8yB$zD>WTp^XPje((#(Wg@Qd|#9&#bj(}z|m0zsvS<*t&ql}
z?jiU}j1c9ER!T&Ym8iEwA;jW^F(QFNi1N5-5FdXXfrTl}!2z)G$7Qwy+aVl>9KdF~
zj6jgu`fqn5ZYWf;hggb<VgzgkFdp`&?;*t$s9%y0le1A^F>KM4D~=cViX_TJbP*r*
zkSZlH0)+@~Vnm3@AagiQY`}INtszkVv&I}u)TtU$nE{w6LD$G4Y^6XVT01N`9+;90
zW|1HSQajJXx1LH_C=?4+0!;YL<PS>(-A)5Fl>g%_Afg^Y4Q1)!{8m^ErRp8{F!PY_
zks^_806cbaCBJoW&2z54tZw>V*)cSi6}tIl?+drYFiO<SP6^agA1=%?&DkC+8nRy=
zYrG`IZ-00kIV1OAX6aCoRoT#aH@mB^f*C(8Hk}ABe5Fiw<DR*dX1)o_DQkAc-sf;`
zY~O5A`6Z%9Ky(c|eJ=D1D@{Bn)2bqKh_RibnN-p&*u7Pxq1{5gj4NL3xgK)1@>90o
zpKVv+=_QQd1Z8$4V%F7SouxwOy$eblxU*rXDN4!7o;1xSf3{`IHK&NL-eZ^2$3_PJ
zuF86L*Sy-9SJHIN@R)bR(xT9Tf+Jq^`YGH4ei52fq@y?VLUuKU6sti}_clZaDmoB>
zeHnGnox>98?fE`;2CepIW_yOk>^W`b=mV{;ZQtF!sp>DGRb6wmP0vjuD@TU4ki^|o
zTcdI*a*OhB*Tz+sNAJ85UUfEE|JACq#|6Ck(hGhx|8Z$nDX$xSs?MmdSrmC>w1;%H
z2CdDS-}hVXtRo$T5@`JXxD1#8=|Kf*=pa6k{lF3*z4;Wx449-aovOTt*tRcEuX6kP
zYqiO%$^ozT<sg|v!G}*Ik|79L1Ej!b6azTjHBO<B&9%2*A;c7Ra=BO+5qmr;_=m+;
zM)SBV_YjsYFC%eb;qhS21};vlAV)jA2%z7^pmgSlm~@3)CLdJ;%XR)xBou@IGKsh{
zl?oB?(`8_@DGo~SQ^7=t4Caxj!^g82Km-B|Y=O<FEDV`g=w#)%NtH@9s%no3Wm36F
zA;ppaL-&KJ2o>m$77+*_Ku204-oO*MYj_&&Kb>OY@814@r<fR+>lEpT3Bo+=%;>+A
zH#kSRk#=B^=BT_oAxiu0GBP)Wpdkbyz~q!41B72@1T_rlIbN-ccoMIFp{jLZ(zy>N
zZ<kkq2~9KKBa`BuPjKuSJTXqa`w!z(>m6?<7Pfd8_pIHu@#Lg@?dmM|bpIB9XI9&`
zsz<)G=l<h|+L@=@?hnlM{OY?)Q*YK>!RazsVB~z4gPr7DE%YjCbYebKcRy@Bl@NME
z(OXk^Ub{0e*(_}RAgQq9{mX=Kf9nUX*;|?h-j*Dy>AkpbhizGTEQ=b@S32!oV&Rfo
zZh8^Uw~A)OX|<f6lXkUo?-pOTsd~HpYtS3={f5^r5ycLE1A=aMy0rUfWy?$Pp@7l^
zN_BN?*_eWIz2<ez`m0XVDEYzK1WVJ&Ez3?JvKD4%Zo`+zZ64c9i*t%DypdfS6GKOO
z(4)}n#}_+m+#es$lO&}Z7c9A*apuIQ2TxBNu`LPkeq_z(tc$%oU;Fr^5#wq8W$S#y
z?ttlAE*)#oBsS2S{W5LBo_}s^x%@G|iE<@q{rY?Fs`VdQW=fgcw(usr>+PDi>&iM&
zY5xbGgvpG^E2#xu&l=PAor>*q^0z2AFmUYgFaGp#A2IhBef`#Po`QR-+WOAi+AVGu
zBcu9VD0chcgTFZN^PJB0GgC@w!7g=etyO70If0-17oh#os|r4NqGH#&vWYx08=eu?
rEwa`2rNz466W0@)sn4cnJW7tq>sVCAXk?<;GR}k5S%ptY8!G+=Up%A8

literal 0
HcmV?d00001

diff --git a/files/almalinux-sb-cert-3.der b/files/almalinux-sb-cert-3.der
new file mode 100644
index 0000000000000000000000000000000000000000..d086cd53c500ca15c889ff2b32c5b6167e162cb5
GIT binary patch
literal 970
zcmXqLVm@Zj#I$Y!GZP~dlOV(4Zs(9&d=69Em3g11sAk<Z;AP{~YV&CO&dbQi&B|bq
zW2kDN3>V^L6cZ~>O)f3UEU9!z%*jp6$;>OQ(917MH&if?V`C0w;Sv^i1d98B#1;I5
z72NVm^HLH^GV}8c6%FJ;Dwu^O5GsN}hNUVv<>!|uI6E51iSrtn7#JIx7#Nxw8X8B5
z^BN;_>Fk;&MkVCnU}R-rZerwTFlb`rVrpV!WY}<Ep%UY-y&sLgH-9O+`C4I0`GaM)
z?HjA)w*)Wj`Y6);wDEz%(b+GwJ}Z5j_Uzl)^(72Tc-6Tc2}Z5lX1Tkg?%SW)5|7Q7
zH=cPdsvsm)Ao}T$^*$--h|A1L-$d8*{WsmOy=|}F>_t7Ne;@l2>AiQadDHC2MrTVB
zO(Lpfw^>Si%esGJa$bBkT4%~@SA&z4SLRpsX_nubYp1h<jh&J6<43PqR*%E?n=##M
zns3U!_Q|Qk_YzMfTI^pK`$zHCj!9ReHP&`XY%aNW>TKIzu}<?gEt66|j+y!)DwE=#
zt@{4zq6_<<b4tux(-(ZqIG}S@`KP(bEdF&_@6WvNXOeppt;pZy&&15gz_>WsAQ2p~
zvdSzH24W2&2m4<Bytc~HWO<$0#>H!6-7=Rf*=N89jCompM#ldvEWm`<X21{P3xoKq
z2FyUpKo%sx$0EjpT|a871V#fRgYWA7AA9a?HV`_W+*B=ie2ZaT;MXsTkHj~7U)QX7
zeO{na@bq2o-sL^#TGFP8)Lat%py1tJ%(M6G|BBOB;u8`d8M@V<w9hd*eX*l5>W}#J
zxk}xi#o5);HktIgnC#)1`JOlE+oS{&KE=3)&u#8$74Y|m%cOL+Z;I<V`_=MTo7&&S
zsR{k+W$fmUYPwmu{S3}^=<fC1QKaa1j?=LC`@+QHmd^>VzN<(T-->Cg@tAgaZeR7U
zoO6kLraH9v^FEAbn0rzC{=8|?{>9&=0(}ZDUbr5qpi+Ngkv!MxEhXG;4@Gr@<_V~8
hz1^Yl@Bi1C6W7#=r%k@Xm3H;jpD6o4&JuOO^8kV}d_DjG

literal 0
HcmV?d00001

diff --git a/files/sbat.almalinux.csv b/files/sbat.almalinux.csv
new file mode 100644
index 0000000..f2496f1
--- /dev/null
+++ b/files/sbat.almalinux.csv
@@ -0,0 +1 @@
+shim.almalinux,3,AlmaLinux,shim,15.8,security@almalinux.org