From b22f671d9fc88d435f8f485b143a9cb6fd261652 Mon Sep 17 00:00:00 2001
From: Andrew Lukoshko <alukoshko@almalinux.org>
Date: Sun, 8 Mar 2026 23:21:52 +0000
Subject: [PATCH] Update secure boot certs: ca0 as Source2, boot0 as Source1

---
 config.yaml                      |  28 +++++++++++++++++++++-------
 files/almalinuxsecureboot0.cer   | Bin 0 -> 999 bytes
 files/almalinuxsecurebootca0.cer | Bin 0 -> 970 bytes
 3 files changed, 21 insertions(+), 7 deletions(-)
 create mode 100644 files/almalinuxsecureboot0.cer
 create mode 100644 files/almalinuxsecurebootca0.cer

diff --git a/config.yaml b/config.yaml
index 9f748b2..0aa8035 100644
--- a/config.yaml
+++ b/config.yaml
@@ -20,7 +20,6 @@ actions:
               e2bd0ba50614457483a298097b2252b6f18c0a1b SOURCES/BOOTAA64.CSV
               46bef68f0c2f722f4bb59385a8917c18210d4c4f SOURCES/BOOTIA32.CSV
               cca8dd0b9b2e2d3a5e693087a926cb63150a0b2f SOURCES/BOOTX64.CSV
-              077f737b9a26b59d2517ee390879f02ab464a284 SOURCES/almalinuxsecurebootca0.cer
               4591a3da03f337b27e963b69202f7109496c0ef8 SOURCES/fbaa64.efi
               0bbc4ac41e7ed2fb284f76995dac4be4f86f18a1 SOURCES/fbia32.efi
               403a4e918a00f5e90551085c7ba545969feee26e SOURCES/fbx64.efi
@@ -75,17 +74,32 @@ actions:
         find: |
               Source1:	redhatsecureboot501.cer
               Source2:	redhatsecurebootca5.cer
-        replace: "Source1:	almalinuxsecurebootca0.cer"
-      - target: ".gitignore"
-        find: |
-            SOURCES/redhatsecureboot501.cer
-            SOURCES/redhatsecurebootca5.cer
-        replace: "SOURCES/almalinuxsecurebootca0.cer"
+        replace: |
+              Source1:	almalinuxsecureboot0.cer
+              Source2:	almalinuxsecurebootca0.cer
+      - target: "shim.rpmmacros"
+        find: "-n redhatsecureboot501 -a %{SOURCE2} -c %{SOURCE1}"
+        replace: "-n almalinuxsecureboot0 -a %{SOURCE2} -c %{SOURCE1}"
+        count: 1
 
   - modify_release:
     - suffix: ".alma.2"
       enabled: true
 
+  - delete_line:
+      - target: ".gitignore"
+        lines:
+          - "SOURCES/redhatsecureboot501.cer"
+          - "SOURCES/redhatsecurebootca5.cer"
+
+  - add_files:
+      - type: "source"
+        name: "almalinuxsecurebootca0.cer"
+        number: 2
+      - type: "source"
+        name: "almalinuxsecureboot0.cer"
+        number: 1
+
   - changelog_entry:
       - name: "Eduard Abdullin"
         email: "eabdullin@almalinux.org"
diff --git a/files/almalinuxsecureboot0.cer b/files/almalinuxsecureboot0.cer
new file mode 100644
index 0000000000000000000000000000000000000000..e6bb9db458dcdd38c1d601a5160ce8464ad028e0
GIT binary patch
literal 999
zcmXqLVt#DU#B_QAGZP~dlSq=$x3`I_j%l#2FGy70?o}0&^C`xFmyJ`a&7<u*FC!y2
zD}zCfp{jv0T!@oVOsqIHxwI&=q|zZVCpR%CGq1ElFTW_=P{BZsjX9KsOIX|yDDDFi
zSMU#3aLX^vOGzxr%+E7aG>`|WU>24@s0aobma5>CpI@Tj>}Vh-&TC|9U~Ft?Xklb&
zVh|<HYYgNXSwgu6g@$SdDqur+WU(6(oSB}NnTK!=4^HP0=P!dMMkVAhVPs`sZerwT
z0E%-lH8C<WEZZ7vnwP#}ZBI`6%E}aj=2*X?OWuz}HVaQNm9>5{Q*3?l-?<XejdnUq
zKCHAY&Ji(*UCnNE>gr~{?8kbg0b5t?lBx5kIj7}g65w>>_kj-vx$A0zuP(QmrG2<v
zyYkg>u2<Dx8luytRn|sj?tZ28M{A<_`Nco3O8PJ=EB{FN@kev^zl`gfdUYihiuIj{
z<jR*lo4|4=%{|g8^7WU!lM;Ve`1D@LUJy3t*T=8!ig)Z2=j5$;7xE+5W~Q=d_Jeh&
zZ#D;QWIvGby)*K~%=00)SLqdObmx7Z=#;R#ckgG*<8$`h3lX%@o6_{CzocB^=Kk%)
zHz&_I5k3Dwje(7^RF{JIoySbfj0}v6D-6mEcz_WjE6m9FpM}YQ!GI6M;|K9rn3>oc
z48%ZuRS=)YfQyYon~jl`m7ST{Ko%s<$0Eie@_$b83%6N8)15EgoM>+NBkWY&gl=$>
zkyU1qFc51HIoS8|=e1RqCd=#0HZEQp>z27>$v)(`0j5`A+%Ph@OKKIL-ult%`<1Av
z5-(2v5nVsM&G$=Ot<n*eNsTTs7N?kZ@@;?hSS~mCSVaEWr5A<g*@f^%nL8ZeT$Z$9
z>(U)hQd!P8?3PlTo-)sP<I&6QPXqm~Z<0*Bw;<xx`@Tst=T_`dJQ7tFm$bI1J}dE4
z^`)cduiTGjs9*CUcth!`gj5sJ__C?DisVG6#~pbmz3ZjsWO4Pa)71XE8a{jO`Rn@(
z<ztQ#VmF2NEZ^4qdX+=g@kcSP_B!dm`yy}U*)IAcd_z=pO6xrR4<=kYmcQJW%>C%)
z%GRv~6F;VMvx!~hPrProZ&#m`UU0&*YmVC)`!Achh~HyQ{q4DbyFt~aQ_2ejlC}W=
DeSwFp

literal 0
HcmV?d00001

diff --git a/files/almalinuxsecurebootca0.cer b/files/almalinuxsecurebootca0.cer
new file mode 100644
index 0000000000000000000000000000000000000000..d086cd53c500ca15c889ff2b32c5b6167e162cb5
GIT binary patch
literal 970
zcmXqLVm@Zj#I$Y!GZP~dlOV(4Zs(9&d=69Em3g11sAk<Z;AP{~YV&CO&dbQi&B|bq
zW2kDN3>V^L6cZ~>O)f3UEU9!z%*jp6$;>OQ(917MH&if?V`C0w;Sv^i1d98B#1;I5
z72NVm^HLH^GV}8c6%FJ;Dwu^O5GsN}hNUVv<>!|uI6E51iSrtn7#JIx7#Nxw8X8B5
z^BN;_>Fk;&MkVCnU}R-rZerwTFlb`rVrpV!WY}<Ep%UY-y&sLgH-9O+`C4I0`GaM)
z?HjA)w*)Wj`Y6);wDEz%(b+GwJ}Z5j_Uzl)^(72Tc-6Tc2}Z5lX1Tkg?%SW)5|7Q7
zH=cPdsvsm)Ao}T$^*$--h|A1L-$d8*{WsmOy=|}F>_t7Ne;@l2>AiQadDHC2MrTVB
zO(Lpfw^>Si%esGJa$bBkT4%~@SA&z4SLRpsX_nubYp1h<jh&J6<43PqR*%E?n=##M
zns3U!_Q|Qk_YzMfTI^pK`$zHCj!9ReHP&`XY%aNW>TKIzu}<?gEt66|j+y!)DwE=#
zt@{4zq6_<<b4tux(-(ZqIG}S@`KP(bEdF&_@6WvNXOeppt;pZy&&15gz_>WsAQ2p~
zvdSzH24W2&2m4<Bytc~HWO<$0#>H!6-7=Rf*=N89jCompM#ldvEWm`<X21{P3xoKq
z2FyUpKo%sx$0EjpT|a871V#fRgYWA7AA9a?HV`_W+*B=ie2ZaT;MXsTkHj~7U)QX7
zeO{na@bq2o-sL^#TGFP8)Lat%py1tJ%(M6G|BBOB;u8`d8M@V<w9hd*eX*l5>W}#J
zxk}xi#o5);HktIgnC#)1`JOlE+oS{&KE=3)&u#8$74Y|m%cOL+Z;I<V`_=MTo7&&S
zsR{k+W$fmUYPwmu{S3}^=<fC1QKaa1j?=LC`@+QHmd^>VzN<(T-->Cg@tAgaZeR7U
zoO6kLraH9v^FEAbn0rzC{=8|?{>9&=0(}ZDUbr5qpi+Ngkv!MxEhXG;4@Gr@<_V~8
hz1^Yl@Bi1C6W7#=r%k@Xm3H;jpD6o4&JuOO^8kV}d_DjG

literal 0
HcmV?d00001