From 8345a2fd703c06652a683e0c0f58c26516e93809 Mon Sep 17 00:00:00 2001
From: Pavel Valena <pvalena@redhat.com>
Date: Fri, 21 Aug 2026 15:17:06 +0200
Subject: [PATCH] fix(dracut): remove trailing null characters from SBATs when
 building UKIs

Resolves: RHEL-214163

From-source-git-commit: 99a74563b15d1d6a7b1458c0b3c4449d3946346c
---
 ...e-trailing-null-characters-from-SBAT.patch | 32 +++++++++++++++++++
 dracut.spec                                   |  8 ++++-
 2 files changed, 39 insertions(+), 1 deletion(-)
 create mode 100644 0042-fix-dracut-remove-trailing-null-characters-from-SBAT.patch

diff --git a/0042-fix-dracut-remove-trailing-null-characters-from-SBAT.patch b/0042-fix-dracut-remove-trailing-null-characters-from-SBAT.patch
new file mode 100644
index 0000000..8f5a23d
--- /dev/null
+++ b/0042-fix-dracut-remove-trailing-null-characters-from-SBAT.patch
@@ -0,0 +1,32 @@
+From 72dff73808cb7cb3fe9c3927c138e0070fccfc98 Mon Sep 17 00:00:00 2001
+From: Li Tian <litian@redhat.com>
+Date: Wed, 14 Jan 2026 13:24:36 +0800
+Subject: [PATCH 42/42] fix(dracut): remove trailing null characters from SBATs
+ when building UKIs
+
+SBAT of kernel has null character paddings at the end. Using tools
+like ukify will display massive amount of '\0' in SBAT. Ukify is
+doing ".rstrip('b\x00')" when merging SBATs.
+
+(cherry picked from commit cbe71b639522c3f328d2a1757a3c54214df66b31)
+
+Resolves: RHEL-214163
+---
+ dracut.sh | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/dracut.sh b/dracut.sh
+index 3b8b0435..a98e53b7 100755
+--- a/dracut.sh
++++ b/dracut.sh
+@@ -2556,6 +2556,7 @@ get_sbat_string() {
+     local inp=$1
+     local out=$uefi_outdir/$2
+     objcopy -O binary --only-section=.sbat "$inp" "$out"
++    sed -i 's/\x00*$//' "$out"
+     clean_sbat_string "$out"
+ }
+ 
+-- 
+2.55.0
+
diff --git a/dracut.spec b/dracut.spec
index 3e1f1f2..50dc98f 100644
--- a/dracut.spec
+++ b/dracut.spec
@@ -8,7 +8,7 @@
 
 Name: dracut
 Version: 107
-Release: 10%{?dist}
+Release: 11%{?dist}
 
 Summary: Initramfs generator using udev
 
@@ -145,6 +145,9 @@ Patch40: 0040-fix-base-escape-die-message-in-emergency-hook-script.patch
 # fix(base): replace eval with safe variable indirection in splitsep and export_n
 # Author: Pavel Valena <pvalena@redhat.com>
 Patch41: 0041-fix-base-replace-eval-with-safe-variable-indirection.patch
+# fix(dracut): remove trailing null characters from SBATs when building UKIs
+# Author: Li Tian <litian@redhat.com>
+Patch42: 0042-fix-dracut-remove-trailing-null-characters-from-SBAT.patch
 
 # Please use source-git to work with this spec file:
 # HowTo: https://packit.dev/source-git/work-with-source-git
@@ -566,6 +569,9 @@ echo 'dracut_rescue_image="yes"' > $RPM_BUILD_ROOT%{dracutlibdir}/dracut.conf.d/
 %{_prefix}/lib/kernel/install.d/51-dracut-rescue.install
 
 %changelog
+* Fri Aug 21 2026 Pavel Valena <pvalena@redhat.com> - 107-11
+- fix(dracut): remove trailing null characters from SBATs when building UKIs
+
 * Tue Jul 28 2026 Pavel Valena <pvalena@redhat.com> - 107-10
 - fix(base): escape die() message in emergency hook script
 - fix(base): replace eval with safe variable indirection in splitsep and export_n