Add qosb to generate pre-enrolled Secure Boot VARS files

Signed-off-by: Patrick Uiterwijk <puiterwijk@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>

edk2.spec

@@ -1,7 +1,13 @@
 %global edk2_date        20171011
 %global edk2_githash     92d07e4
 %global openssl_version  1.1.0e
+%global qosb_version     1.1.2
 
+%define qosb_testing 0
+
+%ifarch x86_64
+%define qosb_testing 1
+%endif
 %if 0%{?fedora:1}
 %define cross 1
 %endif
@@ -29,7 +35,7 @@
 
 Name:           edk2
 Version:        %{edk2_date}git%{edk2_githash}
-Release:        5%{dist}
+Release:        6%{dist}
 Summary:        EFI Development Kit II
 
 Group:          Applications/Emulators
@@ -38,6 +44,7 @@ URL:            http://www.tianocore.org/edk2/
 Source0:        edk2-%{edk2_date}-%{edk2_githash}.tar.xz
 Source1:        openssl-%{openssl_version}-hobbled.tar.xz
 Source2:        ovmf-whitepaper-c770f8c.txt
+Source3:        https://github.com/puiterwijk/qemu-ovmf-secureboot/archive/v%{qosb_version}/qemu-ovmf-secureboot-%{qosb_version}.tar.gz
 Source10:       hobble-openssl
 Source11:       build-iso.sh
 Source12:       update-tarball.sh
@@ -110,6 +117,19 @@ BuildRequires:  nasm
 BuildRequires:  qemu-img
 BuildRequires:  genisoimage
 
+# These are for QOSB
+BuildRequires:  python3-requests
+BuildRequires:  qemu
+%if %{?qosb_testing}
+# This is used for testing the enrollment: builds are run in a chroot, lacking
+# a kernel. The testing is only performed on x86_64 for now, but we can't make
+# the BuildRequires only on a specific arch, as that'd come through in the SRPM
+# NOTE: The actual enrollment needs to happen in all builds for all architectures,
+# because OVMF is built as noarch, which means that koji enforces that the build
+# results don't actually differ per arch, and then it picks a random arches' build
+# for the actual RPM.
+BuildRequires:  kernel-core
+%endif
 
 %description
 EDK II is a development code base for creating UEFI drivers, applications
@@ -141,6 +161,15 @@ BuildArch:      noarch
 This package documents the tools that are needed to
 build EFI executables and ROMs using the GNU tools.
 
+%package qosb
+Summary:        Tool to enroll secureboot
+Group:          Development/Tools
+Buildarch:      noarch
+%description qosb
+This package contains QOSB (QEMU OVMF Secure Boot), which can enroll OVMF
+variable files to enforce Secure Boot.
+
+
 %if 0%{?build_ovmf_x64:1}
 %package ovmf
 Summary:        Open Virtual Machine Firmware
@@ -200,6 +229,11 @@ cp -a -- %{SOURCE2} .
 (cd .. && tar -xvf %{SOURCE1})
 cp CryptoPkg/Library/OpensslLib/openssl/LICENSE LICENSE.openssl
 
+# Extract QOSB
+tar -xvf %{SOURCE3}
+mv qemu-ovmf-secureboot-%{qosb_version}/README.md README.qosb
+mv qemu-ovmf-secureboot-%{qosb_version}/LICENSE LICENSE.qosb
+
 %autopatch -p1
 base64 --decode < MdeModulePkg/Logo/Logo-OpenSSL.bmp.b64 > MdeModulePkg/Logo/Logo-OpenSSL.bmp
 
@@ -264,6 +298,15 @@ cp Build/Ovmf3264/*/FV/OVMF_CODE.fd ovmf/OVMF_CODE.secboot.fd
 cp Build/Ovmf3264/*/X64/Shell.efi ovmf/
 cp Build/Ovmf3264/*/X64/EnrollDefaultKeys.efi ovmf
 sh %{_sourcedir}/build-iso.sh ovmf/
+
+# Build enrolled VARS file
+python3 qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator \
+	--qemu-binary /usr/bin/qemu-system-x86_64 \
+	--skip-testing \
+	--ovmf-binary ovmf/OVMF_CODE.secboot.fd \
+	--ovmf-template-vars ovmf/OVMF_VARS.fd \
+	--uefi-shell-iso ovmf/UefiShell.iso \
+	ovmf/OVMF_VARS.secboot.fd
 %endif
 
 
@@ -306,6 +349,23 @@ dd of="arm/QEMU_EFI-pflash.raw" if="arm/QEMU_EFI.fd" conv=notrunc
 dd of="arm/vars-template-pflash.raw" if="/dev/zero" bs=1M count=64
 %endif
 
+%check
+%if 0%{?build_ovmf_x64:1}
+%if 0%{?qosb_testing}
+# Verify enrolled VARS file
+python3 qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator \
+	--qemu-binary /usr/bin/qemu-system-x86_64 \
+	--skip-enrollment \
+	--print-output \
+	--ovmf-binary ovmf/OVMF_CODE.secboot.fd \
+	--ovmf-template-vars ovmf/OVMF_VARS.fd \
+	--uefi-shell-iso ovmf/UefiShell.iso \
+	--no-download \
+	--kernel-path `rpm -ql kernel-core | grep "\/vmlinuz$" -m 1` \
+	ovmf/OVMF_VARS.secboot.fd
+%endif
+%endif
+
 %install
 mkdir -p %{buildroot}%{_bindir} \
          %{buildroot}%{_datadir}/%{name}/Conf \
@@ -337,6 +397,7 @@ mkdir %{buildroot}/usr/share/OVMF
 ln -sf ../%{name}/ovmf/OVMF_CODE.fd                %{buildroot}/usr/share/OVMF
 ln -sf ../%{name}/ovmf/OVMF_CODE.secboot.fd        %{buildroot}/usr/share/OVMF
 ln -sf ../%{name}/ovmf/OVMF_VARS.fd                %{buildroot}/usr/share/OVMF
+ln -sf ../%{name}/ovmf/OVMF_VARS.secboot.fd        %{buildroot}/usr/share/OVMF
 ln -sf ../%{name}/ovmf/UefiShell.iso               %{buildroot}/usr/share/OVMF
 %endif
 %if 0%{?build_ovmf_ia32:1}
@@ -354,6 +415,8 @@ cp -a arm %{buildroot}/usr/share/%{name}
 ln -sf ../%{name}/arm/QEMU_EFI-pflash.raw          %{buildroot}/usr/share/AAVMF/AAVMF32_CODE.fd
 %endif
 
+install qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator %{buildroot}%{_bindir}
+
 
 %files tools
 %license License.txt
@@ -397,6 +460,11 @@ ln -sf ../%{name}/arm/QEMU_EFI-pflash.raw          %{buildroot}/usr/share/AAVMF/
 %files tools-doc
 %doc BaseTools/UserManuals/*.rtf
 
+%files qosb
+%license LICENSE.qosb
+%doc README.qosb
+%{_bindir}/ovmf-vars-generator
+
 %if 0%{?build_ovmf_x64:1}
 %files ovmf
 %license OvmfPkg/License.txt
@@ -448,6 +516,10 @@ ln -sf ../%{name}/arm/QEMU_EFI-pflash.raw          %{buildroot}/usr/share/AAVMF/
 
 
 %changelog
+* Fri Mar 30 2018 Patrick Uiterwijk <puiterwijk@redhat.com> - 20171011git92d07e4-6
+- Add qemu-ovmf-secureboot (qosb)
+- Generate pre-enrolled Secure Boot OVMF VARS files
+
 * Wed Mar 07 2018 Paolo Bonzini <pbonzini@redhat.com> - 20171011git92d07e4-5
 - Fix GCC 8 compilation
 - Replace dosfstools and mtools with qemu-img vvfat