From 09521bd01adf177759dd44ea0c9bd53a540946c9 Mon Sep 17 00:00:00 2001
From: Richard Hughes <richard@hughsie.com>
Date: Thu, 25 Jun 2026 14:13:38 +0100
Subject: [PATCH] Sign using the new 803 fwupd-specific certs

Rebase to 1.8 to also pick up the d2a16eb34e542d1ce79c0807e4bbb8d7b4bf840f
commit that allow building with binwalk >= 2.45 too.

Resolves: RHEL-188365
---
 .gitignore     |  1 +
 fwupd-efi.spec | 17 +++++++++++------
 sources        |  2 +-
 3 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index 45e2acb..ffadda3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,4 @@
 /fwupd-efi-1.4.tar.xz
 /fwupd-efi-1.5.tar.xz
 /fwupd-efi-1.6.tar.xz
+/fwupd-efi-1.8.tar.gz
diff --git a/fwupd-efi.spec b/fwupd-efi.spec
index 57a83e4..9ad0b26 100644
--- a/fwupd-efi.spec
+++ b/fwupd-efi.spec
@@ -3,19 +3,18 @@
 %define sb_ca		%{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer
 %define sb_cer		%{_datadir}/pki/sb-certs/secureboot-fwupd-%{_arch}.cer
 %if 0%{?centos}
-%define sb_key		centossecureboot202
+%define sb_key		centossecureboot803
 %else
-%define sb_key		redhatsecureboot802
+%define sb_key		redhatsecureboot803
 %endif
 
 Summary:   Firmware update EFI binaries
 Name:      fwupd-efi
-Version:   1.6
+Version:   1.8
 Release:   %autorelease
 License:   LGPL-2.1-or-later
 URL:       https://github.com/fwupd/fwupd-efi
-Source0:   https://github.com/fwupd/fwupd-efi/releases/download/%{version}/%{name}-%{version}.tar.xz
-
+Source0:   https://github.com/fwupd/%{name}/archive/refs/tags/%{name}-%{version}.tar.gz
 
 # these are the only architectures supporting UEFI UpdateCapsule
 ExclusiveArch: x86_64 aarch64
@@ -37,15 +36,17 @@ the EFI binary that is used for updating using UpdateCapsule.
 %build
 
 %meson \
+    -Dgenpeimg=disabled \
 %if 0%{?centos}
     -Defi_sbat_distro_id="centos" \
-    -Defi_sbat_distro_summary="The Fedora Project" \
+    -Defi_sbat_distro_summary="The CentOS Project" \
     -Defi_sbat_distro_url="https://www.centos.org/" \
 %else
     -Defi_sbat_distro_id="rhel" \
     -Defi_sbat_distro_summary="Red Hat Enterprise Linux" \
     -Defi_sbat_distro_url="mailto:secalert@redhat.com" \
 %endif
+    -Dgenpeimg=disabled \
     -Defi_sbat_distro_pkgname="%{name}" \
     -Defi_sbat_distro_version="%{version}-%{release}"
 
@@ -66,9 +67,13 @@ the EFI binary that is used for updating using UpdateCapsule.
 %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.signed -a %{sb_ca} -c %{sb_cer} -n %{sb_key}
 rm -vf %{fwup_efi_fn}.tmp
 
+%check
+pesigcheck -i %{fwup_efi_fn}.signed -n0 -c %{sb_cer}
+
 %files
 %doc README.md AUTHORS
 %license COPYING
+%dir %{_libexecdir}/fwupd/efi
 %{_libexecdir}/fwupd/efi/*.efi
 %{_libexecdir}/fwupd/efi/*.efi.signed
 %{_libdir}/pkgconfig/fwupd-efi.pc
diff --git a/sources b/sources
index 18730b1..f1bf075 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (fwupd-efi-1.6.tar.xz) = 37d3c1348bdead620e626a3e602dc6cd774c47d24ca18a3bf6aee071300d658bc4d37e6ec74fcd20f9b345141d69ea3343d44b9408af4759ad65ef10b72ead69
+SHA512 (fwupd-efi-1.8.tar.gz) = bd361eb60397850af025228ea9f4efbf289f8e1c2612f240ae4c5ffee8caea15c31aa0748c06e57b28a7f38b8c2708147a228d8a99077798f4435436f12e092e