From 9eca8a6d9f4a434bce3786d03e453c1fc6a6476e Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Fri, 17 Mar 2023 17:01:33 +0100 Subject: [PATCH] kernel-4.18.0-479.el8 * Fri Mar 17 2023 Denys Vlasenko [4.18.0-479.el8] - x86/cpu: Add CPU model numbers for Meteor Lake (Prarit Bhargava) [2153936] - redhat: require grub2 >= 2.02-99 (Denys Vlasenko) [2179095] - redhat: delete unused script and file (Denys Vlasenko) [2179095] - redhat: drop certificates that were deprecated after GRUB's BootHole flaw (Denys Vlasenko) [2179095] - redhat: align file names with names of signing keys for ppc and s390 (Denys Vlasenko) [2179095] Resolves: rhbz#2153936, rhbz#2179095 Signed-off-by: Denys Vlasenko --- kernel.spec | 41 ++++++++---------- redhatsecureboot301.cer | Bin 899 -> 0 bytes ...reboot_s390.cer => redhatsecureboot302.cer | Bin secureboot_ppc.cer => redhatsecureboot303.cer | Bin sources | 6 +-- 5 files changed, 22 insertions(+), 25 deletions(-) mode change 100755 => 100644 kernel.spec delete mode 100644 redhatsecureboot301.cer rename secureboot_s390.cer => redhatsecureboot302.cer (100%) rename secureboot_ppc.cer => redhatsecureboot303.cer (100%) diff --git a/kernel.spec b/kernel.spec old mode 100755 new mode 100644 index 7ac958e17..cf13b2d1a --- a/kernel.spec +++ b/kernel.spec @@ -12,7 +12,7 @@ # change below to w4T.xzdio): %define _binary_payload w3T.xzdio -%global distro_build 478 +%global distro_build 479 # Sign the x86_64 kernel for secure boot authentication %ifarch x86_64 aarch64 s390x ppc64le @@ -38,10 +38,10 @@ # define buildid .local %define rpmversion 4.18.0 -%define pkgrelease 478.el8 +%define pkgrelease 479.el8 # allow pkg_release to have configurable %%{?dist} tag -%define specrelease 478%{?dist} +%define specrelease 479%{?dist} %define pkg_release %{specrelease}%{?buildid} @@ -448,10 +448,9 @@ Source9: x509.genkey Source10: redhatsecurebootca3.cer Source11: redhatsecurebootca5.cer -Source12: redhatsecureboot301.cer Source13: redhatsecureboot501.cer -Source14: secureboot_s390.cer -Source15: secureboot_ppc.cer +Source14: redhatsecureboot302.cer +Source15: redhatsecureboot303.cer Source16: redhatsecurebootca7.cer %define secureboot_ca_0 %{SOURCE10} @@ -459,10 +458,8 @@ Source16: redhatsecurebootca7.cer %define secureboot_ca_2 %{SOURCE16} %ifarch x86_64 aarch64 -%define secureboot_key_0 %{SOURCE12} -%define pesign_name_0 redhatsecureboot301 -%define secureboot_key_1 %{SOURCE13} -%define pesign_name_1 redhatsecureboot501 +%define secureboot_key_0 %{SOURCE13} +%define pesign_name_0 redhatsecureboot501 %endif %ifarch s390x @@ -572,6 +569,7 @@ Provides: %{name}-uname-r = %{KVERREL}%{?variant}%{?1:+%{1}}\ Requires(pre): %{kernel_prereq}\ Requires(pre): %{initrd_prereq}\ Requires(pre): linux-firmware >= 20200619-99.git3890db36\ +Requires(pre): grub2 >= 2.02-99\ Requires(preun): systemd >= 200\ Conflicts: xfsprogs < 4.3.0-1\ Conflicts: xorg-x11-drv-vmmouse < 13.0.99\ @@ -1316,9 +1314,7 @@ BuildKernel() { fi %ifarch x86_64 aarch64 - %pesign -s -i $SignImage -o vmlinuz.tmp -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0} - %pesign -s -i vmlinuz.tmp -o vmlinuz.signed -a %{secureboot_ca_1} -c %{secureboot_key_1} -n %{pesign_name_1} - rm vmlinuz.tmp + %pesign -s -i $SignImage -o vmlinuz.signed -a %{secureboot_ca_0} -c %{secureboot_key_0} -n %{pesign_name_0} %endif %ifarch s390x ppc64le if [ -x /usr/bin/rpm-sign ]; then @@ -1744,16 +1740,10 @@ BuildKernel() { # Red Hat UEFI Secure Boot CA cert, which can be used to authenticate the kernel mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer - %ifarch x86_64 aarch64 - install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20200609.cer - install -m 0644 %{secureboot_ca_1} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca-20140212.cer - ln -s kernel-signing-ca-20200609.cer $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer + %ifarch ppc64le + install -m 0644 %{secureboot_ca_2} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer %else - %ifarch ppc64le - install -m 0644 %{secureboot_ca_2} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer - %else - install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer - %endif + install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer %endif %ifarch s390x ppc64le if [ $DoModules -eq 1 ]; then @@ -2698,6 +2688,13 @@ fi # # %changelog +* Fri Mar 17 2023 Denys Vlasenko [4.18.0-479.el8] +- x86/cpu: Add CPU model numbers for Meteor Lake (Prarit Bhargava) [2153936] +- redhat: require grub2 >= 2.02-99 (Denys Vlasenko) [2179095] +- redhat: delete unused script and file (Denys Vlasenko) [2179095] +- redhat: drop certificates that were deprecated after GRUB's BootHole flaw (Denys Vlasenko) [2179095] +- redhat: align file names with names of signing keys for ppc and s390 (Denys Vlasenko) [2179095] + * Thu Mar 16 2023 Denys Vlasenko [4.18.0-478.el8] - net/tunnel: wait until all sk_user_data reader finish before releasing the sock (Hangbin Liu) [2176344] - powerpc/pseries: unregister VPA when hot unplugging a CPU (Mamatha Inamdar) [2143007] diff --git a/redhatsecureboot301.cer b/redhatsecureboot301.cer deleted file mode 100644 index 20e660479db920c9af073ef60dfd52cfcd55ef35..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 899 zcmXqLVy-u6VoG1Y%*4pV#L4h}zvyHQr&ERoylk9WZ60mkc^MhGSs4s`4b=@)*_cCF zn1$tnQd1N>5=#_OQj1C) zic(WD5=-=w^K%X4#CZ)(3=Iv;4Gj!U4NRlNd5z71To3|r4T21H474EDDPy&+I5Ryj zGcTPKJDV7lkbT9-%D~*j$j@NV#K^_e#K_37NxkdnB-fbdAp)7dSWBPZtXrYb5w*C@ z@r&`BZ02)^7x}9-F_f-vdj9zHex2s374i`=>Kunka%XeJpYTcWnYOXcua#Nzv{P2r z{{KfRpNsxBUvPxw_cT2h+pJ?Ab^$YP&OhK@vBdbb{HgCD zgVUK-5>__PZZU-1nmGUR*MJSDB-cbvx6RHHnXKVwU9@H2#x6FkEt|?~dgtD8aoSb6 z`P$`cNzxNN-!l}2zMhj&w=>05mb+)gq|2XQRV^~E`;)lfwmuUxBLm~&Sc7N-9$?7J z3NtePXJIm6FyIF9_*qz(nb;c)WI-H07BLo)aL4})TlQq;>8I$gIMsYUAgZGz$Uq(> zt;`}}Al4w_Al4%0a?Yxeg@ctn?ZuBpb5eiAAV&Z&Spg$}kwNnVx9_f&sUPlII<6Po zwsYpDLfs|_*M8fGuUk4-m%YAz`?d3h%8P~vysm29RsQ!WK%@63*E zY;yV?ieH$Xp0GJ~>}cV)`v*$4n0`ogx_k24UDm?Lu%T{WiSI>r}MgeY{-MAm@j(GO|_ezzhSNC%m_dopoSNWyMX47EzS*y|} z3cr~?y=&H&a;tfp6