From 31942e0e5286a9bd0899334f59d3cc0d089d5dd5 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Thu, 16 Jun 2022 09:18:56 -0400 Subject: [PATCH] import mokutil-0.4.0-8.el9_0.1 --- ...void-taking-pointer-to-packed-struct.patch | 5 +- ...-Fix-a-integer-comparison-sign-issue.patch | 9 +- ...on-to-print-the-UEFI-SBAT-variable-c.patch | 49 +++-- ...il-add-mok-variables-parsing-support.patch | 19 +- SOURCES/0005-mokutil-remove-simple-hash.patch | 9 +- SOURCES/0006-man-remove-simple-hash.patch | 9 +- ...Digest-functions-instead-of-the-depr.patch | 21 +- .../0008-SBAT-revocation-update-support.patch | 181 ++++++++++++++++++ SOURCES/mokutil.patches | 8 + SPECS/mokutil.spec | 15 +- 10 files changed, 246 insertions(+), 79 deletions(-) create mode 100644 SOURCES/0008-SBAT-revocation-update-support.patch create mode 100644 SOURCES/mokutil.patches diff --git a/SOURCES/0001-Avoid-taking-pointer-to-packed-struct.patch b/SOURCES/0001-Avoid-taking-pointer-to-packed-struct.patch index 67d946e..f0268ce 100644 --- a/SOURCES/0001-Avoid-taking-pointer-to-packed-struct.patch +++ b/SOURCES/0001-Avoid-taking-pointer-to-packed-struct.patch @@ -1,4 +1,4 @@ -From 19e8c9071b3d9306ca7b7329b313b31f86c2936d Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Harry Youd Date: Wed, 31 Jul 2019 19:44:53 +0100 Subject: [PATCH] Avoid taking pointer to packed struct @@ -112,6 +112,3 @@ index e2d567d..8892613 100644 continue; /* Dump X509 certificate to files */ --- -2.21.0 - diff --git a/SOURCES/0002-Fix-a-integer-comparison-sign-issue.patch b/SOURCES/0002-Fix-a-integer-comparison-sign-issue.patch index 591a8d2..33662ef 100644 --- a/SOURCES/0002-Fix-a-integer-comparison-sign-issue.patch +++ b/SOURCES/0002-Fix-a-integer-comparison-sign-issue.patch @@ -1,4 +1,4 @@ -From 9292352eb29a4fca41909448799efc524ee3c255 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 25 Jul 2018 10:27:34 -0400 Subject: [PATCH] Fix a integer comparison sign issue. @@ -16,10 +16,10 @@ Signed-off-by: Peter Jones 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/mokutil.c b/src/mokutil.c -index d03127abf54..068df0d109c 100644 +index 8892613..b66c1b8 100644 --- a/src/mokutil.c +++ b/src/mokutil.c -@@ -1938,7 +1938,7 @@ generate_pw_hash (const char *input_pw) +@@ -2011,7 +2011,7 @@ generate_pw_hash (const char *input_pw) char *password = NULL; char *crypt_string; const char *prefix; @@ -28,6 +28,3 @@ index d03127abf54..068df0d109c 100644 unsigned int pw_len, salt_size; if (input_pw) { --- -2.23.0 - diff --git a/SOURCES/0003-mokutil-Add-option-to-print-the-UEFI-SBAT-variable-c.patch b/SOURCES/0003-mokutil-Add-option-to-print-the-UEFI-SBAT-variable-c.patch index 34f7fbc..8ab952c 100644 --- a/SOURCES/0003-mokutil-Add-option-to-print-the-UEFI-SBAT-variable-c.patch +++ b/SOURCES/0003-mokutil-Add-option-to-print-the-UEFI-SBAT-variable-c.patch @@ -1,4 +1,4 @@ -From 698994102afcbbe16e65930a09e0df5248c4d200 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Wed, 17 Mar 2021 14:38:57 +0100 Subject: [PATCH] mokutil: Add option to print the UEFI SBAT variable content @@ -16,32 +16,12 @@ previous processing. Signed-off-by: Javier Martinez Canillas --- - man/mokutil.1 | 5 +++++ src/mokutil.c | 33 +++++++++++++++++++++++++++++++++ + man/mokutil.1 | 5 +++++ 2 files changed, 38 insertions(+) -diff --git a/man/mokutil.1 b/man/mokutil.1 -index 25fe8b433da..446298763ad 100644 ---- a/man/mokutil.1 -+++ b/man/mokutil.1 -@@ -73,6 +73,8 @@ mokutil \- utility to manipulate machine owner keys - .br - \fBmokutil\fR [--dbx] - .br -+\fBmokutil\fR [--sbat] -+.br - - .SH DESCRIPTION - \fBmokutil\fR is a tool to import or delete the machines owner keys -@@ -173,3 +175,6 @@ List the keys in the secure boot signature store (db) - \fB--dbx\fR - List the keys in the secure boot blacklist signature store (dbx) - .TP -+\fB--sbat\fR -+List the entries in the Secure Boot Advanced Targeting store (SBAT) -+.TP diff --git a/src/mokutil.c b/src/mokutil.c -index b66c1b8b5a7..0c25ae5033d 100644 +index b66c1b8..0c25ae5 100644 --- a/src/mokutil.c +++ b/src/mokutil.c @@ -84,6 +84,7 @@ @@ -119,6 +99,23 @@ index b66c1b8b5a7..0c25ae5033d 100644 default: print_help (); break; --- -2.29.2 - +diff --git a/man/mokutil.1 b/man/mokutil.1 +index 25fe8b4..4462987 100644 +--- a/man/mokutil.1 ++++ b/man/mokutil.1 +@@ -73,6 +73,8 @@ mokutil \- utility to manipulate machine owner keys + .br + \fBmokutil\fR [--dbx] + .br ++\fBmokutil\fR [--sbat] ++.br + + .SH DESCRIPTION + \fBmokutil\fR is a tool to import or delete the machines owner keys +@@ -173,3 +175,6 @@ List the keys in the secure boot signature store (db) + \fB--dbx\fR + List the keys in the secure boot blacklist signature store (dbx) + .TP ++\fB--sbat\fR ++List the entries in the Secure Boot Advanced Targeting store (SBAT) ++.TP diff --git a/SOURCES/0004-mokutil-add-mok-variables-parsing-support.patch b/SOURCES/0004-mokutil-add-mok-variables-parsing-support.patch index 88ea983..16c2a39 100644 --- a/SOURCES/0004-mokutil-add-mok-variables-parsing-support.patch +++ b/SOURCES/0004-mokutil-add-mok-variables-parsing-support.patch @@ -1,4 +1,4 @@ -From 256639accc910e60496fffef96128dc1afd0fa3a Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 17 Mar 2021 14:49:21 +0100 Subject: [PATCH] mokutil: add mok-variables parsing support @@ -10,11 +10,11 @@ variables. Signed-off-by: Peter Jones --- - src/mokutil.c | 175 +++++++++++++++++++++++++++++++++++++++++++------- + src/mokutil.c | 175 ++++++++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 151 insertions(+), 24 deletions(-) diff --git a/src/mokutil.c b/src/mokutil.c -index 0c25ae5033d..252dc7a327f 100644 +index 0c25ae5..252dc7a 100644 --- a/src/mokutil.c +++ b/src/mokutil.c @@ -251,6 +251,63 @@ signature_size (const efi_guid_t *hash_type) @@ -112,14 +112,11 @@ index 0c25ae5033d..252dc7a327f 100644 - fprintf (stderr, "Failed to read %s: %m\n", var_name); - return -1; -- } + ret = efi_get_variable (guid, varname, &data, &data_sz, + &attributes); + if (ret < 0) + return 0; - -- ret = list_keys (data, data_size); -- free (data); ++ + ret = list_keys (data, data_sz); + free(data); + /* @@ -131,8 +128,11 @@ index 0c25ae5033d..252dc7a327f 100644 + return 0; + if (ret > 0) + return ret; -+ } + } +- ret = list_keys (data, data_size); +- free (data); +- - return ret; + return 0; } @@ -236,6 +236,3 @@ index 0c25ae5033d..252dc7a327f 100644 static int is_valid_request (const efi_guid_t *type, void *mok, uint32_t mok_size, MokRequest req) --- -2.29.2 - diff --git a/SOURCES/0005-mokutil-remove-simple-hash.patch b/SOURCES/0005-mokutil-remove-simple-hash.patch index f53791a..ef10329 100644 --- a/SOURCES/0005-mokutil-remove-simple-hash.patch +++ b/SOURCES/0005-mokutil-remove-simple-hash.patch @@ -1,4 +1,4 @@ -From b7a6c0a7ee8e66c5daa377d2e6f59461ed34f3bf Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Gary Lin Date: Tue, 25 May 2021 12:46:03 +0200 Subject: [PATCH] mokutil: remove "--simple-hash" @@ -9,11 +9,11 @@ Remove the code to reduce the code size. Signed-off-by: Gary Lin --- - src/mokutil.c | 87 +++++---------------------------------------------- + src/mokutil.c | 87 +++++------------------------------------------------------ 1 file changed, 7 insertions(+), 80 deletions(-) diff --git a/src/mokutil.c b/src/mokutil.c -index 252dc7a327f..563e585979b 100644 +index 252dc7a..563e585 100644 --- a/src/mokutil.c +++ b/src/mokutil.c @@ -76,7 +76,6 @@ @@ -255,6 +255,3 @@ index 252dc7a327f..563e585979b 100644 ret = reset_moks (ENROLL_BLACKLIST, hash_file, use_root_pw); break; case TEST_KEY | MOKX: --- -2.31.1 - diff --git a/SOURCES/0006-man-remove-simple-hash.patch b/SOURCES/0006-man-remove-simple-hash.patch index 4ae64a0..ee8a250 100644 --- a/SOURCES/0006-man-remove-simple-hash.patch +++ b/SOURCES/0006-man-remove-simple-hash.patch @@ -1,7 +1,7 @@ -From d944337820debcaa5e275ec6a3523702ee2d9dd7 Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Gary Lin Date: Thu, 27 Aug 2020 14:48:08 +0800 -Subject: [PATCH 2/2] man: remove "--simple-hash" +Subject: [PATCH] man: remove "--simple-hash" Remove "--simple-hash" from the man page. @@ -11,7 +11,7 @@ Signed-off-by: Gary Lin 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/man/mokutil.1 b/man/mokutil.1 -index 446298763ad..1f82ff1abed 100644 +index 4462987..1f82ff1 100644 --- a/man/mokutil.1 +++ b/man/mokutil.1 @@ -15,11 +15,11 @@ mokutil \- utility to manipulate machine owner keys @@ -76,6 +76,3 @@ index 446298763ad..1f82ff1abed 100644 \fB--ignore-db\fR Tell shim to not use the keys in db to verify EFI images .TP --- -2.31.1 - diff --git a/SOURCES/0007-mokutil-use-EVP_Digest-functions-instead-of-the-depr.patch b/SOURCES/0007-mokutil-use-EVP_Digest-functions-instead-of-the-depr.patch index 67bdff8..a0bea66 100644 --- a/SOURCES/0007-mokutil-use-EVP_Digest-functions-instead-of-the-depr.patch +++ b/SOURCES/0007-mokutil-use-EVP_Digest-functions-instead-of-the-depr.patch @@ -1,4 +1,4 @@ -From f552d2bb570568673d293fcb2263a2ee8c3333de Mon Sep 17 00:00:00 2001 +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 25 May 2021 15:22:29 +0200 Subject: [PATCH] mokutil: use EVP_Digest()* functions instead of the @@ -22,7 +22,7 @@ Signed-off-by: Javier Martinez Canillas 1 file changed, 36 insertions(+), 8 deletions(-) diff --git a/src/mokutil.c b/src/mokutil.c -index 563e585979b..3fdc791af7f 100644 +index 563e585..3fdc791 100644 --- a/src/mokutil.c +++ b/src/mokutil.c @@ -405,8 +405,10 @@ print_x509 (char *cert, int cert_size) @@ -44,8 +44,11 @@ index 563e585979b..3fdc791af7f 100644 fprintf (stderr, "Invalid X509 certificate\n"); - return -1; + goto cleanup_bio; -+ } -+ + } + +- SHA1_Init (&ctx); +- SHA1_Update (&ctx, cert, cert_size); +- SHA1_Final (fingerprint, &ctx); + md = EVP_get_digestbyname ("SHA1"); + if(md == NULL) { + fprintf (stderr, "Failed to get SHA1 digest\n"); @@ -56,11 +59,8 @@ index 563e585979b..3fdc791af7f 100644 + if (ctx == NULL) { + fprintf (stderr, "Failed to create digest context\n"); + goto cleanup_bio; - } - -- SHA1_Init (&ctx); -- SHA1_Update (&ctx, cert, cert_size); -- SHA1_Final (fingerprint, &ctx); ++ } ++ + if (!EVP_DigestInit_ex (ctx, md, NULL)) { + fprintf (stderr, "Failed to initialize digest context\n"); + goto cleanup_ctx; @@ -93,6 +93,3 @@ index 563e585979b..3fdc791af7f 100644 BIO_free (cert_bio); return 0; --- -2.31.1 - diff --git a/SOURCES/0008-SBAT-revocation-update-support.patch b/SOURCES/0008-SBAT-revocation-update-support.patch new file mode 100644 index 0000000..4b1cc7d --- /dev/null +++ b/SOURCES/0008-SBAT-revocation-update-support.patch @@ -0,0 +1,181 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Jan Setje-Eilers +Date: Thu, 21 Apr 2022 17:28:07 -0700 +Subject: [PATCH] SBAT revocation update support + +Control how shim will apply SBAT revocations: + + mokutil --set-sbat-policy latest + + applies the latest SBAT revocations + (default behavior) + + mokutil --set-sbat-policy previous + + applies previous SBAT revocations to + allow falling back to an older release + + In both of the above cases shim will only apply SBAT revocations that +are newer than the ones currently installed. + + mokutil --set-sbat-policy delete + + resets SBAT revocations only if Secure + Boot is disabled. This setting does not + persist. + +Signed-off-by: Jan Setje-Eilers +(cherry picked from commit 68f122d79677cf4a8298cf60ab7dc8a7bf43091c) +[rharwood: renumbering, new options not present, renamed var] +--- + src/mokutil.c | 47 +++++++++++++++++++++++++++++++++++++++++++---- + man/mokutil.1 | 14 ++++++++++++-- + 2 files changed, 55 insertions(+), 6 deletions(-) + +diff --git a/src/mokutil.c b/src/mokutil.c +index 3fdc791..ac158b3 100644 +--- a/src/mokutil.c ++++ b/src/mokutil.c +@@ -84,6 +84,7 @@ + #define VERBOSITY (1 << 23) + #define TIMEOUT (1 << 24) + #define LIST_SBAT (1 << 25) ++#define SET_SBAT (1 << 27) + + #define DEFAULT_CRYPT_METHOD SHA512_BASED + #define DEFAULT_SALT_SIZE SHA512_SALT_MAX +@@ -169,12 +170,13 @@ print_help () + printf (" --import-hash \t\t\tImport a hash into MOK or MOKX\n"); + printf (" --delete-hash \t\t\tDelete a hash in MOK or MOKX\n"); + printf (" --set-verbosity \t\tSet the verbosity bit for shim\n"); +++ printf (" --set-sbat-policy \t\tApply Latest, Previous, or Blank SBAT revocations\n"); +++ printf (" --list-sbat-revocations\t\t\t\tList the entries in SBAT\n"); + printf (" --pk\t\t\t\t\tList the keys in PK\n"); + printf (" --kek\t\t\t\t\tList the keys in KEK\n"); + printf (" --db\t\t\t\t\tList the keys in db\n"); + printf (" --dbx\t\t\t\t\tList the keys in dbx\n"); + printf (" --timeout <-1,0..0x7fff>\t\tSet the timeout for MOK prompt\n"); +- printf (" --sbat\t\t\t\tList the entries in SBAT\n"); + printf ("\n"); + printf ("Supplimentary Options:\n"); + printf (" --hash-file \t\tUse the specific password hash\n"); +@@ -2261,6 +2263,26 @@ list_db (DBName db_name) + return -1; + } + ++static int ++manage_sbat (const uint8_t sbat_policy) ++{ ++ if (sbat_policy) { ++ uint32_t attributes = EFI_VARIABLE_NON_VOLATILE ++ | EFI_VARIABLE_BOOTSERVICE_ACCESS ++ | EFI_VARIABLE_RUNTIME_ACCESS; ++ if (efi_set_variable (efi_guid_shim, "SbatPolicy", ++ (uint8_t *)&sbat_policy, ++ sizeof (sbat_policy), ++ attributes, S_IRUSR | S_IWUSR) < 0) { ++ fprintf (stderr, "Failed to set SbatPolicy\n"); ++ return -1; ++ } ++ } else { ++ return test_and_delete_var ("SbatPolicy"); ++ } ++ return 0; ++} ++ + int + main (int argc, char *argv[]) + { +@@ -2275,6 +2297,7 @@ main (int argc, char *argv[]) + unsigned int command = 0; + int use_root_pw = 0; + uint8_t verbosity = 0; ++ uint8_t sbat_policy = 0; + DBName db_name = MOK_LIST_RT; + int ret = -1; + +@@ -2311,11 +2334,12 @@ main (int argc, char *argv[]) + {"import-hash", required_argument, 0, 0 }, + {"delete-hash", required_argument, 0, 0 }, + {"set-verbosity", required_argument, 0, 0 }, ++ {"set-sbat-policy", required_argument, 0, 0 }, ++ {"list-sbat-revocations", no_argument, 0, 0 }, + {"pk", no_argument, 0, 0 }, + {"kek", no_argument, 0, 0 }, + {"db", no_argument, 0, 0 }, + {"dbx", no_argument, 0, 0 }, +- {"sbat", no_argument, 0, 0 }, + {"timeout", required_argument, 0, 0 }, + {0, 0, 0, 0} + }; +@@ -2376,6 +2400,20 @@ main (int argc, char *argv[]) + verbosity = 0; + else + command |= HELP; ++ } else if (strcmp (option, "set-sbat-policy") == 0) { ++ command |= SET_SBAT; ++ if (strcmp (optarg, "latest") == 0) ++ sbat_policy = 1; ++ else if (strcmp (optarg, "previous") == 0) ++ sbat_policy = 2; ++ else if (strcmp (optarg, "delete") == 0) ++ sbat_policy = 3; ++ else ++ command |= HELP; ++ } else if (strcmp (option, "list-sbat-revocations") == 0) { ++ command |= LIST_SBAT; ++ } else if (strcmp (option, "sbat") == 0) { ++ command |= LIST_SBAT; + } else if (strcmp (option, "pk") == 0) { + if (db_name != MOK_LIST_RT) { + command |= HELP; +@@ -2400,8 +2438,6 @@ main (int argc, char *argv[]) + } else { + db_name = DBX; + } +- } else if (strcmp (option, "sbat") == 0) { +- command |= LIST_SBAT; + } else if (strcmp (option, "timeout") == 0) { + command |= TIMEOUT; + timeout = strdup (optarg); +@@ -2658,6 +2694,9 @@ main (int argc, char *argv[]) + case LIST_SBAT: + ret = print_var_content ("SBAT", efi_guid_shim); + break; ++ case SET_SBAT: ++ ret = manage_sbat(sbat_policy); ++ break; + default: + print_help (); + break; +diff --git a/man/mokutil.1 b/man/mokutil.1 +index 1f82ff1..48fbe25 100644 +--- a/man/mokutil.1 ++++ b/man/mokutil.1 +@@ -71,7 +71,9 @@ mokutil \- utility to manipulate machine owner keys + .br + \fBmokutil\fR [--dbx] + .br +-\fBmokutil\fR [--sbat] ++\fBmokutil\fR [--list-sbat-revocations] ++.br ++\fBmokutil\fR [--set-sbat-policy (\fIlatest\fR | \fIprevious\fR | \fIdelete\fR)] + .br + + .SH DESCRIPTION +@@ -168,6 +170,14 @@ List the keys in the secure boot signature store (db) + \fB--dbx\fR + List the keys in the secure boot blacklist signature store (dbx) + .TP +-\fB--sbat\fR ++\fB--list-sbat-revocations\fR + List the entries in the Secure Boot Advanced Targeting store (SBAT) + .TP ++\fB--set-sbat-policy (\fIlatest\fR | \fIprevious\fR | \fIdelete\fR)\fR ++Set the SbatPolicy UEFI Variable to have shim apply either the latest ++or the previous SBAT revocations. If UEFI Secure Boot is disabled, then ++delete will reset the SBAT revocations to an empty revocation list. ++While latest and previous are persistent configuration, delete will be ++cleared by shim on the next boot whether or not it succeeds. The default ++behavior is for shim to apply the previous revocations. ++.TP diff --git a/SOURCES/mokutil.patches b/SOURCES/mokutil.patches new file mode 100644 index 0000000..9f57238 --- /dev/null +++ b/SOURCES/mokutil.patches @@ -0,0 +1,8 @@ +Patch0001: 0001-Avoid-taking-pointer-to-packed-struct.patch +Patch0002: 0002-Fix-a-integer-comparison-sign-issue.patch +Patch0003: 0003-mokutil-Add-option-to-print-the-UEFI-SBAT-variable-c.patch +Patch0004: 0004-mokutil-add-mok-variables-parsing-support.patch +Patch0005: 0005-mokutil-remove-simple-hash.patch +Patch0006: 0006-man-remove-simple-hash.patch +Patch0007: 0007-mokutil-use-EVP_Digest-functions-instead-of-the-depr.patch +Patch0008: 0008-SBAT-revocation-update-support.patch diff --git a/SPECS/mokutil.spec b/SPECS/mokutil.spec index a7a1378..296740f 100644 --- a/SPECS/mokutil.spec +++ b/SPECS/mokutil.spec @@ -1,6 +1,6 @@ Name: mokutil Version: 0.4.0 -Release: 8%{?dist} +Release: 8%{?dist}.1 Epoch: 2 Summary: Tool to manage UEFI Secure Boot MoK Keys License: GPLv3+ @@ -11,16 +11,11 @@ BuildRequires: gcc BuildRequires: autoconf automake gnu-efi git openssl-devel openssl BuildRequires: efivar-devel >= 31-1 Source0: https://github.com/lcp/mokutil/archive/%{version}.tar.gz +Source1: mokutil.patches Conflicts: shim < 0.8-1%{?dist} Obsoletes: mokutil < 0.2.0 -Patch0001: 0001-Avoid-taking-pointer-to-packed-struct.patch -Patch0002: 0002-Fix-a-integer-comparison-sign-issue.patch -Patch0003: 0003-mokutil-Add-option-to-print-the-UEFI-SBAT-variable-c.patch -Patch0004: 0004-mokutil-add-mok-variables-parsing-support.patch -Patch0005: 0005-mokutil-remove-simple-hash.patch -Patch0006: 0006-man-remove-simple-hash.patch -Patch0007: 0007-mokutil-use-EVP_Digest-functions-instead-of-the-depr.patch +%include %{SOURCE1} %description mokutil provides a tool to manage keys for Secure Boot through the MoK @@ -55,6 +50,10 @@ make PREFIX=%{_prefix} LIBDIR=%{_libdir} DESTDIR=%{buildroot} install %{_datadir}/bash-completion/completions/mokutil %changelog +* Wed Jun 01 2022 Robbie Harwood - 2:0.4.0-8.el9_0.1 +- Support sbat revocation and setting policy +- Related: CVE-2022-28737 + * Mon Aug 09 2021 Mohan Boddu - 2:0.4.0-8 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688