From f916227b5ecc48322ff052c501701cf2cd3eabbe Mon Sep 17 00:00:00 2001
From: Robbie Harwood <rharwood@redhat.com>
Date: Wed, 9 Feb 2022 20:46:29 +0000
Subject: [PATCH] Fix build on aarch64

Resolves: #2049320
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
---
 0005-fcf-protection-is-arch-specific.patch | 44 ++++++++++++++++++++++
 pesign.spec                                |  7 +++-
 2 files changed, 50 insertions(+), 1 deletion(-)
 create mode 100644 0005-fcf-protection-is-arch-specific.patch

diff --git a/0005-fcf-protection-is-arch-specific.patch b/0005-fcf-protection-is-arch-specific.patch
new file mode 100644
index 0000000..b027c77
--- /dev/null
+++ b/0005-fcf-protection-is-arch-specific.patch
@@ -0,0 +1,44 @@
+From d4fb4e0bfe43a3a3ca454ef6297f75962582b464 Mon Sep 17 00:00:00 2001
+From: Robbie Harwood <rharwood@redhat.com>
+Date: Wed, 9 Feb 2022 15:23:27 -0500
+Subject: [PATCH] -fcf-protection is arch-specific
+
+Signed-off-by: Robbie Harwood <rharwood@redhat.com>
+---
+ Make.defaults | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/Make.defaults b/Make.defaults
+index fdb961a..7c320b5 100644
+--- a/Make.defaults
++++ b/Make.defaults
+@@ -22,11 +22,15 @@ EFI_ARCHES ?= aa64 ia32 x64
+ 
+ enabled = $(if $(filter undefined,$(origin $(1))),$(3),$(2))
+ 
++HOSTARCH   = $(shell uname -m | sed s,i[3456789]86,ia32,)
++ARCH	   := $(shell uname -m | sed s,i[3456789]86,ia32,)
++
++
+ PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config
+ CC	:= $(if $(filter default,$(origin CC)),$(CROSS_COMPILE)gcc,$(CC))
+ CCLD	:= $(if $(filter undefined,$(origin CCLD)),$(CC),$(CCLD))
+ CFLAGS	?= -O2 -g3 -pipe -fPIE -fstack-protector-all \
+-	-fstack-clash-protection -fcf-protection=full
++	-fstack-clash-protection $(ifneq(($ARCH), aa64),-fcf-protection=full,)
+ DIAGFLAGS ?= -fmessage-length=0 \
+ 	     -fdiagnostics-color=always \
+ 	     -fdiagnostics-format=text \
+@@ -42,9 +46,6 @@ INSTALL	?= $(CROSS_COMPILE)install
+ 
+ PKGS	= efivar nspr nss nss-util uuid
+ 
+-HOSTARCH   = $(shell uname -m | sed s,i[3456789]86,ia32,)
+-ARCH	   := $(shell uname -m | sed s,i[3456789]86,ia32,)
+-
+ SOFLAGS	?= -shared
+ clang_cflags =
+ gcc_cflags = -Wmaybe-uninitialized -grecord-gcc-switches \
+-- 
+2.34.1
+
diff --git a/pesign.spec b/pesign.spec
index 64cf1d4..bbbc565 100644
--- a/pesign.spec
+++ b/pesign.spec
@@ -3,7 +3,7 @@
 Name:    pesign
 Summary: Signing utility for UEFI binaries
 Version: 114
-Release: 1%{?dist}
+Release: 2%{?dist}
 License: GPL-2.0-only
 URL:     https://github.com/rhboot/pesign
 
@@ -48,6 +48,7 @@ Patch0001: 0001-Revert-Move-license-to-GPLv3.patch
 Patch0002: 0002-Fix-format-strings-for-32-bit-arches.patch
 Patch0003: 0003-macros-drop-_pesign_args.patch
 Patch0004: 0004-Disable-pragmas-for-warnings-that-are-too-old.patch
+Patch0005: 0005-fcf-protection-is-arch-specific.patch
 
 %description
 This package contains the pesign utility for signing UEFI binaries as
@@ -164,6 +165,10 @@ certutil -d %{_sysconfdir}/pki/pesign/ -X -L > /dev/null
 %{python3_sitelib}/mockbuild/plugins/pesign.*
 
 %changelog
+* Wed Feb 09 2022 Robbie Harwood <rharwood@redhat.com> - 114-2
+- Fix build on aarch64
+- Resolves: #2049320
+
 * Tue Feb 08 2022 Robbie Harwood <rharwood@redhat.com> - 114-1
 - New upstream version (114)
 - Resolves: #2049320