|
|
|
@ -8,7 +8,7 @@
|
|
|
|
|
%global __debug_install_post %{SOURCE100} aa64
|
|
|
|
|
%undefine _debuginfo_subpackages
|
|
|
|
|
|
|
|
|
|
%global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/'))
|
|
|
|
|
%global efidir almalinux
|
|
|
|
|
%global shimrootdir %{_datadir}/shim/
|
|
|
|
|
%global shimversiondir %{shimrootdir}/%{version}-%{release}
|
|
|
|
|
%global efiarch aa64
|
|
|
|
@ -16,21 +16,24 @@
|
|
|
|
|
|
|
|
|
|
Name: shim-unsigned-aarch64
|
|
|
|
|
Version: 15.8
|
|
|
|
|
Release: 2.el8
|
|
|
|
|
Release: 2.el8.alma.1
|
|
|
|
|
Summary: First-stage UEFI bootloader
|
|
|
|
|
ExclusiveArch: aarch64
|
|
|
|
|
License: BSD
|
|
|
|
|
URL: https://github.com/rhboot/shim
|
|
|
|
|
Source0: https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2
|
|
|
|
|
Source1: securebootca.cer
|
|
|
|
|
# currently here's what's in our dbx:
|
|
|
|
|
# nothing.
|
|
|
|
|
Source2: dbx.esl
|
|
|
|
|
Source3: sbat.redhat.csv
|
|
|
|
|
Source3: sbat.almalinux.csv
|
|
|
|
|
Source4: shim.patches
|
|
|
|
|
|
|
|
|
|
Source100: shim-find-debuginfo.sh
|
|
|
|
|
|
|
|
|
|
Source101: almalinux-sb-cert-1.der
|
|
|
|
|
Source102: almalinux-sb-cert-2.der
|
|
|
|
|
Source103: almalinux-sb-cert-3.der
|
|
|
|
|
|
|
|
|
|
%include %{SOURCE4}
|
|
|
|
|
|
|
|
|
|
BuildRequires: gcc make
|
|
|
|
@ -38,6 +41,9 @@ BuildRequires: elfutils-libelf-devel
|
|
|
|
|
BuildRequires: git openssl-devel openssl
|
|
|
|
|
BuildRequires: pesign >= %{pesign_vre}
|
|
|
|
|
BuildRequires: dos2unix findutils
|
|
|
|
|
BuildRequires: efitools
|
|
|
|
|
BuildRequires: gcc-toolset-12-binutils
|
|
|
|
|
BuildRequires: gcc-toolset-12-gcc
|
|
|
|
|
|
|
|
|
|
# Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not
|
|
|
|
|
# compatible with SysV (there's no red zone under UEFI) and there isn't a
|
|
|
|
@ -76,40 +82,62 @@ BuildArch: noarch
|
|
|
|
|
%debug_desc
|
|
|
|
|
|
|
|
|
|
%prep
|
|
|
|
|
%autosetup -S git -n shim-%{version}
|
|
|
|
|
%autosetup -S git_am -n shim-%{version}
|
|
|
|
|
%if 0%{?rhel} == 8 || 0%{?rhel} == 9
|
|
|
|
|
source scl_source enable gcc-toolset-12 || :
|
|
|
|
|
%endif
|
|
|
|
|
git config --unset user.email
|
|
|
|
|
git config --unset user.name
|
|
|
|
|
mkdir build-%{efiarch}
|
|
|
|
|
cp %{SOURCE3} data/
|
|
|
|
|
|
|
|
|
|
%build
|
|
|
|
|
# Prepare vendor_db.esl file
|
|
|
|
|
openssl x509 -inform DER -in %{SOURCE101} -out 01.pem
|
|
|
|
|
openssl x509 -inform DER -in %{SOURCE102} -out 02.pem
|
|
|
|
|
openssl x509 -inform DER -in %{SOURCE103} -out 03.pem
|
|
|
|
|
cert-to-efi-sig-list -g 9DD8A2AC-0977-4AEF-99A0-E794FD2A31FE 01.pem 01.esl
|
|
|
|
|
cert-to-efi-sig-list -g 33D81FE3-5EC0-44F8-AB02-C9DA554F63D8 02.pem 02.esl
|
|
|
|
|
cert-to-efi-sig-list -g 50413300-1AC7-49DA-B755-BB0D93E634B6 03.pem 03.esl
|
|
|
|
|
cat 01.esl 02.esl 03.esl > vendor_db.esl
|
|
|
|
|
|
|
|
|
|
%if 0%{?rhel} == 8 || 0%{?rhel} == 9
|
|
|
|
|
source scl_source enable gcc-toolset-12 || :
|
|
|
|
|
%endif
|
|
|
|
|
|
|
|
|
|
COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
|
|
|
|
|
MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMIT_ID} "
|
|
|
|
|
MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
|
|
|
|
|
MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
|
|
|
|
|
MAKEFLAGS+="ENABLE_SHIM_HASH=true "
|
|
|
|
|
MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 "
|
|
|
|
|
MAKEFLAGS+="%{_smp_mflags}"
|
|
|
|
|
if [ -f "%{SOURCE1}" ]; then
|
|
|
|
|
MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "
|
|
|
|
|
if [ -s vendor_db.esl ]; then
|
|
|
|
|
MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=../vendor_db.esl"
|
|
|
|
|
fi
|
|
|
|
|
if [ -f "%{SOURCE2}" ]; then
|
|
|
|
|
MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2} "
|
|
|
|
|
if [ -s "%{SOURCE2}" ]; then
|
|
|
|
|
MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}"
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
cd build-%{efiarch}
|
|
|
|
|
make ${MAKEFLAGS} DEFAULT_LOADER='\\\\grub%{efiarch}.efi' all
|
|
|
|
|
make ${MAKEFLAGS} \
|
|
|
|
|
DEFAULT_LOADER='\\\\grub%{efiarch}.efi' \
|
|
|
|
|
all
|
|
|
|
|
cd ..
|
|
|
|
|
|
|
|
|
|
%install
|
|
|
|
|
%if 0%{?rhel} == 8 || 0%{?rhel} == 9
|
|
|
|
|
source scl_source enable gcc-toolset-12 || :
|
|
|
|
|
%endif
|
|
|
|
|
COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
|
|
|
|
|
MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMIT_ID} "
|
|
|
|
|
MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
|
|
|
|
|
MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
|
|
|
|
|
MAKEFLAGS+="ENABLE_SHIM_HASH=true "
|
|
|
|
|
MAKEFLAGS+="ENABLE_HTTPBOOT=true ENABLE_SHIM_HASH=true "
|
|
|
|
|
MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 "
|
|
|
|
|
if [ -f "%{SOURCE1}" ]; then
|
|
|
|
|
MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "
|
|
|
|
|
if [ -s vendor_db.esl ]; then
|
|
|
|
|
MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=../vendor_db.esl"
|
|
|
|
|
fi
|
|
|
|
|
if [ -f "%{SOURCE2}" ]; then
|
|
|
|
|
MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2} "
|
|
|
|
|
if [ -s "%{SOURCE2}" ]; then
|
|
|
|
|
MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}"
|
|
|
|
|
fi
|
|
|
|
|
|
|
|
|
|
cd build-%{efiarch}
|
|
|
|
@ -124,15 +152,20 @@ cd ..
|
|
|
|
|
%dir %{shimrootdir}
|
|
|
|
|
%dir %{shimversiondir}
|
|
|
|
|
%dir %{shimdir}
|
|
|
|
|
%{shimdir}/*.CSV
|
|
|
|
|
%{shimdir}/*.efi
|
|
|
|
|
%{shimdir}/*.hash
|
|
|
|
|
%{shimdir}/*.CSV
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
%files debuginfo -f build-%{efiarch}/debugfiles.list
|
|
|
|
|
|
|
|
|
|
%files debugsource -f build-%{efiarch}/debugsource.list
|
|
|
|
|
|
|
|
|
|
%changelog
|
|
|
|
|
* Fri May 10 2024 Eduard Abdullin <eabdullin@almalinux.org> - 15.8-2.el8.alma.1
|
|
|
|
|
- Use AlmaLinux cert
|
|
|
|
|
- Use gcc-toolset-12g
|
|
|
|
|
|
|
|
|
|
* Wed Feb 07 2024 Peter Jones <pjones@redhat.com> - 15.8-2.el8
|
|
|
|
|
- Rebuild to fix the commit ident and MAKEFLAGS
|
|
|
|
|
Resolves: RHEL-11259
|
|
|
|
@ -141,41 +174,62 @@ cd ..
|
|
|
|
|
- Update to shim-15.8 for CVE-2023-40547
|
|
|
|
|
Resolves: RHEL-11259
|
|
|
|
|
|
|
|
|
|
* Tue May 26 2020 Javier Martinez Canillas <javierm@redhat.com> - 15-6
|
|
|
|
|
- Fix a shim crash when attempting to netboot
|
|
|
|
|
Resolves: rhbz#1840036
|
|
|
|
|
* Wed Jun 01 2022 Peter Jones <pjones@redhat.com> - 15.6-1.el8
|
|
|
|
|
- Update to shim-15.6
|
|
|
|
|
Resolves: CVE-2022-28737
|
|
|
|
|
|
|
|
|
|
* Mon May 04 2020 Javier Martinez Canillas <javierm@redhat.com> - 15-5
|
|
|
|
|
- Fix firmware update bug in aarch64 caused by shim ignoring arguments
|
|
|
|
|
Resolves: rhbz#1817882
|
|
|
|
|
* Thu Sep 17 2020 Peter Jones <pjones@redhat.com> - 15-9.el8
|
|
|
|
|
- Fix an incorrect allocation size.
|
|
|
|
|
Related: rhbz#1877253
|
|
|
|
|
|
|
|
|
|
* Fri Jun 07 2019 Javier Martinez Canillas <javierm@redhat.com> - 15-4
|
|
|
|
|
- Add a gating.yaml file so the package can be properly gated
|
|
|
|
|
Related: rhbz#1682749
|
|
|
|
|
* Thu Jul 30 2020 Peter Jones <pjones@redhat.com> - 15-8
|
|
|
|
|
- Fix a load-address-dependent forever loop.
|
|
|
|
|
Resolves: rhbz#1861977
|
|
|
|
|
Related: CVE-2020-10713
|
|
|
|
|
Related: CVE-2020-14308
|
|
|
|
|
Related: CVE-2020-14309
|
|
|
|
|
Related: CVE-2020-14310
|
|
|
|
|
Related: CVE-2020-14311
|
|
|
|
|
Related: CVE-2020-15705
|
|
|
|
|
Related: CVE-2020-15706
|
|
|
|
|
Related: CVE-2020-15707
|
|
|
|
|
|
|
|
|
|
* Sat Jul 25 2020 Peter Jones <pjones@redhat.com> - 15-7
|
|
|
|
|
- Implement Lenny's workaround
|
|
|
|
|
Related: CVE-2020-10713
|
|
|
|
|
Related: CVE-2020-14308
|
|
|
|
|
Related: CVE-2020-14309
|
|
|
|
|
Related: CVE-2020-14310
|
|
|
|
|
Related: CVE-2020-14311
|
|
|
|
|
|
|
|
|
|
* Fri Jul 24 2020 Peter Jones <pjones@redhat.com> - 15-5
|
|
|
|
|
- Once more with the MokListRT config table patch added.
|
|
|
|
|
Related: CVE-2020-10713
|
|
|
|
|
Related: CVE-2020-14308
|
|
|
|
|
Related: CVE-2020-14309
|
|
|
|
|
Related: CVE-2020-14310
|
|
|
|
|
Related: CVE-2020-14311
|
|
|
|
|
|
|
|
|
|
* Thu Jul 23 2020 Peter Jones <pjones@redhat.com> - 15-4
|
|
|
|
|
- Rebuild for bug fixes and new signing keys
|
|
|
|
|
Related: CVE-2020-10713
|
|
|
|
|
Related: CVE-2020-14308
|
|
|
|
|
Related: CVE-2020-14309
|
|
|
|
|
Related: CVE-2020-14310
|
|
|
|
|
Related: CVE-2020-14311
|
|
|
|
|
|
|
|
|
|
* Wed Jun 05 2019 Javier Martinez Canillas <javierm@redhat.com> - 15-3
|
|
|
|
|
- Make EFI variable copying fatal only on secureboot enabled systems
|
|
|
|
|
Resolves: rhbz#1704854
|
|
|
|
|
Resolves: rhbz#1715878
|
|
|
|
|
- Fix booting shim from an EFI shell using a relative path
|
|
|
|
|
Resolves: rhbz#1717063
|
|
|
|
|
Resolves: rhbz#1717064
|
|
|
|
|
|
|
|
|
|
* Tue Feb 12 2019 Peter Jones <pjones@redhat.com> - 15-2
|
|
|
|
|
- Fix MoK mirroring issue which breaks kdump without intervention
|
|
|
|
|
Related: rhbz#1668966
|
|
|
|
|
|
|
|
|
|
* Thu Apr 05 2018 Peter Jones <pjones@redhat.com> - 15-1
|
|
|
|
|
* Fri Jul 20 2018 Peter Jones <pjones@redhat.com> - 15-1
|
|
|
|
|
- Update to shim 15
|
|
|
|
|
- better checking for bad linker output
|
|
|
|
|
- flicker-free console if there's no error output
|
|
|
|
|
- improved http boot support
|
|
|
|
|
- better protocol re-installation
|
|
|
|
|
- dhcp proxy support
|
|
|
|
|
- tpm measurement even when verification is disabled
|
|
|
|
|
- REQUIRE_TPM build flag
|
|
|
|
|
- more reproducable builds
|
|
|
|
|
- measurement of everything verified through shim_verify()
|
|
|
|
|
- coverity and scan-build checker make targets
|
|
|
|
|
- misc cleanups
|
|
|
|
|
|
|
|
|
|
* Tue Sep 19 2017 Peter Jones <pjones@redhat.com> - 13-3
|
|
|
|
|
- Actually update to the *real* 13 final.
|
|
|
|
@ -184,17 +238,7 @@ cd ..
|
|
|
|
|
* Thu Aug 31 2017 Peter Jones <pjones@redhat.com> - 13-2
|
|
|
|
|
- Actually update to 13 final.
|
|
|
|
|
|
|
|
|
|
* Mon Aug 21 2017 Peter Jones <pjones@redhat.com> - 13-0.1
|
|
|
|
|
- Update to shim-13 test release.
|
|
|
|
|
|
|
|
|
|
* Thu Aug 03 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.9-4
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Thu Jul 27 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.9-3
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Sat Feb 11 2017 Fedora Release Engineering <releng@fedoraproject.org> - 0.9-2
|
|
|
|
|
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
|
|
|
|
|
|
|
|
|
|
* Thu May 12 2016 Peter Jones <pjones@redhat.com> - - 0.9-1
|
|
|
|
|
- Initial split up of -aarch64
|
|
|
|
|
* Fri Aug 18 2017 Peter Jones <pjones@redhat.com> - 13-1
|
|
|
|
|
- Make a new shim-unsigned-x64 package like the shim-unsigned-aarch64 one.
|
|
|
|
|
- This will (eventually) supersede what's in the "shim" package so we can
|
|
|
|
|
make "shim" hold the signed one, which will confuse fewer people.
|
|
|
|
|