From 211a1650feab4ca4576b1558a4dbf76712012576 Mon Sep 17 00:00:00 2001 From: Brian Stinson Date: Mon, 18 Nov 2024 08:41:21 -0600 Subject: [PATCH] Build shim-unsigned for CentOS Stream 10 Related: RHEL-4391 Signed-off-by: Brian Stinson --- redhatsecureboot502.cer | Bin 964 -> 0 bytes redhatsecurebootca5.cer | Bin 920 -> 0 bytes redhatsecurebootca8.cer | Bin 1400 -> 0 bytes sbat.centos.csv | 1 + sbat.redhat.csv | 1 - shim-unsigned-x64.spec | 17 +++++++++++------ vendordb.esl | Bin 2408 -> 0 bytes 7 files changed, 12 insertions(+), 7 deletions(-) delete mode 100644 redhatsecureboot502.cer delete mode 100644 redhatsecurebootca5.cer delete mode 100644 redhatsecurebootca8.cer create mode 100644 sbat.centos.csv delete mode 100644 sbat.redhat.csv diff --git a/redhatsecureboot502.cer b/redhatsecureboot502.cer deleted file mode 100644 index be0b5e211ccf8ad7ba74c88841c921cfdbad5a70..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 964 zcmXqLVm@Hd#I#}oGZP~d6DPygP|MB7r^(JU;AP{~YV&CO&dbQi&B|a9ZzyIU!p0oR z!o|ZIl$xU8kyxUm;F*`KXQ*f(4-#kQk${RT1g9pK7NsgU<>!|uI6Eqs8Y&qmz)j<1 z6ca8^O-{^7Eh=#+N=?Z~EYVBO&oz(}=QT1gFf*_;G%zqQGL91GHMTG?G_-(n4bpHr zK*K-{;sAMU4hYUn&&$k9S1>g&BFY_2j7rFUXJlnyZerwTFlb`rVrpV!WVlw+5~fxp zlC4%={*?v=&XRBAh?w3|ekJhoz zKe*}Ss+-Dp3y#N}_#^e|W8doa9aT(wxO?y2p89Cbu3Q!=zP!k}$2XsU9VoV!m$7=u zaXE&jl}!J>*zj`9usQhLT4_#)+wqRaoS&{Uz0p%LI=p$>w%yj@jOK-#m#OZnogtKa zXx0-|7pa7a%Pt;nc|B=yqk7|#ij=DjlCF{bKHcw(tDZ=IoA@v;?(+N1K5vh6$0wbX zowLen&AF!%E3#rkR^7F4a=E#$KV5;`11Av2kd# zF|x9 z$k^rSH+lBn4DN|8WwYk@BgYLeT>|5Vkzw{NgZMQ5DIkiD~`h}y9{<=D~#ILx2 z!|e$CoGxy;)T!q_Y)P}vi)7| puC*wrU@|^yJWH`pNJ3}E-0bhMGuf{5G|c)nwXm(hxVvuYUH~CAajXCU diff --git a/redhatsecurebootca5.cer b/redhatsecurebootca5.cer deleted file mode 100644 index dfb0284954861282d1a0ce16c8c5cdc71c27659f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 920 zcmXqLVxD5q#8k6@nTe5!iIbtZm{+@~;bN2lFB_*;n@8JsUPeZ4RtAH3LoovpHs(+k zE*{>X)D#7e#1b6^&%9(kLq!95kT^4s1XNrhI5oMnC{@8JKfgr5*-^pNP{}|6ZW6NxP$#b?ru1p1aqn$3D)YB{Qqo zjCvjz?|=HkE#3AN-xTZpws*U~)f@DZ{t~uwMZy8<;F%jD%$u6!n#qYzp^Sryh{C;x9qf@!N=T4ui@b#({ zSD&^p3kNZ=9lAQ9%xdfP9doNToV+k2^LHOFD{5oE&78StJa^8n7$i2k94PWc<&xr*# z`sciS&XK#@>h!OC8{=mczNLHbADCJ+pE=-CsaDOF#s}?5Q)1qq&%R~#cz>QmiAiVx zk5XXYstAL9d+iK-w@u$FESybMIPOFY~9lmn~9nUf%vMc88@((p0B(#qL+!COmt7`j5IhPVzo{cRPw} Pd!}BnFF!b8N6JS4>O*3Z diff --git a/redhatsecurebootca8.cer b/redhatsecurebootca8.cer deleted file mode 100644 index 75bc46b077318bddb19752c3f1ea23c9e9b4add4..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1400 zcmXqLVl6RfVvbqB%*4pV#L2Mtxs0t>V~MK)FB_*;n@8JsUPeZ4Rt5uiLq!95Hs(+k zW*&*4)D#7e#1e(z)a25lR0XH}{1OFcM+FN*B?ASxE>1=<;o{Wf#GKTk5{IJHl#Ij@ zz2y8{137VCBV$8DV*^7=V-sV`C~;n63j;$#3n-U*7Bw*`A$x+6m4Ug5iJ!rsiHVD; ziHVWnl+bRc3xcb~wko}sZ9hL{_EMJJD`Z4tcfN0WYn&*qBELsXID%zg zT;`b8dpq*t2bMnG_{s|rU-<59TO_o$y!z=S%g@SBrA*ZB|65mnZ%t≥xbVqpNd& z8ky!ildDYIvAz6WXm#3o*)-F6#jB%#Y1}zsC~TIy!0Y&QhN)qf*<&gjw>m#b4T!M# zw5$1)A>$$Gci+DLcKKD;Tzq=#+IONtv$9U`F~-hlV%%g<_Pu_V@}cGIQR^Cuz9lf; zZEF?W78j%zbgE|gNu4{pHD?Cj5o&gNT`rln%Dr>5Md<2;5C)%=M3(OwQ$9Sjj5uy- zZ+uTPdEcLtC8~Q%%kvqsZNKq+2{+ntVDG_jwzS3{(ej3^efN{otM>JjN0lmTI6C`& znw5Q`_?F^_SJ5B=8~DVuKO z_y4}6PV%PPr-tKtO=^bs`@g=6mnis}@#YZwx%teCeM6F0Y|g2*e#C6__MYbBT2*Zk zey-&&&V1(-ifDEdvf7%;$aweIsRzaT81i@9SF3Jcxzy18ul)m7_Sutj*1GtgT={$D z@jJV9m&S`0C7)kj&UpIX$Na^ob@w+0X3br_^)&y#{F4geI+MzFrB{fi|I2(7@b=5v zBAFdeC(19NfLjVm>C%u7bhDe8t?&3RKR?Jo7GSn&Lr#Xk zyaY^!j10@?PrAZ*c1`i+9|n^|>sD{QBRZ+rysGNlmiD7hGd7gPyZ0B(j_HeM-g0GG zCCi_UstNW?FES(ozd8O;Fnhi=aKQnW$zEntI+C^PmcC<{!D(;$r@lCA(GgZlo(Ic1 zj=5}~tlD$w4oAL`t61lD_Z_gX-Ojhp(fFvLLlCoP16#;~Q|FxuB)aEl zMe_IiUz#Ug`XGN%{GO^g>$wgHrA%7Tdvc@J;&R{V?7OC$%@+C8Xzv_zifyk*d9!nt zeTUjX?SmBo;any0a?fop6~uJwDk{3YeHAMH*#A!BY5!j_jz?1B&OQ7WvB5l{+>>`% zjL2b?o!TEIp7*kT{5{{QCdJ78#IIfPs;S3xKKpn-Ug3CsR?N??2E!L`Pukt$UH>6l zG3iqB0f))T5oP*!r+&9+f7rP(@6iqucCW}^8gGODkdCpPj;2v=@?`aMuh)!1KdYWBV2b=3?19};KzdVg=x8umtmm*oqe zDlE#m)?vQX>wEj0y&4B{qRN9$q+I@du7BS3=2qpc`=@s7D=Gb@_fp|%_`|k$ryJL^ zoiw>1u_#!{dA4KRubv5OGEQ1t2+#VE`>?0jUhjanC~06|G(Sx dZ_ms6sEcy`V(AecexlXuYp?Y%Z0AVJ1OS#ZUy}d; diff --git a/sbat.centos.csv b/sbat.centos.csv new file mode 100644 index 0000000..23fbdf3 --- /dev/null +++ b/sbat.centos.csv @@ -0,0 +1 @@ +shim.centos,3,The CentOS Project,shim,15.8,security@centos.org diff --git a/sbat.redhat.csv b/sbat.redhat.csv deleted file mode 100644 index be9e036..0000000 --- a/sbat.redhat.csv +++ /dev/null @@ -1 +0,0 @@ -shim.redhat,3,Red Hat Inc,shim,15.8,secalert@redhat.com diff --git a/shim-unsigned-x64.spec b/shim-unsigned-x64.spec index df27ed3..0994e5f 100644 --- a/shim-unsigned-x64.spec +++ b/shim-unsigned-x64.spec @@ -20,7 +20,7 @@ Name: shim-unsigned-%{efiarch} Version: 15.8 -Release: 2.el9 +Release: 3.el10.centos Summary: First-stage UEFI bootloader ExclusiveArch: x86_64 License: BSD @@ -30,7 +30,7 @@ Source1: vendordb.esl %if 0%{?dbxfile} Source2: %{dbxfile} %endif -Source3: sbat.redhat.csv +Source3: sbat.centos.csv Source4: shim.patches Source100: shim-find-debuginfo.sh @@ -42,6 +42,7 @@ BuildRequires: elfutils-libelf-devel BuildRequires: git openssl-devel openssl BuildRequires: pesign >= %{pesign_vre} BuildRequires: dos2unix findutils +BuildRequires: system-sb-certs # Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not # compatible with SysV (there's no red zone under UEFI) and there isn't a @@ -109,8 +110,8 @@ MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 " MAKEFLAGS+="%{_smp_mflags}" -if [ -f "%{SOURCE1}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1}" +if [ -f "/etc/pki/sb-certs/secureboot-ca-x86_64.cer" ]; then + MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=/etc/pki/sb-certs/secureboot-ca-x86_64.cer" fi %if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then @@ -130,8 +131,8 @@ MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 " -if [ -f "%{SOURCE1}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1} " +if [ -f "/etc/pki/sb-certs/secureboot-ca-x86_64.cer" ]; then + MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=/etc/pki/sb-certs/secureboot-ca-x86_64.cer" fi %if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then @@ -160,6 +161,10 @@ cd .. %files debugsource -f build-%{efiarch}/debugsource.list %changelog +* Mon Nov 18 2024 Brian Stinson - 15.8-3.el10.centos +- Build shim-unsigned for CentOS Stream 10 + Related: RHEL-4391 + * Wed Feb 07 2024 Peter Jones - 15.8-2.el9 - Rebuild to fix the commit ident and MAKEFLAGS Resolves: RHEL-56466 diff --git a/vendordb.esl b/vendordb.esl index 8991b3eae876999d4e8eaefa3087bf84c23e68c0..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391 100644 GIT binary patch literal 0 HcmV?d00001 literal 2408 zcmcJQc|6qn8pr21o9s91)Ct2Ju88{^gDgp7jgtKs8l*AEHZ?O$D9lWDA~^A zVN^2Oj6$KK&GBeGtO|(!eKlb~PMSt0`2>@x^aE6~Z-5V7n?wl#73IZsKu{kv1P!oy zIDHR!ahw5&#TtBe|NjSI0V;pIG=PA>Sb!u1WC0>j763rH8{gvPcQK0-h1-e;Dh1Bk zR|=ZfjMei&ry|h>h@^f88^2V^leHoH4&DkcAhc^MzU|2}2(lh(%zU&0nP!x^ofyT} zJI)`hsDRA(O(wiq6l|8D+q;k=~e&^fC~KfYSv(2vQX*0!A! zhs|Z_mm-lmsbjddsTC`KleZGt#%(6UDN8Y6s-=tQ)e(%I$0Zu#$JlAI%uXS24=w(t zR%y9@xgFE5fN9MYF#2Xh@CkGBDVNz20X_nH@ zBd-lkor6g`L6P?dGs2BH&l|2p-sJV>o>)y22NvU?FaQFSI)jd&!sdG`NWkUbGEXUG z)9L|@Hb=7ZS^`8bScG3LO#ihV6fkfUC>Q(Z36fj$r2$|AjsRhs=8t9H?6u9Z0}zF2 zFS9_ur_}vjbd1 zWj|UIl<_HB;o>CuifPnhh+|#FrJ>NR|>L%FwTV_D3u zHTHR=yLLfn+rs__JL!I^*~y-5%6Fyn3jJ52`DRLoC597eXH#=}O&RSO4ZiP-zhL+( z;x~p9H|^I9Bj}qP6aUF@%k(Z2TPEG|i@Ji=|Cv>T|C&`C7K;P1hB#fE;qR<|cK>%9 zv7lcw3Eg56y2&IIfOJYVne}e3lH;hnQ%LB^&MSjAUE3w=dG8%-2InLHtx~g^Gy&e~ zKHFqXIknc@zwP_;Ke<1fgQtmmNAwaFB=~nrq^cQFQ+n5mt*YNP8ljFB7eZ2M@T znMYM2A9eJCe^!j}Yp7?8xJLQ)DER3W(5j9K)cGA)Y5kBQ+b0(xIp6gQ5hIu!^GUJ; z!Qew9yAuoC|7Lb+an(W)&8Bs6s%K@TE(dl<0G_!l;1(FZ9CI0Sze32PhDlvI1`Nl? zZNKZ~q~_Flrh>PJ-?aOZGhd2r_IJh(zw6dXw+&pYj=4Y%`})9_)wAcu4GB*SO>rZ; zNv&%uyJXlB>%|PRE9?wMjdZ%_u+C-2kqtd z?qm4UrtqjJ_YKQ{nlpm7?@uBR#snQotcr{6K7R5Wh6x^UO!zHmLjmN zq>MOZ02qGUIYw)RP?}7mRO>6tu-2bU#}Gn!S;5s7_Pol~$|w9Ltuk*}DygS}0d$SL zr<8VSwJ{w7uT*imB-bfCwEUjT@J9dBvi|EQUOCJxR8w~~OkGea(TFIM^2{B)q3;%+ znu+@Kn3?)r;1^n7N4SNmMbzlqeJCP-|Fl;oC3!8gCg z_%B$3ZFOHoVdenv!wp*h3YaMyUB%(cX43XXMt0vxcr+DoGu+!cotj5X^M>6SD35@z z)u|pcg}x3zIWFN>(E8IH$0DvpmaTqvB1tp4Y!;F$Y^t{wLklc zD^Bn0J4sB@QdYK_dFv`aVb5oF*$asHhrV9jj&+Bi(OZ@Lc+dRdLlf8V&o2`{CdXo5&+zuY6tA5NQa;{C;vUGt5W@d9oU?3@ zFrHKw`l>-!$ktt;KI6PbVc{Uhxf8FHh?d{Q>b7^E`eAj(rd341Q46 zPc1vDsp9MvbAm=_HBrSI_vPV>qb<}MLQL=tqj(Bk50tuxH|RmP@%Y&;W-XGZ+lwl3Rx!`RdkIoAZUpcQdY!jfm7?ZF z%B AFaQ7m