import shim-unsigned-x64-15-2.el8

.gitignore

@@ -0,0 +1 @@
+SOURCES/shim-15.tar.bz2

.shim-unsigned-x64.metadata

@@ -0,0 +1 @@
+2dc6308584187bf3ee88bf9b119938c72c5a5088 SOURCES/shim-15.tar.bz2

SOURCES/0001-Make-sure-that-MOK-variables-always-get-mirrored.patch

@@ -0,0 +1,60 @@
+From 9ab0d796bdc9cefdaa3b0df7434845d26c43d894 Mon Sep 17 00:00:00 2001
+From: Patrick Uiterwijk <patrick@puiterwijk.org>
+Date: Mon, 5 Nov 2018 14:51:16 +0100
+Subject: [PATCH 1/3] Make sure that MOK variables always get mirrored
+
+Without this, if a Mok variable doesn't exist in Boot Services, it will also
+not be copied to Runtime, even if we have data to be added to it (vendor cert).
+This patch makes sure that if we have extra data to append, we still mirror
+the variable.
+
+Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
+---
+ mok.c | 20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+diff --git a/mok.c b/mok.c
+index 38675211e0e..00dd1ad3034 100644
+--- a/mok.c
++++ b/mok.c
+@@ -223,11 +223,26 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
+ 		UINT32 attrs = 0;
+ 		BOOLEAN delete = FALSE, present, addend;
+ 
++		addend = (v->addend_source && v->addend_size &&
++			  *v->addend_source && *v->addend_size)
++			? TRUE : FALSE;
++
+ 		efi_status = get_variable_attr(v->name,
+ 					       &v->data, &v->data_size,
+ 					       *v->guid, &attrs);
+-		if (efi_status == EFI_NOT_FOUND)
++		if (efi_status == EFI_NOT_FOUND) {
++			if (v->rtname && addend) {
++				efi_status = mirror_one_mok_variable(v);
++				if (EFI_ERROR(efi_status) &&
++				    ret != EFI_SECURITY_VIOLATION)
++					ret = efi_status;
++			}
++			/*
++			 * after possibly adding, we can continue, no
++			 * further checks to be done.
++			 */
+ 			continue;
++		}
+ 		if (EFI_ERROR(efi_status)) {
+ 			perror(L"Could not verify %s: %r\n", v->name,
+ 			       efi_status);
+@@ -272,9 +287,6 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
+ 		}
+ 
+ 		present = (v->data && v->data_size) ? TRUE : FALSE;
+-		addend = (v->addend_source && v->addend_size &&
+-			  *v->addend_source && *v->addend_size)
+-			? TRUE : FALSE;
+ 
+ 		if (v->flags & MOK_VARIABLE_MEASURE && present) {
+ 			/*
+-- 
+2.20.1
+

SOURCES/0002-mok-fix-the-mirroring-of-RT-variables.patch

@@ -0,0 +1,49 @@
+From 4b27ae034ba9885960e72f77b3f687a9b7fea824 Mon Sep 17 00:00:00 2001
+From: Gary Lin <glin@suse.com>
+Date: Wed, 21 Nov 2018 12:47:43 +0800
+Subject: [PATCH 2/3] mok: fix the mirroring of RT variables
+
+When there is no key in MokList, import_mok_state() just skipped MokList
+even though it should always mirror the vendor cert. Besides, the faulty
+check of 'present' and 'addend' invalidates the mirroring of MokListXRT,
+MokSBStateRT, and MokIgnoreDB.
+
+https://github.com/rhboot/shim/issues/154
+
+Signed-off-by: Gary Lin <glin@suse.com>
+---
+ mok.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+diff --git a/mok.c b/mok.c
+index 00dd1ad3034..41925abbb49 100644
+--- a/mok.c
++++ b/mok.c
+@@ -231,12 +231,8 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
+ 					       &v->data, &v->data_size,
+ 					       *v->guid, &attrs);
+ 		if (efi_status == EFI_NOT_FOUND) {
+-			if (v->rtname && addend) {
+-				efi_status = mirror_one_mok_variable(v);
+-				if (EFI_ERROR(efi_status) &&
+-				    ret != EFI_SECURITY_VIOLATION)
+-					ret = efi_status;
+-			}
++			if (addend)
++				goto mirror_addend;
+ 			/*
+ 			 * after possibly adding, we can continue, no
+ 			 * further checks to be done.
+@@ -316,7 +312,8 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
+ 			}
+ 		}
+ 
+-		if (v->rtname && present && addend) {
++mirror_addend:
++		if (v->rtname && (present || addend)) {
+ 			if (v->flags & MOK_MIRROR_DELETE_FIRST)
+ 				LibDeleteVariable(v->rtname, v->guid);
+ 
+-- 
+2.20.1
+

SOURCES/0003-mok-consolidate-mirroring-code-in-a-helper-instead-o.patch

@@ -0,0 +1,109 @@
+From 29c11483101b460869a5e0dba1f425073862127d Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Thu, 31 Jan 2019 13:45:30 -0500
+Subject: [PATCH 3/3] mok: consolidate mirroring code in a helper instead of
+ using goto
+
+There's no reason to complicate the logic with a goto here, instead just
+pull the logic we're jumping to out to a helper function.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ mok.c  | 41 ++++++++++++++++++++++++++++-------------
+ shim.h |  2 ++
+ 2 files changed, 30 insertions(+), 13 deletions(-)
+
+diff --git a/mok.c b/mok.c
+index 41925abbb49..2f495e6cf25 100644
+--- a/mok.c
++++ b/mok.c
+@@ -130,7 +130,8 @@ struct mok_state_variable mok_state_variables[] = {
+ 	{ NULL, }
+ };
+ 
+-static EFI_STATUS mirror_one_mok_variable(struct mok_state_variable *v)
++static EFI_STATUS nonnull(1)
++mirror_one_mok_variable(struct mok_state_variable *v)
+ {
+ 	EFI_STATUS efi_status = EFI_SUCCESS;
+ 	void *FullData = NULL;
+@@ -196,6 +197,29 @@ static EFI_STATUS mirror_one_mok_variable(struct mok_state_variable *v)
+ 	return efi_status;
+ }
+ 
++/*
++ * Mirror a variable if it has an rtname, and preserve any
++ * EFI_SECURITY_VIOLATION status at the same time.
++ */
++static EFI_STATUS nonnull(1)
++maybe_mirror_one_mok_variable(struct mok_state_variable *v, EFI_STATUS ret)
++{
++	EFI_STATUS efi_status;
++	if (v->rtname) {
++		if (v->flags & MOK_MIRROR_DELETE_FIRST)
++			LibDeleteVariable(v->rtname, v->guid);
++
++		efi_status = mirror_one_mok_variable(v);
++		if (EFI_ERROR(efi_status)) {
++			if (ret != EFI_SECURITY_VIOLATION)
++				ret = efi_status;
++			perror(L"Could not create %s: %r\n", v->rtname,
++			       efi_status);
++		}
++	}
++	return ret;
++}
++
+ /*
+  * Verify our non-volatile MoK state.  This checks the variables above
+  * accessable and have valid attributes.  If they don't, it removes
+@@ -232,7 +256,7 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
+ 					       *v->guid, &attrs);
+ 		if (efi_status == EFI_NOT_FOUND) {
+ 			if (addend)
+-				goto mirror_addend;
++				ret = maybe_mirror_one_mok_variable(v, ret);
+ 			/*
+ 			 * after possibly adding, we can continue, no
+ 			 * further checks to be done.
+@@ -312,16 +336,8 @@ EFI_STATUS import_mok_state(EFI_HANDLE image_handle)
+ 			}
+ 		}
+ 
+-mirror_addend:
+-		if (v->rtname && (present || addend)) {
+-			if (v->flags & MOK_MIRROR_DELETE_FIRST)
+-				LibDeleteVariable(v->rtname, v->guid);
+-
+-			efi_status = mirror_one_mok_variable(v);
+-			if (EFI_ERROR(efi_status) &&
+-			    ret != EFI_SECURITY_VIOLATION)
+-				ret = efi_status;
+-		}
++		if (present)
++			ret = maybe_mirror_one_mok_variable(v, ret);
+ 	}
+ 
+ 	/*
+@@ -340,4 +356,4 @@ mirror_addend:
+ 	return ret;
+ }
+ 
+-// vim:fenc=utf-8:tw=75
++// vim:fenc=utf-8:tw=75:noet
+diff --git a/shim.h b/shim.h
+index 2b359d821e3..c26d5f06538 100644
+--- a/shim.h
++++ b/shim.h
+@@ -30,6 +30,8 @@
+ 
+ #include <stddef.h>
+ 
++#define nonnull(...) __attribute__((__nonnull__(__VA_ARGS__)))
++
+ #define min(a, b) ({(a) < (b) ? (a) : (b);})
+ 
+ #ifdef __x86_64__
+-- 
+2.20.1
+

SOURCES/0004-Make-VLogError-behave-as-expected.patch

@@ -0,0 +1,50 @@
+From 0bff94b170116737e6e0838c35c0ac376542a5c0 Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Tue, 12 Feb 2019 18:04:49 -0500
+Subject: [PATCH 4/4] Make VLogError() behave as expected.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ errlog.c | 15 +++------------
+ 1 file changed, 3 insertions(+), 12 deletions(-)
+
+diff --git a/errlog.c b/errlog.c
+index 18be4822d53..eebb266d396 100644
+--- a/errlog.c
++++ b/errlog.c
+@@ -14,29 +14,20 @@ EFI_STATUS
+ VLogError(const char *file, int line, const char *func, CHAR16 *fmt, va_list args)
+ {
+ 	va_list args2;
+-	UINTN size = 0, size2;
+ 	CHAR16 **newerrs;
+ 
+-	size = SPrint(NULL, 0, L"%a:%d %a() ", file, line, func);
+-	va_copy(args2, args);
+-	size2 = VSPrint(NULL, 0, fmt, args2);
+-	va_end(args2);
+-
+ 	newerrs = ReallocatePool(errs, (nerrs + 1) * sizeof(*errs),
+ 				       (nerrs + 3) * sizeof(*errs));
+ 	if (!newerrs)
+ 		return EFI_OUT_OF_RESOURCES;
+ 
+-	newerrs[nerrs] = AllocatePool(size*2+2);
++	newerrs[nerrs] = PoolPrint(L"%a:%d %a() ", file, line, func);
+ 	if (!newerrs[nerrs])
+ 		return EFI_OUT_OF_RESOURCES;
+-	newerrs[nerrs+1] = AllocatePool(size2*2+2);
++	va_copy(args2, args);
++	newerrs[nerrs+1] = VPoolPrint(fmt, args2);
+ 	if (!newerrs[nerrs+1])
+ 		return EFI_OUT_OF_RESOURCES;
+-
+-	SPrint(newerrs[nerrs], size*2+2, L"%a:%d %a() ", file, line, func);
+-	va_copy(args2, args);
+-	VSPrint(newerrs[nerrs+1], size2*2+2, fmt, args2);
+ 	va_end(args2);
+ 
+ 	nerrs += 2;
+-- 
+2.20.1
+

SOURCES/shim-find-debuginfo.sh

@@ -0,0 +1,90 @@
+#!/bin/bash
+#
+# shim-find-debuginfo.sh
+# Copyright (C) 2017 Peter Jones <Peter Jones@random>
+#
+# Distributed under terms of the GPLv3 license.
+#
+set -e
+set -u
+
+mainarch=$1 && shift
+if [ $# == 1 ]; then
+    altarch=$1 && shift
+fi
+if ! [ -v RPM_BUILD_ROOT ]; then
+    echo "RPM_BUILD_ROOT must be set" 1>&2
+    exit 1
+fi
+
+findsource()
+{
+    (
+        cd ${RPM_BUILD_ROOT}
+        find usr/src/debug/ -type d | sed "s,^,%dir /,"
+        find usr/src/debug/ -type f | sed "s,^,/,"
+    )
+}
+
+finddebug()
+{
+    arch=$1 && shift
+    declare -a dirs=()
+    declare -a files=()
+    declare -a excludes=()
+
+    pushd ${RPM_BUILD_ROOT} >/dev/null 2>&1
+    for x in $(find usr/lib/debug/ -type f -iname *.efi.debug); do
+        if ! [ -e "${x}" ]; then
+            break
+        fi
+        if [[ ${x} =~ ${arch}\.efi\.debug$ ]]; then
+            files[${#files[@]}]=${x}
+        else
+            excludes[${#excludes[@]}]=${x}
+        fi
+    done
+    for x in usr/lib/debug/.build-id/*/*.debug ; do
+        if ! [ -e "${x}" ]; then
+            break
+        fi
+        link=$(readlink "${x}")
+        if [[ ${link} =~ ${arch}\.efi\.debug$ ]]; then
+            files[${#files[@]}]=${x}
+            files[${#files[@]}]=${x%%.debug}
+        else
+            excludes[${#excludes[@]}]=${x}
+            excludes[${#excludes[@]}]=${x%%.debug}
+        fi
+    done
+    for x in ${files[@]} ; do
+        declare name=$(dirname /${x})
+        while [ "${name}" != "/" ]; do
+            case "${name}" in
+            "/usr/lib/debug"|"/usr/lib"|"/usr")
+                ;;
+            *)
+                dirs[${#dirs[@]}]=${name}
+                ;;
+            esac
+            name=$(dirname ${name})
+        done
+    done
+
+    popd >/dev/null 2>&1
+    for x in ${dirs[@]} ; do
+        echo "%dir ${x}"
+    done | sort | uniq
+    for x in ${files[@]} ; do
+        echo "/${x}"
+    done | sort | uniq
+    for x in ${excludes[@]} ; do
+        echo "%exclude /${x}"
+    done
+}
+
+findsource > build-${mainarch}/debugsource.list
+finddebug ${mainarch} > build-${mainarch}/debugfiles.list
+if [ -v altarch ]; then
+    finddebug ${altarch} > build-${altarch}/debugfiles.list
+fi

SPECS/shim-unsigned-x64.spec

@@ -0,0 +1,192 @@
+%global pesign_vre 0.106-1
+%global gnuefi_vre 1:3.0.5-6
+%global openssl_vre 1.0.2j
+
+%global debug_package %{nil}
+%global __debug_package 1
+%global _binaries_in_noarch_packages_terminate_build 0
+%global __debug_install_post %{SOURCE100} x64 ia32
+%undefine _debuginfo_subpackages
+
+%global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/'))
+%global shimrootdir %{_datadir}/shim/
+%global shimversiondir %{shimrootdir}/%{version}-%{release}
+%global efiarch x64
+%global shimdir %{shimversiondir}/%{efiarch}
+%global efialtarch ia32
+%global shimaltdir %{shimversiondir}/%{efialtarch}
+
+Name:		shim-unsigned-%{efiarch}
+Version:	15
+Release:	2%{?dist}
+Summary:	First-stage UEFI bootloader
+ExclusiveArch:	x86_64
+License:	BSD
+URL:		https://github.com/rhboot/shim
+Source0:	https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2
+Source1:	securebootca.cer
+# currently here's what's in our dbx:
+# nothing.
+Source2:	dbx.esl
+
+Source100:	shim-find-debuginfo.sh
+
+Patch0001:	0001-Make-sure-that-MOK-variables-always-get-mirrored.patch
+Patch0002:	0002-mok-fix-the-mirroring-of-RT-variables.patch
+Patch0003:	0003-mok-consolidate-mirroring-code-in-a-helper-instead-o.patch
+Patch0004:	0004-Make-VLogError-behave-as-expected.patch
+
+BuildRequires:	elfutils-libelf-devel
+BuildRequires:	git openssl-devel openssl
+BuildRequires:	pesign >= %{pesign_vre}
+BuildRequires:	gnu-efi >= %{gnuefi_vre}
+BuildRequires:	gnu-efi-devel >= %{gnuefi_vre}
+
+# Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not
+# compatible with SysV (there's no red zone under UEFI) and there isn't a
+# POSIX-style C library.
+# BuildRequires:	OpenSSL
+Provides:	bundled(openssl) = %{openssl_vre}
+
+%global desc \
+Initial UEFI bootloader that handles chaining to a trusted full \
+bootloader under secure boot environments.
+%global debug_desc \
+This package provides debug information for package %{expand:%%{name}} \
+Debug information is useful when developing applications that \
+use this package or when debugging this package.
+
+%description
+%desc
+
+%package -n shim-unsigned-%{efialtarch}
+Summary:	First-stage UEFI bootloader (unsigned data)
+Provides:	bundled(openssl) = %{openssl_vre}
+
+%description -n shim-unsigned-%{efialtarch}
+%desc
+
+%package debuginfo
+Summary:	Debug information for shim-unsigned-%{efiarch}
+Requires:	%{name}-debugsource = %{version}-%{release}
+Group:		Development/Debug
+AutoReqProv:	0
+BuildArch:	noarch
+
+%description debuginfo
+%debug_desc
+
+%package -n shim-unsigned-%{efialtarch}-debuginfo
+Summary:	Debug information for shim-unsigned-%{efialtarch}
+Group:		Development/Debug
+Requires:	%{name}-debugsource = %{version}-%{release}
+AutoReqProv:	0
+BuildArch:	noarch
+
+%description -n shim-unsigned-%{efialtarch}-debuginfo
+%debug_desc
+
+%package debugsource
+Summary:	Debug Source for shim-unsigned
+Group:		Development/Debug
+AutoReqProv:	0
+BuildArch:	noarch
+
+%description debugsource
+%debug_desc
+
+%prep
+%autosetup -S git -n shim-%{version}
+git config --unset user.email
+git config --unset user.name
+mkdir build-%{efiarch}
+mkdir build-%{efialtarch}
+
+%build
+COMMITID=$(cat commit)
+MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} "
+MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
+MAKEFLAGS+="ENABLE_HTTPBOOT=true ENABLE_SHIM_HASH=true "
+MAKEFLAGS+="%{_smp_mflags}"
+if [ -f "%{SOURCE1}" ]; then
+	MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}"
+fi
+if [ -f "%{SOURCE2}" ]; then
+	MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}"
+fi
+
+cd build-%{efiarch}
+make ${MAKEFLAGS} DEFAULT_LOADER='\\\\grub%{efiarch}.efi' all
+cd ..
+
+cd build-%{efialtarch}
+setarch linux32 -B make ${MAKEFLAGS} ARCH=%{efialtarch} DEFAULT_LOADER='\\\\grub%{efialtarch}.efi' all
+cd ..
+
+%install
+COMMITID=$(cat commit)
+MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} "
+MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
+MAKEFLAGS+="ENABLE_HTTPBOOT=true ENABLE_SHIM_HASH=true "
+if [ -f "%{SOURCE1}" ]; then
+	MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}"
+fi
+if [ -f "%{SOURCE2}" ]; then
+	MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}"
+fi
+
+cd build-%{efiarch}
+make ${MAKEFLAGS} \
+	DEFAULT_LOADER='\\\\grub%{efiarch}.efi' \
+	DESTDIR=${RPM_BUILD_ROOT} \
+	install-as-data install-debuginfo install-debugsource
+cd ..
+
+cd build-%{efialtarch}
+setarch linux32 make ${MAKEFLAGS} ARCH=%{efialtarch} \
+	DEFAULT_LOADER='\\\\grub%{efialtarch}.efi' \
+	DESTDIR=${RPM_BUILD_ROOT} \
+	install-as-data install-debuginfo install-debugsource
+cd ..
+
+%files
+%license COPYRIGHT
+%dir %{shimrootdir}
+%dir %{shimversiondir}
+%dir %{shimdir}
+%{shimdir}/*.efi
+%{shimdir}/*.hash
+
+%files -n shim-unsigned-%{efialtarch}
+%license COPYRIGHT
+%dir %{shimrootdir}
+%dir %{shimversiondir}
+%dir %{shimaltdir}
+%{shimaltdir}/*.efi
+%{shimaltdir}/*.hash
+
+%files debuginfo -f build-%{efiarch}/debugfiles.list
+
+%files -n shim-unsigned-%{efialtarch}-debuginfo -f build-%{efialtarch}/debugfiles.list
+
+%files debugsource -f build-%{efiarch}/debugsource.list
+
+%changelog
+* Tue Feb 12 2019 Peter Jones <pjones@redhat.com> - 15-2
+- Fix MoK mirroring issue which breaks kdump without intervention
+  Related: rhbz#1668966
+
+* Fri Jul 20 2018 Peter Jones <pjones@redhat.com> - 15-1
+- Update to shim 15
+
+* Tue Sep 19 2017 Peter Jones <pjones@redhat.com> - 13-3
+- Actually update to the *real* 13 final.
+  Related: rhbz#1489604
+
+* Thu Aug 31 2017 Peter Jones <pjones@redhat.com> - 13-2
+- Actually update to 13 final.
+
+* Fri Aug 18 2017 Peter Jones <pjones@redhat.com> - 13-1
+- Make a new shim-unsigned-x64 package like the shim-unsigned-aarch64 one.
+- This will (eventually) supersede what's in the "shim" package so we can
+  make "shim" hold the signed one, which will confuse fewer people.