From 706b98e87948d6816ac81458ae78aaec629dc4d3 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Mon, 13 Apr 2026 15:13:02 +0200 Subject: [PATCH] Update shim to 16.1 Certs: Add centos_vendor.esl containing both CA2 and CA8 certs Resolves: RHEL-137056 Signed-off-by: Nicolas Frayer --- centos_vendordb.esl | Bin 0 -> 2334 bytes shim-unsigned-x64.spec | 19 ++++++++++++------- sources | 2 +- 3 files changed, 13 insertions(+), 8 deletions(-) create mode 100644 centos_vendordb.esl diff --git a/centos_vendordb.esl b/centos_vendordb.esl new file mode 100644 index 0000000000000000000000000000000000000000..bd508b57ef2c1e030bac609bb7413d6521506cb3 GIT binary patch literal 2334 zcmb`Ic|6p67sqF{Wh+~T8AG-xelxNaZkEt6im~quBI`4@nkh6U$r8GfeHTI)V<;3+ zsG%qk3AcpEE`{>&^t|qKU-kTP|G3|O&g;Cs=e*AAobP#mz6ExzCGS&9aaZaqgd7zY zN!OvE|D3QL+mg8vZU@EUTU_N=r;^T@092?uK!xD)p%5?x!U?)+PM(iFhTQ~s*f)E*guG0?>aZae{>f zf_DRaLe3v2?j!^TD+Q9y04Nb2EC8qhnt%pIQw3`;!lR-AU@#j0b^ozCRIt=vTL8mB zP%4-Y1W>_T5Goi9DmeS9#|JdfC-|^@eU0f7)^RPr$xbUVKF^_z)RTLM_kuSfneeBX|73=HhSft=;#%UjgBYIzZ^Y}w=JfvG_I|oL zH`*rO3{@L5lB~5Mi3q0O%8zGtd)dBmmvVRmiRv)&Z}Dq=Tap}71VSGXDdr<{GB>gFU$7Cb z!iC&*>3ba%NrQHf?dC$XvJ329w{y9RmVV}RSVNcj^%rqMlZV4j58dXoc@xusz=1!A z(f2lGda5|u&{{8^S_T>5(Hwj0rk?7WtsVuJ*gpw>pQoT>i1Vq<>wj9oQ&sC*7M1T< zoQIgtFV<>&d1*DDvaJ_r9iP}as*}SiwhJVST2!t~e6{r(9@ITs)#Yy{n8+#fg28;@ zOl3d@1DkM1CPKw(BolIN*jR9fv9FARpNLF={~$7G$Nowr+;N9WgC9f+QatnEZwu3M z9>1HFKw<1Nw2z72_-Vv{0~(FL4W}vwP{Ck!0oB}vQyqi-)BVTlP$9p<3E71cvI8ds z3@TC4*h<&97SLhDqju{OZ&^no7BIH_D!4QsDpcp^QW+-N{m?6!EfZ;R&Z1WsbN=;G z%Lw1?nej_gP{UL?E2P{y6RJ{UPWD8(uV(ui-U@1w?NXPfnp`=`VrVwLswO=jdpmge zX)hLak>x_PVx|w>4KKk=(XWu10h6*ei`lQ}#NG>n=rfaS^>`w_g&j?FT?J&EL_ADT$QV2bl#M^?4baPA8`m09Bi3xFVsHnFf-v7 zo~3H-H|`H#mSGj^UKj4l%SE_#>l@jqPCQFXSTA*Qo0-Pb6wts>j-_q!fFDON(i}Ncs6T^tYis?BRX+ePIlaEYaSrTG^Rk zc))B4`|G|@SB=2511B!Bk1pS|ZQ9!FG@E=Fhcg>V@Gx5ul0%FMNlrsKJ$GS#zG$vKF9A; z&u;2+nG|jY^4j-@ROfGB*z8@XZpPe?59?_sHzfPc(9DmSBKp1sXT}bmDXBr89^Maw zN^moT?G@KZViyz}6sX@xQ&hYTmu8C6x$Np~-69TlVZOo1TLb)LU&R`AQ94~PXTK@j z!g;i2Nj4$mk&RkbeZ=7D{4;y2x0B;u-jVo+dX*%c$8*56FM7* n`(w%SZfH+ASla#AP`2bDn$Ze(nSET`9m)AA{&CbsCW7#9RkPEG literal 0 HcmV?d00001 diff --git a/shim-unsigned-x64.spec b/shim-unsigned-x64.spec index 0994e5f..c3fe42b 100644 --- a/shim-unsigned-x64.spec +++ b/shim-unsigned-x64.spec @@ -19,14 +19,14 @@ %global dbxfile %{nil} Name: shim-unsigned-%{efiarch} -Version: 15.8 -Release: 3.el10.centos +Version: 16.1 +Release: 1.el10.centos Summary: First-stage UEFI bootloader ExclusiveArch: x86_64 License: BSD URL: https://github.com/rhboot/shim Source0: https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2 -Source1: vendordb.esl +Source1: centos_vendordb.esl %if 0%{?dbxfile} Source2: %{dbxfile} %endif @@ -110,8 +110,8 @@ MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 " MAKEFLAGS+="%{_smp_mflags}" -if [ -f "/etc/pki/sb-certs/secureboot-ca-x86_64.cer" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=/etc/pki/sb-certs/secureboot-ca-x86_64.cer" +if [ -f "%{SOURCE1}" ]; then + MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1}" fi %if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then @@ -131,8 +131,8 @@ MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 " -if [ -f "/etc/pki/sb-certs/secureboot-ca-x86_64.cer" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=/etc/pki/sb-certs/secureboot-ca-x86_64.cer" +if [ -f "%{SOURCE1}" ]; then + MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1} " fi %if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then @@ -161,6 +161,11 @@ cd .. %files debugsource -f build-%{efiarch}/debugsource.list %changelog +* Mon Apr 13 2026 Nicolas Frayer - 16.1-1.el10.centos +- Update shim to 16.1 +- Certs: Add centos_vendor.esl containing both CA2 and CA8 certs +- Resolves: RHEL-137056 + * Mon Nov 18 2024 Brian Stinson - 15.8-3.el10.centos - Build shim-unsigned for CentOS Stream 10 Related: RHEL-4391 diff --git a/sources b/sources index 5428b75..e96df6e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (shim-15.8.tar.bz2) = 30b3390ae935121ea6fe728d8f59d37ded7b918ad81bea06e213464298b4bdabbca881b30817965bd397facc596db1ad0b8462a84c87896ce6c1204b19371cd1 +SHA512 (shim-16.1.tar.bz2) = ca5f80e82f3b80b622028f03ef23105c98ee1b6a25f52a59c823080a3202dd4b9962266489296e99f955eb92e36ce13e0b1d57f688350006bba45f2718f159fb