diff --git a/.gitignore b/.gitignore index 6b84d7a..668482d 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/shim-15.6.tar.bz2 +SOURCES/shim-15.8.tar.bz2 diff --git a/.shim-unsigned-x64.metadata b/.shim-unsigned-x64.metadata index b5fa713..89e9ccb 100644 --- a/.shim-unsigned-x64.metadata +++ b/.shim-unsigned-x64.metadata @@ -1 +1 @@ -3df0ab5cefc74fdf865cb36aea0e923cb4b6b3ed SOURCES/shim-15.6.tar.bz2 +cdec924ca437a4509dcb178396996ddf92c11183 SOURCES/shim-15.8.tar.bz2 diff --git a/SOURCES/redhatsecurebootca5.cer b/SOURCES/redhatsecurebootca5.cer deleted file mode 100644 index dfb0284..0000000 Binary files a/SOURCES/redhatsecurebootca5.cer and /dev/null differ diff --git a/SOURCES/sbat.redhat.csv b/SOURCES/sbat.redhat.csv index 2135543..be9e036 100644 --- a/SOURCES/sbat.redhat.csv +++ b/SOURCES/sbat.redhat.csv @@ -1 +1 @@ -shim.redhat,1,Red Hat Inc,shim,15.5,secalert@redhat.com +shim.redhat,3,Red Hat Inc,shim,15.8,secalert@redhat.com diff --git a/SOURCES/vendordb.esl b/SOURCES/vendordb.esl new file mode 100644 index 0000000..8991b3e Binary files /dev/null and b/SOURCES/vendordb.esl differ diff --git a/SPECS/shim-unsigned-x64.spec b/SPECS/shim-unsigned-x64.spec index 6064d69..1bc764c 100644 --- a/SPECS/shim-unsigned-x64.spec +++ b/SPECS/shim-unsigned-x64.spec @@ -19,14 +19,14 @@ %global dbxfile %{nil} Name: shim-unsigned-%{efiarch} -Version: 15.6 -Release: 1.el9 +Version: 15.8 +Release: 2.el9 Summary: First-stage UEFI bootloader ExclusiveArch: x86_64 License: BSD URL: https://github.com/rhboot/shim Source0: https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2 -Source1: redhatsecurebootca5.cer +Source1: vendordb.esl %if 0%{?dbxfile} Source2: %{dbxfile} %endif @@ -103,13 +103,14 @@ mkdir build-%{efialtarch} cp %{SOURCE3} data/ %build -COMMITID=$(cat commit) -MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " +COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6 +MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " +MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 " MAKEFLAGS+="%{_smp_mflags}" if [ -f "%{SOURCE1}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" + MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1}" fi %if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then @@ -124,16 +125,17 @@ make ${MAKEFLAGS} \ cd .. %install -COMMITID=$(cat commit) -MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " +COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6 +MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " +MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 " if [ -f "%{SOURCE1}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" + MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1} " fi %if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}" + MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2} " fi %endif @@ -158,9 +160,19 @@ cd .. %files debugsource -f build-%{efiarch}/debugsource.list %changelog +* Wed Feb 07 2024 Peter Jones - 15.8-2.el9 +- Rebuild to fix the commit ident and MAKEFLAGS + Resolves: RHEL-11262 + +* Tue Jan 23 2024 Peter Jones - 15.8-1.el9 +- Update to shim-15.8 for CVE-2023-40547 + Resolves: RHEL-11262 + * Wed Jun 01 2022 Peter Jones - 15.6-1.el9 -- Update to shim-15.6 - Resolves: CVE-2022-28737 +- Update to shim-15.6 for CVE-2022-28737 + +* Tue May 24 2022 Peter Jones - 15.6~rc1-1.el9 +- Update to shim-15.6~rc1 for CVE-2022-28737 * Wed Mar 09 2022 Peter Jones - 15.5-1 - Update to shim-15.5