From e87446c8db99cf2ef702b9e5383bab35fc8330e4 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Fri, 10 May 2024 16:06:17 +0300 Subject: [PATCH] import shim-15.8 --- .gitignore | 2 +- .shim-unsigned-x64.metadata | 2 +- SOURCES/redhatsecurebootca5.cer | Bin 920 -> 0 bytes SOURCES/sbat.redhat.csv | 2 +- SOURCES/vendordb.esl | Bin 0 -> 2408 bytes SPECS/shim-unsigned-x64.spec | 36 +++++++++++++++++++++----------- 6 files changed, 27 insertions(+), 15 deletions(-) delete mode 100644 SOURCES/redhatsecurebootca5.cer create mode 100644 SOURCES/vendordb.esl diff --git a/.gitignore b/.gitignore index 6b84d7a..668482d 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/shim-15.6.tar.bz2 +SOURCES/shim-15.8.tar.bz2 diff --git a/.shim-unsigned-x64.metadata b/.shim-unsigned-x64.metadata index b5fa713..89e9ccb 100644 --- a/.shim-unsigned-x64.metadata +++ b/.shim-unsigned-x64.metadata @@ -1 +1 @@ -3df0ab5cefc74fdf865cb36aea0e923cb4b6b3ed SOURCES/shim-15.6.tar.bz2 +cdec924ca437a4509dcb178396996ddf92c11183 SOURCES/shim-15.8.tar.bz2 diff --git a/SOURCES/redhatsecurebootca5.cer b/SOURCES/redhatsecurebootca5.cer deleted file mode 100644 index dfb0284954861282d1a0ce16c8c5cdc71c27659f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 920 zcmXqLVxD5q#8k6@nTe5!iIbtZm{+@~;bN2lFB_*;n@8JsUPeZ4RtAH3LoovpHs(+k zE*{>X)D#7e#1b6^&%9(kLq!95kT^4s1XNrhI5oMnC{@8JKfgr5*-^pNP{}|6ZW6NxP$#b?ru1p1aqn$3D)YB{Qqo zjCvjz?|=HkE#3AN-xTZpws*U~)f@DZ{t~uwMZy8<;F%jD%$u6!n#qYzp^Sryh{C;x9qf@!N=T4ui@b#({ zSD&^p3kNZ=9lAQ9%xdfP9doNToV+k2^LHOFD{5oE&78StJa^8n7$i2k94PWc<&xr*# z`sciS&XK#@>h!OC8{=mczNLHbADCJ+pE=-CsaDOF#s}?5Q)1qq&%R~#cz>QmiAiVx zk5XXYstAL9d+iK-w@u$FESybMIPOFY~9lmn~9nUf%vMc88@((p0B(#qL+!COmt7`j5IhPVzo{cRPw} Pd!}BnFF!b8N6JS4>O*3Z diff --git a/SOURCES/sbat.redhat.csv b/SOURCES/sbat.redhat.csv index 2135543..be9e036 100644 --- a/SOURCES/sbat.redhat.csv +++ b/SOURCES/sbat.redhat.csv @@ -1 +1 @@ -shim.redhat,1,Red Hat Inc,shim,15.5,secalert@redhat.com +shim.redhat,3,Red Hat Inc,shim,15.8,secalert@redhat.com diff --git a/SOURCES/vendordb.esl b/SOURCES/vendordb.esl new file mode 100644 index 0000000000000000000000000000000000000000..8991b3eae876999d4e8eaefa3087bf84c23e68c0 GIT binary patch literal 2408 zcmcJQc|6qn8pr21o9s91)Ct2Ju88{^gDgp7jgtKs8l*AEHZ?O$D9lWDA~^A zVN^2Oj6$KK&GBeGtO|(!eKlb~PMSt0`2>@x^aE6~Z-5V7n?wl#73IZsKu{kv1P!oy zIDHR!ahw5&#TtBe|NjSI0V;pIG=PA>Sb!u1WC0>j763rH8{gvPcQK0-h1-e;Dh1Bk zR|=ZfjMei&ry|h>h@^f88^2V^leHoH4&DkcAhc^MzU|2}2(lh(%zU&0nP!x^ofyT} zJI)`hsDRA(O(wiq6l|8D+q;k=~e&^fC~KfYSv(2vQX*0!A! zhs|Z_mm-lmsbjddsTC`KleZGt#%(6UDN8Y6s-=tQ)e(%I$0Zu#$JlAI%uXS24=w(t zR%y9@xgFE5fN9MYF#2Xh@CkGBDVNz20X_nH@ zBd-lkor6g`L6P?dGs2BH&l|2p-sJV>o>)y22NvU?FaQFSI)jd&!sdG`NWkUbGEXUG z)9L|@Hb=7ZS^`8bScG3LO#ihV6fkfUC>Q(Z36fj$r2$|AjsRhs=8t9H?6u9Z0}zF2 zFS9_ur_}vjbd1 zWj|UIl<_HB;o>CuifPnhh+|#FrJ>NR|>L%FwTV_D3u zHTHR=yLLfn+rs__JL!I^*~y-5%6Fyn3jJ52`DRLoC597eXH#=}O&RSO4ZiP-zhL+( z;x~p9H|^I9Bj}qP6aUF@%k(Z2TPEG|i@Ji=|Cv>T|C&`C7K;P1hB#fE;qR<|cK>%9 zv7lcw3Eg56y2&IIfOJYVne}e3lH;hnQ%LB^&MSjAUE3w=dG8%-2InLHtx~g^Gy&e~ zKHFqXIknc@zwP_;Ke<1fgQtmmNAwaFB=~nrq^cQFQ+n5mt*YNP8ljFB7eZ2M@T znMYM2A9eJCe^!j}Yp7?8xJLQ)DER3W(5j9K)cGA)Y5kBQ+b0(xIp6gQ5hIu!^GUJ; z!Qew9yAuoC|7Lb+an(W)&8Bs6s%K@TE(dl<0G_!l;1(FZ9CI0Sze32PhDlvI1`Nl? zZNKZ~q~_Flrh>PJ-?aOZGhd2r_IJh(zw6dXw+&pYj=4Y%`})9_)wAcu4GB*SO>rZ; zNv&%uyJXlB>%|PRE9?wMjdZ%_u+C-2kqtd z?qm4UrtqjJ_YKQ{nlpm7?@uBR#snQotcr{6K7R5Wh6x^UO!zHmLjmN zq>MOZ02qGUIYw)RP?}7mRO>6tu-2bU#}Gn!S;5s7_Pol~$|w9Ltuk*}DygS}0d$SL zr<8VSwJ{w7uT*imB-bfCwEUjT@J9dBvi|EQUOCJxR8w~~OkGea(TFIM^2{B)q3;%+ znu+@Kn3?)r;1^n7N4SNmMbzlqeJCP-|Fl;oC3!8gCg z_%B$3ZFOHoVdenv!wp*h3YaMyUB%(cX43XXMt0vxcr+DoGu+!cotj5X^M>6SD35@z z)u|pcg}x3zIWFN>(E8IH$0DvpmaTqvB1tp4Y!;F$Y^t{wLklc zD^Bn0J4sB@QdYK_dFv`aVb5oF*$asHhrV9jj&+Bi(OZ@Lc+dRdLlf8V&o2`{CdXo5&+zuY6tA5NQa;{C;vUGt5W@d9oU?3@ zFrHKw`l>-!$ktt;KI6PbVc{Uhxf8FHh?d{Q>b7^E`eAj(rd341Q46 zPc1vDsp9MvbAm=_HBrSI_vPV>qb<}MLQL=tqj(Bk50tuxH|RmP@%Y&;W-XGZ+lwl3Rx!`RdkIoAZUpcQdY!jfm7?ZF z%B AFaQ7m literal 0 HcmV?d00001 diff --git a/SPECS/shim-unsigned-x64.spec b/SPECS/shim-unsigned-x64.spec index 6064d69..1bc764c 100644 --- a/SPECS/shim-unsigned-x64.spec +++ b/SPECS/shim-unsigned-x64.spec @@ -19,14 +19,14 @@ %global dbxfile %{nil} Name: shim-unsigned-%{efiarch} -Version: 15.6 -Release: 1.el9 +Version: 15.8 +Release: 2.el9 Summary: First-stage UEFI bootloader ExclusiveArch: x86_64 License: BSD URL: https://github.com/rhboot/shim Source0: https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2 -Source1: redhatsecurebootca5.cer +Source1: vendordb.esl %if 0%{?dbxfile} Source2: %{dbxfile} %endif @@ -103,13 +103,14 @@ mkdir build-%{efialtarch} cp %{SOURCE3} data/ %build -COMMITID=$(cat commit) -MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " +COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6 +MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " +MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 " MAKEFLAGS+="%{_smp_mflags}" if [ -f "%{SOURCE1}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" + MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1}" fi %if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then @@ -124,16 +125,17 @@ make ${MAKEFLAGS} \ cd .. %install -COMMITID=$(cat commit) -MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " +COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6 +MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " +MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 " if [ -f "%{SOURCE1}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" + MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1} " fi %if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}" + MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2} " fi %endif @@ -158,9 +160,19 @@ cd .. %files debugsource -f build-%{efiarch}/debugsource.list %changelog +* Wed Feb 07 2024 Peter Jones - 15.8-2.el9 +- Rebuild to fix the commit ident and MAKEFLAGS + Resolves: RHEL-11262 + +* Tue Jan 23 2024 Peter Jones - 15.8-1.el9 +- Update to shim-15.8 for CVE-2023-40547 + Resolves: RHEL-11262 + * Wed Jun 01 2022 Peter Jones - 15.6-1.el9 -- Update to shim-15.6 - Resolves: CVE-2022-28737 +- Update to shim-15.6 for CVE-2022-28737 + +* Tue May 24 2022 Peter Jones - 15.6~rc1-1.el9 +- Update to shim-15.6~rc1 for CVE-2022-28737 * Wed Mar 09 2022 Peter Jones - 15.5-1 - Update to shim-15.5