import shim-unsigned-x64-15.8-2.el8

import shim-unsigned-x64-15.6-1.el8
import shim-unsigned-x64-15.5-1.el8
2024-02-27 15:07:17 +00:00 · 2022-06-16 13:12:19 +00:00 · 2022-05-10 11:51:43 +00:00
8 changed files with 127 additions and 132 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +1,2 @@
-SOURCES/shim-15.6.tar.bz2
+SOURCES/redhatsecurebootca5.cer
+SOURCES/shim-15.8.tar.bz2
--- a/.shim-unsigned-x64.metadata
+++ b/.shim-unsigned-x64.metadata
@ -1 +1,2 @@
-3df0ab5cefc74fdf865cb36aea0e923cb4b6b3ed SOURCES/shim-15.6.tar.bz2
+e6f506462069aa17d2e8610503635c20f3a995c3 SOURCES/redhatsecurebootca5.cer
+cdec924ca437a4509dcb178396996ddf92c11183 SOURCES/shim-15.8.tar.bz2
--- a/SOURCES/dbx.esl
+++ b/SOURCES/dbx.esl
--- a/SOURCES/sbat.almalinux.csv
+++ b/SOURCES/sbat.almalinux.csv
@ -1 +0,0 @@
-shim.almalinux,2,AlmaLinux,shim,15.6,security@almalinux.org
--- a/SOURCES/sbat.redhat.csv
+++ b/SOURCES/sbat.redhat.csv
@ -0,0 +1 @@
+shim.redhat,3,Red Hat Inc,shim,15.8,secalert@redhat.com
--- a/SOURCES/shim-find-debuginfo.sh
+++ b/SOURCES/shim-find-debuginfo.sh
@ -20,9 +20,9 @@ fi
 findsource()
 {
    (
-        cd "${RPM_BUILD_ROOT}"
-        find usr/src/debug/ -type d | sed -e "s,^,%dir /," | sort -u | tac
-        find usr/src/debug/ -type f | sed -e "s,^,/," | sort -u | tac
+        cd ${RPM_BUILD_ROOT}
+        find usr/src/debug/ -type d | sed "s,^,%dir /,"
+        find usr/src/debug/ -type f | sed "s,^,/,"
    )
 }

@ -32,12 +32,9 @@ finddebug()
    declare -a dirs=()
    declare -a files=()
    declare -a excludes=()
-    declare -a tmp=()

-    pushd "${RPM_BUILD_ROOT}" >/dev/null 2>&1
-
-    mapfile -t tmp < <(find usr/lib/debug/ -type f -iname "*.efi.debug")
-    for x in "${tmp[@]}" ; do
+    pushd ${RPM_BUILD_ROOT} >/dev/null 2>&1
+    for x in $(find usr/lib/debug/ -type f -iname *.efi.debug); do
        if ! [ -e "${x}" ]; then
            break
        fi
@ -60,10 +57,8 @@ finddebug()
            excludes[${#excludes[@]}]=${x%%.debug}
        fi
    done
-    for x in "${files[@]}" ; do
-        declare name
-
-        name=$(dirname "/${x}")
+    for x in ${files[@]} ; do
+        declare name=$(dirname /${x})
        while [ "${name}" != "/" ]; do
            case "${name}" in
            "/usr/lib/debug"|"/usr/lib"|"/usr")
@ -72,24 +67,24 @@ finddebug()
                dirs[${#dirs[@]}]=${name}
                ;;
            esac
-            name=$(dirname "${name}")
+            name=$(dirname ${name})
        done
    done

    popd >/dev/null 2>&1
-    for x in "${dirs[@]}" ; do
+    for x in ${dirs[@]} ; do
        echo "%dir ${x}"
    done | sort | uniq
-    for x in "${files[@]}" ; do
+    for x in ${files[@]} ; do
        echo "/${x}"
    done | sort | uniq
-    for x in "${excludes[@]}" ; do
+    for x in ${excludes[@]} ; do
        echo "%exclude /${x}"
    done
 }

-findsource > "build-${mainarch}/debugsource.list"
-finddebug "${mainarch}" > "build-${mainarch}/debugfiles.list"
+findsource > build-${mainarch}/debugsource.list
+finddebug ${mainarch} > build-${mainarch}/debugfiles.list
 if [ -v altarch ]; then
-    finddebug "${altarch}" > "build-${altarch}/debugfiles.list"
+    finddebug ${altarch} > build-${altarch}/debugfiles.list
 fi
--- a/SOURCES/vendor_db.esl
+++ b/SOURCES/vendor_db.esl
--- a/SPECS/shim-unsigned-x64.spec
+++ b/SPECS/shim-unsigned-x64.spec
@ -1,7 +1,14 @@
 %global pesign_vre 0.106-1
+%global gnuefi_vre 1:3.0.5-6
 %global openssl_vre 1.0.2j

-%global efidir almalinux
+%global debug_package %{nil}
+%global __debug_package 1
+%global _binaries_in_noarch_packages_terminate_build 0
+%global __debug_install_post %{SOURCE100} x64 ia32
+%undefine _debuginfo_subpackages
+
+%global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/'))
 %global shimrootdir %{_datadir}/shim/
 %global shimversiondir %{shimrootdir}/%{version}-%{release}
 %global efiarch x64
@ -9,28 +16,19 @@
 %global efialtarch ia32
 %global shimaltdir %{shimversiondir}/%{efialtarch}

-%global debug_package %{nil}
-%global __debug_package 1
-%global _binaries_in_noarch_packages_terminate_build 0
-%global __debug_install_post %{SOURCE100} %{efiarch} %{efialtarch}
-%undefine _debuginfo_subpackages
-
-# currently here's what's in our dbx: nothing
-%global dbxfile %{nil}
-
 Name:		shim-unsigned-%{efiarch}
-Version:	15.6
-Release:	1.el9.alma.1
+Version:	15.8
+Release:	2.el8
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	x86_64
 License:	BSD
 URL:		https://github.com/rhboot/shim
 Source0:	https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2
-Source1:	vendor_db.esl
-%if 0%{?dbxfile}
-Source2:	%{dbxfile}
-%endif
-Source3:	sbat.almalinux.csv
+Source1:	redhatsecurebootca5.cer
+# currently here's what's in our dbx:
+# nothing.
+Source2:	dbx.esl
+Source3:	sbat.redhat.csv
 Source4:	shim.patches

 Source100:	shim-find-debuginfo.sh
@ -69,6 +67,7 @@ Provides:	bundled(openssl) = %{openssl_vre}

 %package debuginfo
 Summary:	Debug information for shim-unsigned-%{efiarch}
+Requires:	%{name}-debugsource = %{version}-%{release}
 Group:		Development/Debug
 AutoReqProv:	0
 BuildArch:	noarch
@ -79,6 +78,7 @@ BuildArch:	noarch
 %package -n shim-unsigned-%{efialtarch}-debuginfo
 Summary:	Debug information for shim-unsigned-%{efialtarch}
 Group:		Development/Debug
+Requires:	%{name}-debugsource = %{version}-%{release}
 AutoReqProv:	0
 BuildArch:	noarch

@ -103,19 +103,18 @@ mkdir build-%{efialtarch}
 cp %{SOURCE3} data/

 %build
-COMMITID=$(cat commit)
-MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} "
+COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
+MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 "
 MAKEFLAGS+="%{_smp_mflags}"
-if [ -f "%{SOURCE1}" ]; then
-	MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1}"
+if [ -s "%{SOURCE1}" ]; then
+	MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "
 fi
-%if 0%{?dbxfile}
-if [ -f "%{SOURCE2}" ]; then
-	MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}"
+if [ -s "%{SOURCE2}" ]; then
+	MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2} "
 fi
-%endif

 cd build-%{efiarch}
 make ${MAKEFLAGS} \
@ -123,19 +122,24 @@ make ${MAKEFLAGS} \
 	all
 cd ..

+cd build-%{efialtarch}
+setarch linux32 -B make ${MAKEFLAGS} ARCH=%{efialtarch} \
+	DEFAULT_LOADER='\\\\grub%{efialtarch}.efi' \
+	all
+cd ..
+
 %install
-COMMITID=$(cat commit)
-MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} "
+COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
-MAKEFLAGS+="ENABLE_SHIM_HASH=true "
-if [ -f "%{SOURCE1}" ]; then
-	MAKEFLAGS="$MAKEFLAGS VENDOR_DB_FILE=%{SOURCE1}"
+MAKEFLAGS+="ENABLE_HTTPBOOT=true ENABLE_SHIM_HASH=true "
+MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 "
+if [ -s "%{SOURCE1}" ]; then
+	MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "
 fi
-%if 0%{?dbxfile}
-if [ -f "%{SOURCE2}" ]; then
-	MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}"
+if [ -s "%{SOURCE2}" ]; then
+	MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2} "
 fi
-%endif

 cd build-%{efiarch}
 make ${MAKEFLAGS} \
@ -144,88 +148,89 @@ make ${MAKEFLAGS} \
 	install-as-data install-debuginfo install-debugsource
 cd ..

+cd build-%{efialtarch}
+setarch linux32 make ${MAKEFLAGS} ARCH=%{efialtarch} \
+	DEFAULT_LOADER='\\\\grub%{efialtarch}.efi' \
+	DESTDIR=${RPM_BUILD_ROOT} \
+	install-as-data install-debuginfo install-debugsource
+cd ..
+
 %files
 %license COPYRIGHT
 %dir %{shimrootdir}
 %dir %{shimversiondir}
 %dir %{shimdir}
+%{shimdir}/*.CSV
 %{shimdir}/*.efi
 %{shimdir}/*.hash
-%{shimdir}/*.CSV
+
+%files -n shim-unsigned-%{efialtarch}
+%license COPYRIGHT
+%dir %{shimrootdir}
+%dir %{shimversiondir}
+%dir %{shimaltdir}
+%{shimaltdir}/*.CSV
+%{shimaltdir}/*.efi
+%{shimaltdir}/*.hash

 %files debuginfo -f build-%{efiarch}/debugfiles.list

+%files -n shim-unsigned-%{efialtarch}-debuginfo -f build-%{efialtarch}/debugfiles.list
+
 %files debugsource -f build-%{efiarch}/debugsource.list

 %changelog
-* Thu Mar 09 2023 Eduard Abdullin <eabdullin@almalinux.org> - 15.6-1.el9.alma.1
- Use AlmaLinux vendor cert and SBAT entry
+* Wed Feb 07 2024 Peter Jones <pjones@redhat.com> - 15.8-2.el8
+- Rebuild to fix the commit ident and MAKEFLAGS
+  Resolves: RHEL-11259

-* Wed Jun 01 2022 Peter Jones <pjones@redhat.com> - 15.6-1.el9
+* Tue Dec 05 2023 Peter Jones <pjones@redhat.com> - 15.8-1.el8
+- Update to shim-15.8 for CVE-2023-40547
+  Resolves: RHEL-11259
+
+* Wed Jun 01 2022 Peter Jones <pjones@redhat.com> - 15.6-1.el8
 - Update to shim-15.6
  Resolves: CVE-2022-28737

-* Wed Mar 09 2022 Peter Jones <pjones@redhat.com> - 15.5-1
- Update to shim-15.5
-  Related: rhbz#1932057
+* Thu Sep 17 2020 Peter Jones <pjones@redhat.com> - 15-9.el8
+- Fix an incorrect allocation size.
+  Related: rhbz#1877253

-* Thu Apr 01 2021 Peter Jones <pjones@redhat.com> - 15.4-4
- Fix the sbat data to actually match /this/ product.
-  Resolves: CVE-2020-14372
-  Resolves: CVE-2020-25632
-  Resolves: CVE-2020-25647
-  Resolves: CVE-2020-27749
-  Resolves: CVE-2020-27779
-  Resolves: CVE-2021-20225
-  Resolves: CVE-2021-20233
+* Thu Jul 30 2020 Peter Jones <pjones@redhat.com> - 15-8
+- Fix a load-address-dependent forever loop.
+  Resolves: rhbz#1861977
+  Related: CVE-2020-10713
+  Related: CVE-2020-14308
+  Related: CVE-2020-14309
+  Related: CVE-2020-14310
+  Related: CVE-2020-14311
+  Related: CVE-2020-15705
+  Related: CVE-2020-15706
+  Related: CVE-2020-15707

-* Wed Mar 31 2021 Peter Jones <pjones@redhat.com> - 15.4-3
- Build with the correct certificate trust list for this OS.
-  Resolves: CVE-2020-14372
-  Resolves: CVE-2020-25632
-  Resolves: CVE-2020-25647
-  Resolves: CVE-2020-27749
-  Resolves: CVE-2020-27779
-  Resolves: CVE-2021-20225
-  Resolves: CVE-2021-20233
+* Sat Jul 25 2020 Peter Jones <pjones@redhat.com> - 15-7
+- Implement Lenny's workaround
+  Related: CVE-2020-10713
+  Related: CVE-2020-14308
+  Related: CVE-2020-14309
+  Related: CVE-2020-14310
+  Related: CVE-2020-14311

-* Wed Mar 31 2021 Peter Jones <pjones@redhat.com> - 15.4-2
- Fix the ia32 build.
-  Resolves: CVE-2020-14372
-  Resolves: CVE-2020-25632
-  Resolves: CVE-2020-25647
-  Resolves: CVE-2020-27749
-  Resolves: CVE-2020-27779
-  Resolves: CVE-2021-20225
-  Resolves: CVE-2021-20233
+* Fri Jul 24 2020 Peter Jones <pjones@redhat.com> - 15-5
+- Once more with the MokListRT config table patch added.
+  Related: CVE-2020-10713
+  Related: CVE-2020-14308
+  Related: CVE-2020-14309
+  Related: CVE-2020-14310
+  Related: CVE-2020-14311

-* Tue Mar 30 2021 Peter Jones <pjones@redhat.com> - 15.4-1
- Update to shim 15.4
-  - Support for revocations via the ".sbat" section and SBAT EFI variable
-  - A new unit test framework and a bunch of unit tests
-  - No external gnu-efi dependency
-  - Better CI
-  Resolves: CVE-2020-14372
-  Resolves: CVE-2020-25632
-  Resolves: CVE-2020-25647
-  Resolves: CVE-2020-27749
-  Resolves: CVE-2020-27779
-  Resolves: CVE-2021-20225
-  Resolves: CVE-2021-20233
-
-* Wed Mar 24 2021 Peter Jones <pjones@redhat.com> - 15.3-0~1
- Update to shim 15.3
-  - Support for revocations via the ".sbat" section and SBAT EFI variable
-  - A new unit test framework and a bunch of unit tests
-  - No external gnu-efi dependency
-  - Better CI
-  Resolves: CVE-2020-14372
-  Resolves: CVE-2020-25632
-  Resolves: CVE-2020-25647
-  Resolves: CVE-2020-27749
-  Resolves: CVE-2020-27779
-  Resolves: CVE-2021-20225
-  Resolves: CVE-2021-20233
+* Thu Jul 23 2020 Peter Jones <pjones@redhat.com> - 15-4
+- Rebuild for bug fixes and new signing keys
+  Related: CVE-2020-10713
+  Related: CVE-2020-14308
+  Related: CVE-2020-14309
+  Related: CVE-2020-14310
+  Related: CVE-2020-14311

 * Wed Jun 05 2019 Javier Martinez Canillas <javierm@redhat.com> - 15-3
 - Make EFI variable copying fatal only on secureboot enabled systems
@ -237,24 +242,17 @@ cd ..
 - Fix MoK mirroring issue which breaks kdump without intervention
  Related: rhbz#1668966

-* Thu Apr 05 2018 Peter Jones <pjones@redhat.com> - 15-1
+* Fri Jul 20 2018 Peter Jones <pjones@redhat.com> - 15-1
 - Update to shim 15
- better checking for bad linker output
- flicker-free console if there's no error output
- improved http boot support
- better protocol re-installation
- dhcp proxy support
- tpm measurement even when verification is disabled
- REQUIRE_TPM build flag
- more reproducable builds
- measurement of everything verified through shim_verify()
- coverity and scan-build checker make targets
- misc cleanups

-* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 13-0.2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+* Tue Sep 19 2017 Peter Jones <pjones@redhat.com> - 13-3
+- Actually update to the *real* 13 final.
+  Related: rhbz#1489604

-* Fri Aug 18 2017 Peter Jones <pjones@redhat.com> - 13-0.1
+* Thu Aug 31 2017 Peter Jones <pjones@redhat.com> - 13-2
+- Actually update to 13 final.
+
+* Fri Aug 18 2017 Peter Jones <pjones@redhat.com> - 13-1
 - Make a new shim-unsigned-x64 package like the shim-unsigned-aarch64 one.
 - This will (eventually) supersede what's in the "shim" package so we can
  make "shim" hold the signed one, which will confuse fewer people.
Author	SHA1	Message	Date
Andrew Lukoshko	9e33a296d6	import shim-unsigned-x64-15.8-2.el8	2024-02-27 15:07:17 +00:00
CentOS Sources	d3b5b82bbe	import shim-unsigned-x64-15.6-1.el8	2022-06-16 13:12:19 +00:00
CentOS Sources	c4b36b74dd	import shim-unsigned-x64-15.5-1.el8	2022-05-10 11:51:43 +00:00
				`@ -1 +0,0 @@`
				`shim.almalinux,2,AlmaLinux,shim,15.6,security@almalinux.org`
				`@ -0,0 +1 @@`
				`shim.redhat,3,Red Hat Inc,shim,15.8,secalert@redhat.com`