Compare commits

..

No commits in common. "c9-beta" and "c8" have entirely different histories.
c9-beta ... c8

7 changed files with 125 additions and 127 deletions

3
.gitignore vendored
View File

@ -1 +1,2 @@
SOURCES/shim-15.6.tar.bz2 SOURCES/redhatsecurebootca5.cer
SOURCES/shim-15.8.tar.bz2

View File

@ -1 +1,2 @@
3df0ab5cefc74fdf865cb36aea0e923cb4b6b3ed SOURCES/shim-15.6.tar.bz2 e6f506462069aa17d2e8610503635c20f3a995c3 SOURCES/redhatsecurebootca5.cer
cdec924ca437a4509dcb178396996ddf92c11183 SOURCES/shim-15.8.tar.bz2

0
SOURCES/dbx.esl Normal file
View File

Binary file not shown.

View File

@ -1 +1 @@
shim.redhat,1,Red Hat Inc,shim,15.5,secalert@redhat.com shim.redhat,3,Red Hat Inc,shim,15.8,secalert@redhat.com

1 shim.redhat 1 3 Red Hat Inc shim 15.5 15.8 secalert@redhat.com

View File

@ -20,9 +20,9 @@ fi
findsource() findsource()
{ {
( (
cd "${RPM_BUILD_ROOT}" cd ${RPM_BUILD_ROOT}
find usr/src/debug/ -type d | sed -e "s,^,%dir /," | sort -u | tac find usr/src/debug/ -type d | sed "s,^,%dir /,"
find usr/src/debug/ -type f | sed -e "s,^,/," | sort -u | tac find usr/src/debug/ -type f | sed "s,^,/,"
) )
} }
@ -32,12 +32,9 @@ finddebug()
declare -a dirs=() declare -a dirs=()
declare -a files=() declare -a files=()
declare -a excludes=() declare -a excludes=()
declare -a tmp=()
pushd "${RPM_BUILD_ROOT}" >/dev/null 2>&1 pushd ${RPM_BUILD_ROOT} >/dev/null 2>&1
for x in $(find usr/lib/debug/ -type f -iname *.efi.debug); do
mapfile -t tmp < <(find usr/lib/debug/ -type f -iname "*.efi.debug")
for x in "${tmp[@]}" ; do
if ! [ -e "${x}" ]; then if ! [ -e "${x}" ]; then
break break
fi fi
@ -60,10 +57,8 @@ finddebug()
excludes[${#excludes[@]}]=${x%%.debug} excludes[${#excludes[@]}]=${x%%.debug}
fi fi
done done
for x in "${files[@]}" ; do for x in ${files[@]} ; do
declare name declare name=$(dirname /${x})
name=$(dirname "/${x}")
while [ "${name}" != "/" ]; do while [ "${name}" != "/" ]; do
case "${name}" in case "${name}" in
"/usr/lib/debug"|"/usr/lib"|"/usr") "/usr/lib/debug"|"/usr/lib"|"/usr")
@ -72,24 +67,24 @@ finddebug()
dirs[${#dirs[@]}]=${name} dirs[${#dirs[@]}]=${name}
;; ;;
esac esac
name=$(dirname "${name}") name=$(dirname ${name})
done done
done done
popd >/dev/null 2>&1 popd >/dev/null 2>&1
for x in "${dirs[@]}" ; do for x in ${dirs[@]} ; do
echo "%dir ${x}" echo "%dir ${x}"
done | sort | uniq done | sort | uniq
for x in "${files[@]}" ; do for x in ${files[@]} ; do
echo "/${x}" echo "/${x}"
done | sort | uniq done | sort | uniq
for x in "${excludes[@]}" ; do for x in ${excludes[@]} ; do
echo "%exclude /${x}" echo "%exclude /${x}"
done done
} }
findsource > "build-${mainarch}/debugsource.list" findsource > build-${mainarch}/debugsource.list
finddebug "${mainarch}" > "build-${mainarch}/debugfiles.list" finddebug ${mainarch} > build-${mainarch}/debugfiles.list
if [ -v altarch ]; then if [ -v altarch ]; then
finddebug "${altarch}" > "build-${altarch}/debugfiles.list" finddebug ${altarch} > build-${altarch}/debugfiles.list
fi fi

View File

@ -1,6 +1,13 @@
%global pesign_vre 0.106-1 %global pesign_vre 0.106-1
%global gnuefi_vre 1:3.0.5-6
%global openssl_vre 1.0.2j %global openssl_vre 1.0.2j
%global debug_package %{nil}
%global __debug_package 1
%global _binaries_in_noarch_packages_terminate_build 0
%global __debug_install_post %{SOURCE100} x64 ia32
%undefine _debuginfo_subpackages
%global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/')) %global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/'))
%global shimrootdir %{_datadir}/shim/ %global shimrootdir %{_datadir}/shim/
%global shimversiondir %{shimrootdir}/%{version}-%{release} %global shimversiondir %{shimrootdir}/%{version}-%{release}
@ -9,27 +16,18 @@
%global efialtarch ia32 %global efialtarch ia32
%global shimaltdir %{shimversiondir}/%{efialtarch} %global shimaltdir %{shimversiondir}/%{efialtarch}
%global debug_package %{nil}
%global __debug_package 1
%global _binaries_in_noarch_packages_terminate_build 0
%global __debug_install_post %{SOURCE100} %{efiarch} %{efialtarch}
%undefine _debuginfo_subpackages
# currently here's what's in our dbx: nothing
%global dbxfile %{nil}
Name: shim-unsigned-%{efiarch} Name: shim-unsigned-%{efiarch}
Version: 15.6 Version: 15.8
Release: 1.el9 Release: 2.el8
Summary: First-stage UEFI bootloader Summary: First-stage UEFI bootloader
ExclusiveArch: x86_64 ExclusiveArch: x86_64
License: BSD License: BSD
URL: https://github.com/rhboot/shim URL: https://github.com/rhboot/shim
Source0: https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2 Source0: https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2
Source1: redhatsecurebootca5.cer Source1: redhatsecurebootca5.cer
%if 0%{?dbxfile} # currently here's what's in our dbx:
Source2: %{dbxfile} # nothing.
%endif Source2: dbx.esl
Source3: sbat.redhat.csv Source3: sbat.redhat.csv
Source4: shim.patches Source4: shim.patches
@ -69,6 +67,7 @@ Provides: bundled(openssl) = %{openssl_vre}
%package debuginfo %package debuginfo
Summary: Debug information for shim-unsigned-%{efiarch} Summary: Debug information for shim-unsigned-%{efiarch}
Requires: %{name}-debugsource = %{version}-%{release}
Group: Development/Debug Group: Development/Debug
AutoReqProv: 0 AutoReqProv: 0
BuildArch: noarch BuildArch: noarch
@ -79,6 +78,7 @@ BuildArch: noarch
%package -n shim-unsigned-%{efialtarch}-debuginfo %package -n shim-unsigned-%{efialtarch}-debuginfo
Summary: Debug information for shim-unsigned-%{efialtarch} Summary: Debug information for shim-unsigned-%{efialtarch}
Group: Development/Debug Group: Development/Debug
Requires: %{name}-debugsource = %{version}-%{release}
AutoReqProv: 0 AutoReqProv: 0
BuildArch: noarch BuildArch: noarch
@ -103,19 +103,18 @@ mkdir build-%{efialtarch}
cp %{SOURCE3} data/ cp %{SOURCE3} data/
%build %build
COMMITID=$(cat commit) COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
MAKEFLAGS+="ENABLE_SHIM_HASH=true " MAKEFLAGS+="ENABLE_SHIM_HASH=true "
MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 "
MAKEFLAGS+="%{_smp_mflags}" MAKEFLAGS+="%{_smp_mflags}"
if [ -f "%{SOURCE1}" ]; then if [ -s "%{SOURCE1}" ]; then
MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "
fi fi
%if 0%{?dbxfile} if [ -s "%{SOURCE2}" ]; then
if [ -f "%{SOURCE2}" ]; then MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2} "
MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}"
fi fi
%endif
cd build-%{efiarch} cd build-%{efiarch}
make ${MAKEFLAGS} \ make ${MAKEFLAGS} \
@ -123,19 +122,24 @@ make ${MAKEFLAGS} \
all all
cd .. cd ..
cd build-%{efialtarch}
setarch linux32 -B make ${MAKEFLAGS} ARCH=%{efialtarch} \
DEFAULT_LOADER='\\\\grub%{efialtarch}.efi' \
all
cd ..
%install %install
COMMITID=$(cat commit) COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
MAKEFLAGS+="ENABLE_SHIM_HASH=true " MAKEFLAGS+="ENABLE_HTTPBOOT=true ENABLE_SHIM_HASH=true "
if [ -f "%{SOURCE1}" ]; then MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2023012900 "
MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" if [ -s "%{SOURCE1}" ]; then
MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "
fi fi
%if 0%{?dbxfile} if [ -s "%{SOURCE2}" ]; then
if [ -f "%{SOURCE2}" ]; then MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2} "
MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}"
fi fi
%endif
cd build-%{efiarch} cd build-%{efiarch}
make ${MAKEFLAGS} \ make ${MAKEFLAGS} \
@ -144,85 +148,89 @@ make ${MAKEFLAGS} \
install-as-data install-debuginfo install-debugsource install-as-data install-debuginfo install-debugsource
cd .. cd ..
cd build-%{efialtarch}
setarch linux32 make ${MAKEFLAGS} ARCH=%{efialtarch} \
DEFAULT_LOADER='\\\\grub%{efialtarch}.efi' \
DESTDIR=${RPM_BUILD_ROOT} \
install-as-data install-debuginfo install-debugsource
cd ..
%files %files
%license COPYRIGHT %license COPYRIGHT
%dir %{shimrootdir} %dir %{shimrootdir}
%dir %{shimversiondir} %dir %{shimversiondir}
%dir %{shimdir} %dir %{shimdir}
%{shimdir}/*.CSV
%{shimdir}/*.efi %{shimdir}/*.efi
%{shimdir}/*.hash %{shimdir}/*.hash
%{shimdir}/*.CSV
%files -n shim-unsigned-%{efialtarch}
%license COPYRIGHT
%dir %{shimrootdir}
%dir %{shimversiondir}
%dir %{shimaltdir}
%{shimaltdir}/*.CSV
%{shimaltdir}/*.efi
%{shimaltdir}/*.hash
%files debuginfo -f build-%{efiarch}/debugfiles.list %files debuginfo -f build-%{efiarch}/debugfiles.list
%files -n shim-unsigned-%{efialtarch}-debuginfo -f build-%{efialtarch}/debugfiles.list
%files debugsource -f build-%{efiarch}/debugsource.list %files debugsource -f build-%{efiarch}/debugsource.list
%changelog %changelog
* Wed Jun 01 2022 Peter Jones <pjones@redhat.com> - 15.6-1.el9 * Wed Feb 07 2024 Peter Jones <pjones@redhat.com> - 15.8-2.el8
- Rebuild to fix the commit ident and MAKEFLAGS
Resolves: RHEL-11259
* Tue Dec 05 2023 Peter Jones <pjones@redhat.com> - 15.8-1.el8
- Update to shim-15.8 for CVE-2023-40547
Resolves: RHEL-11259
* Wed Jun 01 2022 Peter Jones <pjones@redhat.com> - 15.6-1.el8
- Update to shim-15.6 - Update to shim-15.6
Resolves: CVE-2022-28737 Resolves: CVE-2022-28737
* Wed Mar 09 2022 Peter Jones <pjones@redhat.com> - 15.5-1 * Thu Sep 17 2020 Peter Jones <pjones@redhat.com> - 15-9.el8
- Update to shim-15.5 - Fix an incorrect allocation size.
Related: rhbz#1932057 Related: rhbz#1877253
* Thu Apr 01 2021 Peter Jones <pjones@redhat.com> - 15.4-4 * Thu Jul 30 2020 Peter Jones <pjones@redhat.com> - 15-8
- Fix the sbat data to actually match /this/ product. - Fix a load-address-dependent forever loop.
Resolves: CVE-2020-14372 Resolves: rhbz#1861977
Resolves: CVE-2020-25632 Related: CVE-2020-10713
Resolves: CVE-2020-25647 Related: CVE-2020-14308
Resolves: CVE-2020-27749 Related: CVE-2020-14309
Resolves: CVE-2020-27779 Related: CVE-2020-14310
Resolves: CVE-2021-20225 Related: CVE-2020-14311
Resolves: CVE-2021-20233 Related: CVE-2020-15705
Related: CVE-2020-15706
Related: CVE-2020-15707
* Wed Mar 31 2021 Peter Jones <pjones@redhat.com> - 15.4-3 * Sat Jul 25 2020 Peter Jones <pjones@redhat.com> - 15-7
- Build with the correct certificate trust list for this OS. - Implement Lenny's workaround
Resolves: CVE-2020-14372 Related: CVE-2020-10713
Resolves: CVE-2020-25632 Related: CVE-2020-14308
Resolves: CVE-2020-25647 Related: CVE-2020-14309
Resolves: CVE-2020-27749 Related: CVE-2020-14310
Resolves: CVE-2020-27779 Related: CVE-2020-14311
Resolves: CVE-2021-20225
Resolves: CVE-2021-20233
* Wed Mar 31 2021 Peter Jones <pjones@redhat.com> - 15.4-2 * Fri Jul 24 2020 Peter Jones <pjones@redhat.com> - 15-5
- Fix the ia32 build. - Once more with the MokListRT config table patch added.
Resolves: CVE-2020-14372 Related: CVE-2020-10713
Resolves: CVE-2020-25632 Related: CVE-2020-14308
Resolves: CVE-2020-25647 Related: CVE-2020-14309
Resolves: CVE-2020-27749 Related: CVE-2020-14310
Resolves: CVE-2020-27779 Related: CVE-2020-14311
Resolves: CVE-2021-20225
Resolves: CVE-2021-20233
* Tue Mar 30 2021 Peter Jones <pjones@redhat.com> - 15.4-1 * Thu Jul 23 2020 Peter Jones <pjones@redhat.com> - 15-4
- Update to shim 15.4 - Rebuild for bug fixes and new signing keys
- Support for revocations via the ".sbat" section and SBAT EFI variable Related: CVE-2020-10713
- A new unit test framework and a bunch of unit tests Related: CVE-2020-14308
- No external gnu-efi dependency Related: CVE-2020-14309
- Better CI Related: CVE-2020-14310
Resolves: CVE-2020-14372 Related: CVE-2020-14311
Resolves: CVE-2020-25632
Resolves: CVE-2020-25647
Resolves: CVE-2020-27749
Resolves: CVE-2020-27779
Resolves: CVE-2021-20225
Resolves: CVE-2021-20233
* Wed Mar 24 2021 Peter Jones <pjones@redhat.com> - 15.3-0~1
- Update to shim 15.3
- Support for revocations via the ".sbat" section and SBAT EFI variable
- A new unit test framework and a bunch of unit tests
- No external gnu-efi dependency
- Better CI
Resolves: CVE-2020-14372
Resolves: CVE-2020-25632
Resolves: CVE-2020-25647
Resolves: CVE-2020-27749
Resolves: CVE-2020-27779
Resolves: CVE-2021-20225
Resolves: CVE-2021-20233
* Wed Jun 05 2019 Javier Martinez Canillas <javierm@redhat.com> - 15-3 * Wed Jun 05 2019 Javier Martinez Canillas <javierm@redhat.com> - 15-3
- Make EFI variable copying fatal only on secureboot enabled systems - Make EFI variable copying fatal only on secureboot enabled systems
@ -234,24 +242,17 @@ cd ..
- Fix MoK mirroring issue which breaks kdump without intervention - Fix MoK mirroring issue which breaks kdump without intervention
Related: rhbz#1668966 Related: rhbz#1668966
* Thu Apr 05 2018 Peter Jones <pjones@redhat.com> - 15-1 * Fri Jul 20 2018 Peter Jones <pjones@redhat.com> - 15-1
- Update to shim 15 - Update to shim 15
- better checking for bad linker output
- flicker-free console if there's no error output
- improved http boot support
- better protocol re-installation
- dhcp proxy support
- tpm measurement even when verification is disabled
- REQUIRE_TPM build flag
- more reproducable builds
- measurement of everything verified through shim_verify()
- coverity and scan-build checker make targets
- misc cleanups
* Fri Feb 09 2018 Fedora Release Engineering <releng@fedoraproject.org> - 13-0.2 * Tue Sep 19 2017 Peter Jones <pjones@redhat.com> - 13-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - Actually update to the *real* 13 final.
Related: rhbz#1489604
* Fri Aug 18 2017 Peter Jones <pjones@redhat.com> - 13-0.1 * Thu Aug 31 2017 Peter Jones <pjones@redhat.com> - 13-2
- Actually update to 13 final.
* Fri Aug 18 2017 Peter Jones <pjones@redhat.com> - 13-1
- Make a new shim-unsigned-x64 package like the shim-unsigned-aarch64 one. - Make a new shim-unsigned-x64 package like the shim-unsigned-aarch64 one.
- This will (eventually) supersede what's in the "shim" package so we can - This will (eventually) supersede what's in the "shim" package so we can
make "shim" hold the signed one, which will confuse fewer people. make "shim" hold the signed one, which will confuse fewer people.