From b32c40b4cbdcfd4544605379dafb32b429bcaac4 Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Tue, 1 Jul 2025 18:10:58 +0200 Subject: [PATCH] First build for Centos Stream 10 Resolves: #RHEL-45014 Signed-off-by: Nicolas Frayer --- .gitignore | 8 ++ centossecureboot201.cer | Bin 0 -> 914 bytes centossecurebootca2.cer | Bin 0 -> 870 bytes shim.conf | 4 + shim.rpmmacros | 201 ++++++++++++++++++++++++++++++++++++++++ shim.spec | 114 +++++++++++++++++++++++ sources | 8 ++ 7 files changed, 335 insertions(+) create mode 100644 centossecureboot201.cer create mode 100644 centossecurebootca2.cer create mode 100644 shim.conf create mode 100644 shim.rpmmacros create mode 100644 shim.spec create mode 100644 sources diff --git a/.gitignore b/.gitignore index e69de29..59c1072 100644 --- a/.gitignore +++ b/.gitignore @@ -0,0 +1,8 @@ +/shimx64.efi +/fbx64.efi +/mmx64.efi +/BOOTX64.CSV +/BOOTAA64.CSV +/fbaa64.efi +/mmaa64.efi +/shimaa64.efi diff --git a/centossecureboot201.cer b/centossecureboot201.cer new file mode 100644 index 0000000000000000000000000000000000000000..ca3c13440363bdc4aabe8c0b2da7116624b0cf45 GIT binary patch literal 914 zcmXqLV(v3&Vk%p}%*4pV#K|!E5X+6d<=KJ;ylk9WZ60mkc^MhGSs4u63>6II*qB3E zn0dsVQ}asvgB5~PlS_+I6`b<(OB9?P6^sm(3>4s+I2px+i$Mx9ODY|bfg19Q_413- z4dldmjSLLT3@i-|3`~p+qQrTPEes3|EudTjUqf{RRfs)uSnLVTOwY^AOII)g>LJFu zCPpP>pD?mAFgG#sGZ-{6axpbAGBV72|F2AD{%pHXPmXHtl{8|E{QPX@uh(0DOyQYo zl^VCP=t6*9K}wg@#c#grbHm>`6gqI;HQ;Gn*sYc<#J>OGMc4VWIhTdcnD>7A%e@&E zuT~{b(&N?d`@OHjVRq!>J=^mi@6MLXoA)k!hsLq1*Y>+Fdug$p&b%Jz0vh|b&SQ>{w{ z#LgO|yt=Ahr~K{Do6MEY`W405#ueQ^LT=lio4O>5WtOPtjI$;+$9q)%v=-g|p?&o+tnU+hfGj0}v6D-6mEcz}T}E6m9F zpM}YQ!GI6M;|K9rn3>oc48%ZuRS=)YfQyYon~jl`m7ST{Ko%s<$0Eie66>Av=~uE` zT>R}-cSO>U<;+y9QZkSSNh`BR7>G596fo4!RG1@_{m{MS)tl*gnJPH0C_xHAtq;fu2fXH9}nxE~qKXaqkvoD=uBHhCN<>P{T zXNucr8XlgUc3{sZ{!N*weYbW>^{ulA`&<*%tI2D-w&i)7;i5jR6+eD_Z#PPfZFCRb z;c!%XxtsikgymbNcLu82+;iJ0a&iLMJHkvv0&9lR8yiJBG zu7Phv*BUmjkjV@3-N7Hr{iHh3)6%Vr`!A2%`Yn>F{6Zi9y!)H&e}7hS&4UxRhp%p3 z?bT*B{YB^R^0kJ` Rg4Lty3TBzUsw%s<2LKOiZSw#C literal 0 HcmV?d00001 diff --git a/centossecurebootca2.cer b/centossecurebootca2.cer new file mode 100644 index 0000000000000000000000000000000000000000..42bdfcfbcda649796099fdc87bbe9dc58e2348d5 GIT binary patch literal 870 zcmXqLVoow>V)9zR%*4pV#L3VZSoN;M+UU0dFB_*;n@8JsUPeZ4Rt5t%Lj?mlHs(+k zW*%|p)Vvb^V1?k+zWand9m0rCz?btasy17qhCd~{zWSac7_phd5=E4lAo4tExT(TE@+xh11 zL5)4kX7}9{H-;C9i_BQIp!>|pw1_)NO3`N}XwL= 1:0.3.0-1 \ +Requires: efi-filesystem \ +Provides: shim-signed-%{-a*} = %{version}-%{release} \ +Requires: dbxtool >= 0.6-3 \ +Conflicts: grub2-efi-%{-a*} < %{grub_version} \ +%{expand:%%if 0%%{-p*} \ +Provides: shim = %{version}-%{release} \ +Provides: shim-signed = %{version}-%{release} \ +Obsoletes: shim-signed < %{version}-%{release} \ +Obsoletes: shim < %{version}-%{release} \ +%%endif} \ +# Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI \ +# is not compatible with SysV (there's no red zone under UEFI) and \ +# there isn't a POSIX-style C library. \ +# BuildRequires: OpenSSL \ +Provides: bundled(openssl) = 1.0.2j \ + \ +%{expand:%%description -n shim-%{-a*}} \ +Initial UEFI bootloader that handles chaining to a trusted full \ +bootloader under secure boot environments. This package contains the \ +version signed by the UEFI signing service. \ +%{nil} + +# -a +# -i +%define hash(a:i:d:) \ + if [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ + pesign -i %{-i*} -h -P > shim.hash \ + read file0 hash0 < shim.hash \ + read file1 hash1 < %{-d*}/shim%{-a*}.hash \ + if ! [ "$hash0" = "$hash1" ] ; then \ + echo Invalid signature\! > /dev/stderr \ + echo $hash0 vs $hash1 \ + exit 1 \ + fi \ + fi \ + %{nil} + +# -i +# -o +%define sign(i:o:n:a:c:) \ + %{expand:%%pesign -s -i %{-i*} -o %{-o*} %{-n} %{-n*} %{-a} %{-a*} %{-c} %{-c*}} \ + %{nil} + +# -b +# -a +# -i +%define distrosign(b:a:d:) \ + if [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ + if [ "%{-b*}%{-a*}" = "shim%{efi_arch}" ] ; then \ + cp -av "%{shimefi}" %{-b*}%{-a*}-unsigned.efi \ + elif [ "%{-b*}%{-a*}" = "shim%{efi_alt_arch}" ] ; then \ + cp -av "%{shimefialt}" %{-b*}%{-a*}-unsigned.efi \ + elif [ "%{-b*}%{-a*}" = "mm%{efi_arch}" ] ; then \ + cp -av "%{mmefi}" %{-b*}%{-a*}-unsigned.efi \ + elif [ "%{-b*}%{-a*}" = "mm%{efi_alt_arch}" ] ; then \ + cp -av "%{mmefialt}" %{-b*}%{-a*}-unsigned.efi \ + elif [ "%{-b*}%{-a*}" = "fb%{efi_arch}" ] ; then \ + cp -av "%{fbefi}" %{-b*}%{-a*}-unsigned.efi \ + elif [ "%{-b*}%{-a*}" = "fb%{efi_alt_arch}" ] ; then \ + cp -av "%{fbefialt}" %{-b*}%{-a*}-unsigned.efi \ + fi \ + else \ + cp -av %{-d*}/%{-b*}%{-a*}.efi %{-b*}%{-a*}-unsigned.efi \ + fi \ + %{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi -n centossecureboot201 -a %{SOURCE2} -c %{SOURCE1} } \ + %{nil} + +# -a +# -A +# -b <1|0> # signed by this builder? +# -c <1|0> # signed by UEFI CA? +# -i +# -d /usr/share dir for this build (full path) +%define define_build(a:A:b:c:i:d:) \ +if [ "%{-c*}" = "yes-temporarily-disabled-20180723" ]; then \ + %{expand:%%hash -i %{-i*} -a %{-a*} -d %{-d*}} \ +fi \ +cp %{-i*} shim%{-a*}.efi \ +if [ "%{-b*}" = "yes" ] ; then \ + %{expand:%%distrosign -b shim -a %{-a*} -d %{-d*}} \ + mv shim%{-a*}-signed.efi shim%{-a*}-%{efi_vendor}.efi \ +fi \ +if [ "%{-c*}" = "no" ] || \ + [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ + cp shim%{-a*}-%{efi_vendor}.efi shim%{-a*}.efi \ +fi \ +%{expand:%%distrosign -b mm -a %{-a*} -d %{-d*}} \ +mv mm%{-a*}-signed.efi mm%{-a*}.efi \ +%{expand:%%distrosign -b fb -a %{-a*} -d %{-d*}} \ +mv fb%{-a*}-signed.efi fb%{-a*}.efi \ +rm -vf \\\ + mm%{-a*}-unsigned.efi \\\ + fb%{-a*}-unsigned.efi \\\ + shim%{-a*}-unsigned.efi \ +%{nil} + +# -a +# -A +# -b +%define do_install(a:A:b:) \ +install -m 0700 shim%{-a*}.efi \\\ + $RPM_BUILD_ROOT%{efi_esp_dir}/shim%{-a*}.efi \ +install -m 0700 shim%{-a*}-%{efi_vendor}.efi \\\ + $RPM_BUILD_ROOT%{efi_esp_dir}/shim%{-a*}-%{efi_vendor}.efi \ +install -m 0700 mm%{-a*}.efi \\\ + $RPM_BUILD_ROOT%{efi_esp_dir}/mm%{-a*}.efi \ +install -m 0700 %{-b*} \\\ + $RPM_BUILD_ROOT%{efi_esp_dir}/BOOT%{-A*}.CSV \ +install -m 0700 shim%{-a*}.efi \\\ + $RPM_BUILD_ROOT%{efi_esp_boot}/BOOT%{-A*}.EFI \ +install -m 0700 fb%{-a*}.efi \\\ + $RPM_BUILD_ROOT%{efi_esp_boot}/fb%{-a*}.efi \ +%nil + +# -a +# -A +%define define_files(a:A:) \ +%{expand:%%files -n shim-%{-a*}} \ +%%verify(not mtime) %{efi_esp_dir}/*%{-a*}*.efi \ +%%verify(not mtime) %{efi_esp_dir}/BOOT%{-A*}.CSV \ +%%verify(not mtime) %{efi_esp_boot}/*%{-a*}.efi \ +%%verify(not mtime) %{efi_esp_boot}/*%{-A*}.EFI \ +%{nil} + +%ifarch x86_64 +%global is_signed yes +%global is_alt_signed no +%global provide_legacy_shim 1 +%endif +%ifarch aarch64 +%global is_signed no +%global is_alt_signed no +%global provide_legacy_shim 1 +%endif +%ifnarch x86_64 aarch64 +%global is_signed no +%global is_alt_signed no +%global provide_legacy_shim 0 +%endif + +%if ! 0%{?vendor:1} +%global vendor nopenopenope +%endif + +# vim:filetype=rpmmacros diff --git a/shim.spec b/shim.spec new file mode 100644 index 0000000..c729a4d --- /dev/null +++ b/shim.spec @@ -0,0 +1,114 @@ +Name: shim +Version: 15.8 +Release: 5%{?dist} +Summary: First-stage UEFI bootloader +License: BSD +URL: https://github.com/rhboot/shim/ +BuildRequires: efi-filesystem +BuildRequires: efi-srpm-macros >= 6 + +ExclusiveArch: %{efi} +# and we don't have shim-unsigned-arm builds *yet* +ExcludeArch: %{arm} %{ix86} + +Source0: shim.rpmmacros +Source1: centossecureboot201.cer +Source2: centossecurebootca2.cer +Source5: shim.conf + +# keep these two lists of sources synched up arch-wise. That is 0 and 10 +# match, 1 and 11 match, ... +Source10: BOOTAA64.CSV +Source20: shimaa64.efi +Source30: mmaa64.efi +Source40: fbaa64.efi +Source12: BOOTX64.CSV +Source22: shimx64.efi +Source32: mmx64.efi +Source42: fbx64.efi +#Source13: BOOTARM.CSV +#Source23: shimarm.efi +#Source33: mmarm.efi +#Source43: fbarm.efi + +%include %{SOURCE0} + +BuildRequires: pesign >= 0.112-20.fc27 +# Right now we're just including all of the parts from them as sources here +# to make the build+errata process less maddening. We do this because +# %%{efi} won't expand before choosing where to make the src.rpm in koji, +# and we could be on a non-efi architecture, in which case we won't have a +# valid expansion here... +#%% ifarch x86_64 +#BuildRequires: %% {unsignedx64} = %% {shimverx64} +#%% endif +#%% ifarch aarch64 +#BuildRequires: %% {unsignedaa64} = %% {shimveraa64} +#%% endif +#%%ifarch arm +#BuildRequires: %%{unsignedarm} = %%{shimverarm} +#%%endif + +%description +Initial UEFI bootloader that handles chaining to a trusted full bootloader +under secure boot environments. This package contains the version signed by +the UEFI signing service. + +%define_pkg -a %{efi_arch} -p 1 +%if %{efi_has_alt_arch} +%define_pkg -a %{efi_alt_arch} +%endif + +%prep +cd %{_builddir} +rm -rf shim-%{version} +mkdir shim-%{version} + +%build +export PS4='${LINENO}: ' + +cd shim-%{version} +%if %{efi_has_alt_arch} +%define_build -a %{efi_alt_arch} -A %{efi_alt_arch_upper} -i %{shimefialt} -b yes -c %{is_alt_signed} -d %{shimdiralt} +%endif +# Temporarily using _sourcedir to avoid build dep annoyances. +%define_build -a %{efi_arch} -A %{efi_arch_upper} -i %{shimefi} -b yes -c %{is_signed} -d %{_sourcedir} + +%install +rm -rf $RPM_BUILD_ROOT +cd shim-%{version} +install -D -d -m 0755 $RPM_BUILD_ROOT/boot/ +install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_root}/ +install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_efi}/ +install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_dir}/ +install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_boot}/ + +%do_install -a %{efi_arch} -A %{efi_arch_upper} -b %{bootcsv} +%if %{efi_has_alt_arch} +%do_install -a %{efi_alt_arch} -A %{efi_alt_arch_upper} -b %{bootcsvalt} +%endif + +%if %{provide_legacy_shim} +install -m 0700 %{shimefi} $RPM_BUILD_ROOT%{efi_esp_dir}/shim.efi +%endif +install -D -d -m 0755 $RPM_BUILD_ROOT%{_sysconfdir}/dnf/protected.d/ +install -m 0644 %{SOURCE5} $RPM_BUILD_ROOT%{_sysconfdir}/dnf/protected.d/ + +( cd $RPM_BUILD_ROOT ; find .%{efi_esp_root} -type f ) \ + | sed -e 's/\./\^/' -e 's,^\\\./,.*/,' -e 's,$,$,' > %{__brp_mangle_shebangs_exclude_from_file} + +%define_files -a %{efi_arch} -A %{efi_arch_upper} +%if %{efi_has_alt_arch} +%define_files -a %{efi_alt_arch} -A %{efi_alt_arch_upper} +%endif +%{_sysconfdir}/dnf/protected.d/shim.conf + +%if %{provide_legacy_shim} +%verify(not mtime) %{efi_esp_dir}/shim.efi +%endif + +%changelog +* Wed Jul 2 2025 Nicolas Frayer - 15.8-5 +- First build for Centos Stream 10 +- Resolves: #RHEL-45014 + diff --git a/sources b/sources new file mode 100644 index 0000000..39c05f1 --- /dev/null +++ b/sources @@ -0,0 +1,8 @@ +SHA512 (shimx64.efi) = b4dc7ff94feec631d63e496b72d9ea333179204407ba91399d7c5e2c762172a3ab91001604727641ac5b0eaf79fa350d981b05c101c523897987e12b494b03cd +SHA512 (fbx64.efi) = 1bbf117734d042d92e331a9e619b0f48a7da1016c5fbc3ec5461247e9bb599df200b98ad9ffe82300550f884e8e3b2457763c7f3fd9cf142fbef76aa3b10d0a5 +SHA512 (mmx64.efi) = caabd963f6a8a05bbb48f0298c683d1f97d3fe4bc68eee4521b2e8bc2c5cdb6ef405b7188031b8ff250b7a1ddafbdc5da241ac30545bfabca42ee2bc45507499 +SHA512 (BOOTX64.CSV) = 16936301ec1b098022aac2428d31a4849a585e047493a64916427a235287b8d81bc285b0371a270e77ed476b71c741b8d7e7158986b167c3d6bb982705764e16 +SHA512 (BOOTAA64.CSV) = 1c1bac8c2627b704e8b091d2e0c81d55a8bd7420450fe429e20efe8830fa377fdf48c51c2e658e3d0ecee491845bf5cc696ba848669dc26d23687ed5fe5efa76 +SHA512 (fbaa64.efi) = 5816080369a5fa47bed503b1fad4c31d35c88be2fc2a3c513c6bae7159bc95d989dfe3cb773fd6a452360040b6035689179bf29c5d68cc912d7272c7472c7d5d +SHA512 (mmaa64.efi) = c422b693831aee23bdf4224a6996edad9c6a91ebc66eeb9bc1bc5d98942a963fad2db077d0804d2b3382b483c7d39a0fb37987214810b4e14d193a97c3c2debe +SHA512 (shimaa64.efi) = 8ded3a96b6b02afb39e5df829913c1536afb1e711239f5f58620d4dec622a722725cdd8764830da0a93acce7f9741f6e9235a67254da12e240dc3ff032c536fb