From f0ce0023045210b4528efa2d711d90e2b02ac856 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 27 Sep 2022 10:59:37 -0400 Subject: [PATCH] import shim-15.6-1.el9 --- .gitignore | 3 +- .shim.metadata | 7 ++-- SOURCES/BOOTIA32.CSV | Bin 184 -> 0 bytes SOURCES/BOOTX64.CSV | Bin 182 -> 108 bytes SOURCES/fbaa64.efi | 0 SOURCES/mmaa64.efi | 0 SOURCES/shim.rpmmacros | 71 ++++++++++++++++++++++++++++------------- SPECS/shim.spec | 52 +++++++++++++++--------------- 8 files changed, 80 insertions(+), 53 deletions(-) delete mode 100644 SOURCES/BOOTIA32.CSV create mode 100644 SOURCES/fbaa64.efi create mode 100644 SOURCES/mmaa64.efi diff --git a/.gitignore b/.gitignore index 1d48086..e57fc72 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ +SOURCES/fbx64.efi +SOURCES/mmx64.efi SOURCES/shimaa64.efi -SOURCES/shimia32.efi SOURCES/shimx64.efi diff --git a/.shim.metadata b/.shim.metadata index f997f90..bd1dd4b 100644 --- a/.shim.metadata +++ b/.shim.metadata @@ -1,3 +1,4 @@ -750bd7932437b1fb6610c233f69db1b70d67fab1 SOURCES/shimaa64.efi -96ea5ec6612ad2d49dfa812897fc2f70ebee6b9d SOURCES/shimia32.efi -b7adea991a31e4392910db8b7ee63faff39e9207 SOURCES/shimx64.efi +9ca9cfa834aedfaf3efe2216bfa1cb7c286ee1c0 SOURCES/fbx64.efi +5eb0ac78eee6aeeaf44a3f11d002b4fe00af6916 SOURCES/mmx64.efi +4312f246b6ba692040383f10358ac9a5927207de SOURCES/shimaa64.efi +783fb77783e9d0c4c400b723dfd0f02f006616ae SOURCES/shimx64.efi diff --git a/SOURCES/BOOTIA32.CSV b/SOURCES/BOOTIA32.CSV deleted file mode 100644 index 4e658b2f4fc811efe3f482f81efef435dab58626..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 184 zcmb7-OAbIl5JcbFDdqrT!5JhLR^kH0Oj!72hJ?$b%nhW|sp_ik>gNuOOw8(zf}9MC z)0EPP4HzmpyRc*tT0EP2B8VGmv4w+E7b$H_3(`N|Xn%}bJ*(JmSc{R=rq?Dv-nm%`6WMbx|ASc7( zG^aFT1BQx@U0AXREuKw15yTC(*utUfRMp0;ApP4L`N!z$Syf+(jVYc>+)4Aozn>Cb DrCcGk diff --git a/SOURCES/fbaa64.efi b/SOURCES/fbaa64.efi new file mode 100644 index 0000000..e69de29 diff --git a/SOURCES/mmaa64.efi b/SOURCES/mmaa64.efi new file mode 100644 index 0000000..e69de29 diff --git a/SOURCES/shim.rpmmacros b/SOURCES/shim.rpmmacros index ec33c1d..d1379ff 100644 --- a/SOURCES/shim.rpmmacros +++ b/SOURCES/shim.rpmmacros @@ -4,27 +4,30 @@ %global vendor_cert_str %{expand:%%{!?vendor_cert_nickname:-c "Red Hat Test Certificate"}%%{?vendor_cert_nickname:-c "%%{vendor_cert_nickname}"}} %global bootcsvaa64 %{expand:%{SOURCE10}} -%global bootcsvia32 %{expand:%{SOURCE11}} %global bootcsvx64 %{expand:%{SOURCE12}} #%%global bootcsvarm %%{expand:%%{SOURCE13}} %global shimefiaa64 %{expand:%{SOURCE20}} -%global shimefiia32 %{expand:%{SOURCE21}} %global shimefix64 %{expand:%{SOURCE22}} #%%global shimefiarm %%{expand:%%{SOURCE23} -%global shimveraa64 15-6.el8 -%global shimveria32 15-9.el8 -%global shimverx64 15-9.el8 +%global fbefiaa64 %{expand:%{SOURCE30}} +%global fbefix64 %{expand:%{SOURCE32}} +#%%global fbefiarm %%{expand:%%{SOURCE33} + +%global mmefiaa64 %{expand:%{SOURCE40}} +%global mmefix64 %{expand:%{SOURCE42}} +#%%global mmefiarm %%{expand:%%{SOURCE43} + +%global shimveraa64 15-6.el9 +%global shimverx64 15.6-1.el9 #%%global shimverarm 15-1.el8 %global shimdiraa64 %{_datadir}/shim/%{shimveraa64}/aa64 -%global shimdiria32 %{_datadir}/shim/%{shimveria32}/ia32 %global shimdirx64 %{_datadir}/shim/%{shimverx64}/x64 #%%global shimdirarm %%{_datadir}/shim/%%{shimverarm}/arm %global unsignedaa64 shim-unsigned-aarch64 -%global unsignedia32 shim-unsigned-ia32 %global unsignedx64 shim-unsigned-x64 #%%global unsignedarm shim-unsigned-arm @@ -36,6 +39,10 @@ %global shimveralt %{expand:%{shimver%{?efi_alt_arch}}} %global shimdir %{expand:%{shimdir%{efi_arch}}} %global shimdiralt %{expand:%{shimdir%{?efi_alt_arch}}} +%global fbefi %{expand:%{fbefi%{efi_arch}}} +%global fbefialt %{expand:%{fbefi%{?efi_alt_arch}}} +%global mmefi %{expand:%{mmefi%{efi_arch}}} +%global mmefialt %{expand:%{mmefi%{?efi_alt_arch}}} %global unsignednone shim-unsigned-none %global unsigned %{expand:%%{unsigned%{efi_arch}}} @@ -68,15 +75,17 @@ version signed by the UEFI signing service. \ # -a # -i -%define hash(a:i:d:) \ - pesign -i %{-i*} -h -P > shim.hash \ - read file0 hash0 < shim.hash \ - read file1 hash1 < %{-d*}/shim%{-a*}.hash \ - if ! [ "$hash0" = "$hash1" ]; then \ - echo Invalid signature\! > /dev/stderr \ - echo $hash0 vs $hash1 \ - exit 1 \ - fi \ +%define hash(a:i:d:) \ + if [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ + pesign -i %{-i*} -h -P > shim.hash \ + read file0 hash0 < shim.hash \ + read file1 hash1 < %{-d*}/shim%{-a*}.hash \ + if ! [ "$hash0" = "$hash1" ] ; then \ + echo Invalid signature\! > /dev/stderr \ + echo $hash0 vs $hash1 \ + exit 1 \ + fi \ + fi \ %{nil} # -i @@ -88,9 +97,25 @@ version signed by the UEFI signing service. \ # -b # -a # -i -%define distrosign(b:a:d:) \ - cp -av %{-d*}/%{-b*}%{-a*}.efi %{-b*}%{-a*}-unsigned.efi \ - %{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi -n redhatsecureboot501 -a %{SOURCE2} -c %{SOURCE1} }\ +%define distrosign(b:a:d:) \ + if [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ + if [ "%{-b*}%{-a*}" = "shim%{efi_arch}" ] ; then \ + cp -av "%{shimefi}" %{-b*}%{-a*}-unsigned.efi \ + elif [ "%{-b*}%{-a*}" = "shim%{efi_alt_arch}" ] ; then \ + cp -av "%{shimefialt}" %{-b*}%{-a*}-unsigned.efi \ + elif [ "%{-b*}%{-a*}" = "mm%{efi_arch}" ] ; then \ + cp -av "%{mmefi}" %{-b*}%{-a*}-unsigned.efi \ + elif [ "%{-b*}%{-a*}" = "mm%{efi_alt_arch}" ] ; then \ + cp -av "%{mmefialt}" %{-b*}%{-a*}-unsigned.efi \ + elif [ "%{-b*}%{-a*}" = "fb%{efi_arch}" ] ; then \ + cp -av "%{fbefi}" %{-b*}%{-a*}-unsigned.efi \ + elif [ "%{-b*}%{-a*}" = "fb%{efi_alt_arch}" ] ; then \ + cp -av "%{fbefialt}" %{-b*}%{-a*}-unsigned.efi \ + fi \ + else \ + cp -av %{-d*}/%{-b*}%{-a*}.efi %{-b*}%{-a*}-unsigned.efi \ + fi \ + %{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi -n redhatsecureboot501 -a %{SOURCE2} -c %{SOURCE1} } \ %{nil} # -a @@ -98,16 +123,18 @@ version signed by the UEFI signing service. \ # -b <1|0> # signed by this builder? # -c <1|0> # signed by UEFI CA? # -i +# -d /usr/share dir for this build (full path) %define define_build(a:A:b:c:i:d:) \ if [ "%{-c*}" = "yes-temporarily-disabled-20180723" ]; then \ %{expand:%%hash -i %{-i*} -a %{-a*} -d %{-d*}} \ fi \ cp %{-i*} shim%{-a*}.efi \ -if [ "%{-b*}" = "yes" ]; then \ +if [ "%{-b*}" = "yes" ] ; then \ %{expand:%%distrosign -b shim -a %{-a*} -d %{-d*}} \ mv shim%{-a*}-signed.efi shim%{-a*}-%{efi_vendor}.efi \ fi \ -if [ "%{-c*}" = "no" ]; then \ +if [ "%{-c*}" = "no" ] || \ + [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ cp shim%{-a*}-%{efi_vendor}.efi shim%{-a*}.efi \ fi \ %{expand:%%distrosign -b mm -a %{-a*} -d %{-d*}} \ @@ -150,7 +177,7 @@ install -m 0700 fb%{-a*}.efi \\\ %ifarch x86_64 %global is_signed yes -%global is_alt_signed yes +%global is_alt_signed no %global provide_legacy_shim 1 %endif %ifarch aarch64 diff --git a/SPECS/shim.spec b/SPECS/shim.spec index c21b6cb..cae3ba6 100644 --- a/SPECS/shim.spec +++ b/SPECS/shim.spec @@ -1,17 +1,15 @@ Name: shim -Version: 15 -Release: 16%{?dist} +Version: 15.6 +Release: 1.el9 Summary: First-stage UEFI bootloader License: BSD URL: https://github.com/rhboot/shim/ BuildRequires: efi-filesystem -BuildRequires: efi-srpm-macros >= 3-2 +BuildRequires: efi-srpm-macros >= 6 ExclusiveArch: %{efi} -# but we don't build a .i686 package, just a shim-ia32.x86_64 package -ExcludeArch: %{ix86} # and we don't have shim-unsigned-arm builds *yet* -ExcludeArch: %{arm} +ExcludeArch: %{arm} %{ix86} Source0: shim.rpmmacros Source1: redhatsecureboot501.cer @@ -21,12 +19,16 @@ Source2: redhatsecurebootca5.cer # match, 1 and 11 match, ... Source10: BOOTAA64.CSV Source20: shimaa64.efi -Source11: BOOTIA32.CSV -Source21: shimia32.efi +Source30: mmaa64.efi +Source40: fbaa64.efi Source12: BOOTX64.CSV Source22: shimx64.efi +Source32: mmx64.efi +Source42: fbx64.efi #Source13: BOOTARM.CSV #Source23: shimarm.efi +#Source33: mmarm.efi +#Source43: fbarm.efi %include %{SOURCE0} @@ -37,8 +39,8 @@ BuildRequires: pesign >= 0.112-20.fc27 # (shim 16+) by making the unsigned packages all provide "shim-unsigned", so # we can just BuildRequires that. %ifarch x86_64 -BuildRequires: %{unsignedx64} = %{shimverx64} -BuildRequires: %{unsignedia32} = %{shimveria32} +## BuildRequires: %% {unsignedx64} = %% {shimverx64} +BuildRequires: shim-unsigned-x64 = 15.6-1.el9 %endif %ifarch aarch64 BuildRequires: %{unsignedaa64} = %{shimveraa64} @@ -63,6 +65,7 @@ rm -rf shim-%{version} mkdir shim-%{version} %build +export PS4='${LINENO}: ' cd shim-%{version} %if %{efi_has_alt_arch} @@ -101,60 +104,55 @@ install -m 0700 %{shimefi} $RPM_BUILD_ROOT%{efi_esp_dir}/shim.efi %endif %changelog +* Mon Jun 06 2022 Peter Jones - 15.6-1.el9 +- Update to shim-15.6 + Resolves: CVE-2022-28737 + +* Thu Apr 14 2022 Peter Jones - 15.5-2.el9 +- Attempt to make aarch64 build. + Related: rhbz#1932057 + +* Thu Apr 14 2022 Peter Jones - 15.5-1.el9 +- Rebuild for rhel-9.0.0 + Resolves: rhbz#1932057 + * Mon Sep 21 2020 Javier Martinez Canillas - 15-16 - Fix an incorrect allocation size - Resolves: rhbz#1877253 * Fri Jul 31 2020 Peter Jones - 15-15 - Update once again for new signed shim builds. - Resolves: rhbz#1861977 * Tue Jul 28 2020 Peter Jones - 15-14 - Get rid of our %%dist hack for now. * Tue Jul 28 2020 Peter Jones - 15-13 - New signing keys - Related: CVE-2020-10713 - Related: CVE-2020-14308 - Related: CVE-2020-14309 - Related: CVE-2020-14310 - Related: CVE-2020-14311 * Thu Jun 11 2020 Javier Martinez Canillas - 15-12 - Fix firmware update bug in aarch64 caused by shim ignoring arguments - Resolves: rhbz#1830871 - Fix a shim crash when attempting to netboot - Resolves: rhbz#1795654 * Fri Jun 07 2019 Javier Martinez Canillas - 15-11 - Update the shim-unsigned-aarch64 version number - Related: rhbz#1715879 * Fri Jun 07 2019 Javier Martinez Canillas - 15-10 - Add a gating.yaml file so the package can be properly gated - Related: rhbz#1681809 * Wed Jun 05 2019 Javier Martinez Canillas - 15-9 - Bump the NVR - Related: rhbz#1715879 * Wed Jun 05 2019 Javier Martinez Canillas - 15-7 - Make EFI variable copying fatal only on secureboot enabled systems - Resolves: rhbz#1715879 - Fix booting shim from an EFI shell using a relative path - Resolves: rhbz#1717061 * Thu Mar 14 2019 Peter Jones - 15-6 - Fix MoK mirroring issue which breaks kdump without intervention - Resolves: rhbz#1668966 * Thu Jan 24 2019 Peter Jones - 15-5 - Rebuild for signing once again. If the signer actually works, then: - Resolves: rhbz#1620941 * Tue Oct 16 2018 Peter Jones - 15-4 - Rebuild for signing - Resolves: rhbz#1620941 * Mon Aug 13 2018 Troy Dawson - Release Bumped for el8 Mass Rebuild