- Use AlmaLinux cert

- Add conflicts to old shim

.shim.metadata

@@ -1,3 +1,3 @@
 8f61bdc72cf582e2fdf094eac3bd911464857d89 SOURCES/shimaa64.efi
-cf0dc84373d0036f0420255baaa5a3b4760563ed SOURCES/shimia32.efi
-5957bbccac9f22c1738039679204be0bb57c3812 SOURCES/shimx64.efi
+0ec5248d6de68520dad7587f531dfabe4e2a9007 SOURCES/shimia32.efi
+8d5251f1166c9dd43426903459fe95d4bd262483 SOURCES/shimx64.efi

SOURCES/shim.rpmmacros

@@ -13,9 +13,9 @@
 %global shimefix64 %{expand:%{SOURCE22}}
 #%%global shimefiarm %%{expand:%%{SOURCE23}
 
-%global shimveraa64 15-7.el8_1.alma
-%global shimveria32 15.6-1.el8.alma
-%global shimverx64 15.6-1.el8.alma
+%global shimveraa64 15-7.el8_1.alma.1
+%global shimveria32 15.6-1.el8.alma.1
+%global shimverx64 15.6-1.el8.alma.1
 #%%global shimverarm 15-1.el8
 
 %global shimdiraa64 %{_datadir}/shim/%{shimveraa64}/aa64
@@ -49,6 +49,11 @@ Requires: efi-filesystem						\
 Provides: shim-signed-%{-a*} = %{version}-%{release}			\
 Requires: dbxtool >= 0.6-3						\
 Requires: %{efi_esp_dir}/grub%{-a*}.efi					\
+%{expand:%ifarch x86_64						\
+# SecureBoot keys dependencies						\
+Requires: almalinux(grub2-sig-key) >= 202303				\
+Requires: almalinux(kernel-sig-key) >= 202303				\
+%endif}											\
 %{expand:%%if 0%%{-p*}							\
 Provides: shim = %{version}-%{release}					\
 Provides: shim-signed = %{version}-%{release}				\

SPECS/shim.spec

@@ -4,7 +4,7 @@
 
 Name:		shim
 Version:	15.6
-Release:	1%{?dist}.alma
+Release:	1%{?dist}.alma.1
 Summary:	First-stage UEFI bootloader
 License:	BSD
 URL:		https://github.com/rhboot/shim/
@@ -18,7 +18,7 @@ ExcludeArch:	%{ix86}
 ExcludeArch:	%{arm}
 
 Source0:	shim.rpmmacros
-Source1:	clsecureboot001.cer
+Source1:	almalinuxsecurebootca0.cer
 
 # keep these two lists of sources synched up arch-wise.  That is 0 and 10
 # match, 1 and 11 match, ...