Modified to use MSVSphere Secure Boot certificates

SOURCES/x509.genkey.centos

@@ -5,9 +5,9 @@ prompt = no
 x509_extensions = myexts
 
 [ req_distinguished_name ]
-O = The CentOS Project
+O = NCSD LLC
-CN = CentOS Stream kernel signing key
+CN = MSVSphere Stream kernel signing key
-emailAddress = security@centos.org
+emailAddress = security@msvsphere.ru
 
 [ myexts ]
 basicConstraints=critical,CA:FALSE

SOURCES/x509.genkey.rhel

@@ -5,9 +5,9 @@ prompt = no
 x509_extensions = myexts
 
 [ req_distinguished_name ]
-O = Red Hat
+O = NCSD LLC
-CN = Red Hat Enterprise Linux kernel signing key
+CN = MSVSphere kernel signing key
-emailAddress = secalert@redhat.com
+emailAddress = security@msvsphere.ru
 
 [ myexts ]
 basicConstraints=critical,CA:FALSE

SPECS/kernel.spec

@@ -793,20 +793,7 @@ Source1: Makefile.rhelver
 
 %define secureboot_ca_0 %{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer
 %define secureboot_key_0 %{_datadir}/pki/sb-certs/secureboot-kernel-%{_arch}.cer
-
+%define pesign_name_0 spheresecureboot001
-%if 0%{?centos}
-%define pesign_name_0 centossecureboot201
-%else
-%ifarch x86_64 aarch64
-%define pesign_name_0 redhatsecureboot501
-%endif
-%ifarch s390x
-%define pesign_name_0 redhatsecureboot302
-%endif
-%ifarch ppc64le
-%define pesign_name_0 redhatsecureboot701
-%endif
-%endif
 
 # signkernel
 %endif
@@ -883,8 +870,8 @@ Source82: update_scripts.sh
 Source84: mod-internal.list
 Source85: mod-partner.list
 
-Source100: rheldup3.x509
+Source100: msvspheredup1.x509
-Source101: rhelkpatch1.x509
+Source101: msvspherepatch1.x509
 
 Source150: dracut-virt.conf
 
@@ -1191,11 +1178,11 @@ kernel-gcov includes the gcov graph and source files for gcov coverage collectio
 %endif
 
 %package -n kernel-abi-stablelists
-Summary: The Red Hat Enterprise Linux kernel ABI symbol stablelists
+Summary: The MSVSphere kernel ABI symbol stablelists
 AutoReqProv: no
 %description -n kernel-abi-stablelists
-The kABI package contains information pertaining to the Red Hat Enterprise
+The kABI package contains information pertaining to the MSVSphere
-Linux kernel ABI, including lists of kernel symbols that are needed by
+kernel ABI, including lists of kernel symbols that are needed by
 external Linux kernel modules, and a yum plugin to aid enforcement.
 
 %if %{with_kabidw_base}
@@ -1204,8 +1191,8 @@ Summary: The baseline dataset for kABI verification using DWARF data
 Group: System Environment/Kernel
 AutoReqProv: no
 %description kernel-kabidw-base-internal
-The package contains data describing the current ABI of the Red Hat Enterprise
+The package contains data describing the current ABI of the MSVSphere
-Linux kernel, suitable for the kabi-dw tool.
+kernel, suitable for the kabi-dw tool.
 %endif
 
 #
@@ -1304,7 +1291,7 @@ Requires: %{name}%{?1:-%{1}}-modules-core-uname-r = %{KVERREL}%{uname_suffix %{?
 AutoReq: no\
 AutoProv: yes\
 %description %{?1:%{1}-}modules-internal\
-This package provides kernel modules for the %{?2:%{2} }kernel package for Red Hat internal usage.\
+This package provides kernel modules for the %{?2:%{2} }kernel package for MSVSphere internal usage.\
 %{nil}
 
 #
@@ -1472,7 +1459,7 @@ Requires: %{name}%{?1:-%{1}}-modules-uname-r = %{KVERREL}%{uname_suffix %{?1:%{1
 AutoReq: no\
 AutoProv: yes\
 %description %{?1:%{1}-}modules-partner\
-This package provides kernel modules for the %{?2:%{2} }kernel package for Red Hat partners usage.\
+This package provides kernel modules for the %{?2:%{2} }kernel package for MSVSphere partners usage.\
 %{nil}
 
 # Now, each variant package.
@@ -1716,7 +1703,7 @@ done
 # Adjust FIPS module name for RHEL
 %if 0%{?rhel}
 for i in *.config; do
-  sed -i 's/CONFIG_CRYPTO_FIPS_NAME=.*/CONFIG_CRYPTO_FIPS_NAME="Red Hat Enterprise Linux %{rhel} - Kernel Cryptographic API"/' $i
+  sed -i 's/CONFIG_CRYPTO_FIPS_NAME=.*/CONFIG_CRYPTO_FIPS_NAME="MSVSphere %{rhel} - Kernel Cryptographic API"/' $i
 done
 %endif
 
@@ -1735,18 +1722,6 @@ RHJOBS=$RPM_BUILD_NCPUS PACKAGE_NAME=kernel-rt ./process_configs.sh $OPTS ${spec
 cp %{SOURCE82} .
 RPM_SOURCE_DIR=$RPM_SOURCE_DIR ./update_scripts.sh %{primary_target}
 
-# We may want to override files from the primary target in case of building
-# against a flavour of it (eg. centos not rhel), thus override it here if
-# necessary
-if [ "%{primary_target}" == "rhel" ]; then
-%if 0%{?centos}
-  echo "Updating scripts/sources to centos version"
-  RPM_SOURCE_DIR=$RPM_SOURCE_DIR ./update_scripts.sh centos
-%else
-  echo "Not updating scripts/sources to centos version"
-%endif
-fi
-
 # end of kernel config
 %endif
 
@@ -2449,7 +2424,7 @@ BuildKernel() {
     # prune junk from kernel-devel
     find $RPM_BUILD_ROOT/usr/src/kernels -name ".*.cmd" -delete
 
-    # Red Hat UEFI Secure Boot CA cert, which can be used to authenticate the kernel
+    # MSVSphere UEFI Secure Boot CA cert, which can be used to authenticate the kernel
     mkdir -p $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer
 %if %{signkernel}
     install -m 0644 %{secureboot_ca_0} $RPM_BUILD_ROOT%{_datadir}/doc/kernel-keys/$KernelVer/kernel-signing-ca.cer
@@ -3547,8 +3522,9 @@ fi
 #
 #
 %changelog
-* Fri Apr 14 2023 MSVSphere Packaging Team <packager@msvsphere.ru> - 5.14.0-162.6.1.rt21.168
+* Wed Jun 21 2023 Arkady L. Shane <ashejn@msvsphere.ru> - 5.14.0-162.6.1.rt21.168
-- Rebuilt for MSVSphere 9.1.
+- Modified to use MSVSphere Secure Boot certificates
+- Rebuilt for MSVSphere 9.2.
 
 * Wed Apr 12 2023 Luis Claudio R. Goncalves <lgoncalv@redhat.com> [5.14.0-284.11.1.rt14.296.el9_2]
 - [rt] build kernel-rt-5.14.0-284.11.1.rt14.296.el9_2 [2125474]