diff --git a/.shim.metadata b/.shim.metadata index a99a2be..f1dd333 100644 --- a/.shim.metadata +++ b/.shim.metadata @@ -1,3 +1,2 @@ -a90efeb1562bde896b930fe40a09d22284cad2fc SOURCES/fbx64.efi -03da6effba89aa015501640bf486973b8b74f47f SOURCES/mmx64.efi -888dfe2b9f8c3eaec7db4ecf282dacd81229b5d0 SOURCES/shimx64.efi +be027373ba823a967e6d92f3aaa855869ca0ce30 SOURCES/shimia32.efi +d7cdcbd38a363a458cbe571ea7bc0f592ab5f52b SOURCES/shimx64.efi diff --git a/SOURCES/BOOTIA32.CSV b/SOURCES/BOOTIA32.CSV new file mode 100644 index 0000000..568e0a7 Binary files /dev/null and b/SOURCES/BOOTIA32.CSV differ diff --git a/SOURCES/shim.rpmmacros b/SOURCES/shim.rpmmacros index 5f23bce..d1cc90a 100644 --- a/SOURCES/shim.rpmmacros +++ b/SOURCES/shim.rpmmacros @@ -3,33 +3,28 @@ %global vendor_token_str %{expand:%%{nil}%%{?vendor_token_name:-t "%{vendor_token_name}"}} %global vendor_cert_str %{expand:%%{!?vendor_cert_nickname:-c "Red Hat Test Certificate"}%%{?vendor_cert_nickname:-c "%%{vendor_cert_nickname}"}} -%global efi_has_alt_arch 0 - %global bootcsvaa64 %{expand:%{SOURCE10}} +%global bootcsvia32 %{expand:%{SOURCE11}} %global bootcsvx64 %{expand:%{SOURCE12}} #%%global bootcsvarm %%{expand:%%{SOURCE13}} %global shimefiaa64 %{expand:%{SOURCE20}} +%global shimefiia32 %{expand:%{SOURCE21}} %global shimefix64 %{expand:%{SOURCE22}} #%%global shimefiarm %%{expand:%%{SOURCE23} -%global fbefiaa64 %{expand:%{SOURCE30}} -%global fbefix64 %{expand:%{SOURCE32}} -#%%global fbefiarm %%{expand:%%{SOURCE33} - -%global mmefiaa64 %{expand:%{SOURCE40}} -%global mmefix64 %{expand:%{SOURCE42}} -#%%global mmefiarm %%{expand:%%{SOURCE43} - -%global shimveraa64 15-6.el8 +%global shimveraa64 15-7.el8_1 +%global shimveria32 15.6-1.el8.inferit %global shimverx64 15.6-1.el8.inferit #%%global shimverarm 15-1.el8 %global shimdiraa64 %{_datadir}/shim/%{shimveraa64}/aa64 +%global shimdiria32 %{_datadir}/shim/%{shimveria32}/ia32 %global shimdirx64 %{_datadir}/shim/%{shimverx64}/x64 #%%global shimdirarm %%{_datadir}/shim/%%{shimverarm}/arm %global unsignedaa64 shim-unsigned-aarch64 +%global unsignedia32 shim-unsigned-ia32 %global unsignedx64 shim-unsigned-x64 #%%global unsignedarm shim-unsigned-arm @@ -41,10 +36,6 @@ %global shimveralt %{expand:%{shimver%{?efi_alt_arch}}} %global shimdir %{expand:%{shimdir%{efi_arch}}} %global shimdiralt %{expand:%{shimdir%{?efi_alt_arch}}} -%global fbefi %{expand:%{fbefi%{efi_arch}}} -%global fbefialt %{expand:%{fbefi%{?efi_alt_arch}}} -%global mmefi %{expand:%{mmefi%{efi_arch}}} -%global mmefialt %{expand:%{mmefi%{?efi_alt_arch}}} %global unsignednone shim-unsigned-none %global unsigned %{expand:%%{unsigned%{efi_arch}}} @@ -57,6 +48,7 @@ Requires: mokutil >= 1:0.3.0-1 \ Requires: efi-filesystem \ Provides: shim-signed-%{-a*} = %{version}-%{release} \ Requires: dbxtool >= 0.6-3 \ +Requires: %{efi_esp_dir}/grub%{-a*}.efi \ %{expand:%%if 0%%{-p*} \ Provides: shim = %{version}-%{release} \ Provides: shim-signed = %{version}-%{release} \ @@ -77,17 +69,15 @@ version signed by the UEFI signing service. \ # -a # -i -%define hash(a:i:d:) \ - if [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ - pesign -i %{-i*} -h -P > shim.hash \ - read file0 hash0 < shim.hash \ - read file1 hash1 < %{-d*}/shim%{-a*}.hash \ - if ! [ "$hash0" = "$hash1" ] ; then \ - echo Invalid signature\! > /dev/stderr \ - echo $hash0 vs $hash1 \ - exit 1 \ - fi \ - fi \ +%define hash(a:i:d:) \ + pesign -i %{-i*} -h -P > shim.hash \ + read file0 hash0 < shim.hash \ + read file1 hash1 < %{-d*}/shim%{-a*}.hash \ + if ! [ "$hash0" = "$hash1" ]; then \ + echo Invalid signature\! > /dev/stderr \ + echo $hash0 vs $hash1 \ + exit 1 \ + fi \ %{nil} # -i @@ -99,25 +89,9 @@ version signed by the UEFI signing service. \ # -b # -a # -i -%define distrosign(b:a:d:) \ - if [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ - if [ "%{-b*}%{-a*}" = "shim%{efi_arch}" ] ; then \ - cp -av "%{shimefi}" %{-b*}%{-a*}-unsigned.efi \ - elif [ "%{-b*}%{-a*}" = "shim%{efi_alt_arch}" ] ; then \ - cp -av "%{shimefialt}" %{-b*}%{-a*}-unsigned.efi \ - elif [ "%{-b*}%{-a*}" = "mm%{efi_arch}" ] ; then \ - cp -av "%{mmefi}" %{-b*}%{-a*}-unsigned.efi \ - elif [ "%{-b*}%{-a*}" = "mm%{efi_alt_arch}" ] ; then \ - cp -av "%{mmefialt}" %{-b*}%{-a*}-unsigned.efi \ - elif [ "%{-b*}%{-a*}" = "fb%{efi_arch}" ] ; then \ - cp -av "%{fbefi}" %{-b*}%{-a*}-unsigned.efi \ - elif [ "%{-b*}%{-a*}" = "fb%{efi_alt_arch}" ] ; then \ - cp -av "%{fbefialt}" %{-b*}%{-a*}-unsigned.efi \ - fi \ - else \ - cp -av %{-d*}/%{-b*}%{-a*}.efi %{-b*}%{-a*}-unsigned.efi \ - fi \ - %{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi -n redhatsecureboot501 -a %{SOURCE2} -c %{SOURCE1} } \ +%define distrosign(b:a:d:) \ + cp -av %{-d*}/%{-b*}%{-a*}.efi %{-b*}%{-a*}-unsigned.efi \ + %{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi -n redhatsecureboot501 -a %{SOURCE2} -c %{SOURCE1} }\ %{nil} # -a @@ -125,18 +99,16 @@ version signed by the UEFI signing service. \ # -b <1|0> # signed by this builder? # -c <1|0> # signed by UEFI CA? # -i -# -d /usr/share dir for this build (full path) %define define_build(a:A:b:c:i:d:) \ if [ "%{-c*}" = "yes-temporarily-disabled-20180723" ]; then \ %{expand:%%hash -i %{-i*} -a %{-a*} -d %{-d*}} \ fi \ cp %{-i*} shim%{-a*}.efi \ -if [ "%{-b*}" = "yes" ] ; then \ +if [ "%{-b*}" = "yes" ]; then \ %{expand:%%distrosign -b shim -a %{-a*} -d %{-d*}} \ mv shim%{-a*}-signed.efi shim%{-a*}-%{efi_vendor}.efi \ fi \ -if [ "%{-c*}" = "no" ] || \ - [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ +if [ "%{-c*}" = "no" ]; then \ cp shim%{-a*}-%{efi_vendor}.efi shim%{-a*}.efi \ fi \ %{expand:%%distrosign -b mm -a %{-a*} -d %{-d*}} \ @@ -179,7 +151,7 @@ install -m 0700 fb%{-a*}.efi \\\ %ifarch x86_64 %global is_signed yes -%global is_alt_signed no +%global is_alt_signed yes %global provide_legacy_shim 1 %endif %ifarch aarch64 diff --git a/SPECS/shim.spec b/SPECS/shim.spec index 9f94092..db8875c 100644 --- a/SPECS/shim.spec +++ b/SPECS/shim.spec @@ -1,3 +1,7 @@ +%global efi_vendor msvsphere +%global efidir msvsphere +%global efi_esp_dir /boot/efi/EFI/%{efidir} + Name: shim Version: 15.6 Release: 1.el8.inferit @@ -8,8 +12,10 @@ BuildRequires: efi-filesystem BuildRequires: efi-srpm-macros >= 3-2 ExclusiveArch: %{efi} +# but we don't build a .i686 package, just a shim-ia32.x86_64 package +ExcludeArch: %{ix86} # and we don't have shim-unsigned-arm builds *yet* -ExcludeArch: %{arm} %{ix86} +ExcludeArch: %{arm} Source0: shim.rpmmacros Source1: spheresecureboot001.cer @@ -19,17 +25,13 @@ Source2: spheresecurebootca.cer # match, 1 and 11 match, ... #Source10: BOOTAA64.CSV #Source20: shimaa64.efi -#Source30: mmaa64.efi -#Source40: fbaa64.efi -# MSVSphere note: currently we support only the x86_64 architecture +# MSVSphere note: currently we support only ia32 and x86 architecture +Source11: BOOTIA32.CSV +Source21: shimia32.efi Source12: BOOTX64.CSV Source22: shimx64.efi -Source32: mmx64.efi -Source42: fbx64.efi #Source13: BOOTARM.CSV #Source23: shimarm.efi -#Source33: mmarm.efi -#Source43: fbarm.efi %include %{SOURCE0} @@ -40,8 +42,8 @@ BuildRequires: pesign >= 0.112-20.fc27 # (shim 16+) by making the unsigned packages all provide "shim-unsigned", so # we can just BuildRequires that. %ifarch x86_64 -## BuildRequires: %% {unsignedx64} = %% {shimverx64} BuildRequires: shim-unsigned-x64 = 15.6-1.el8.inferit +BuildRequires: shim-unsigned-ia32 = 15.6-1.el8.inferit %endif %ifarch aarch64 BuildRequires: %{unsignedaa64} = %{shimveraa64} @@ -104,60 +106,71 @@ install -m 0700 %{shimefi} $RPM_BUILD_ROOT%{efi_esp_dir}/shim.efi %endif %changelog -* Fri Mar 24 2023 Eugene Zamriy - 15.6-1.inferit +* Fri Dec 22 2023 Arkady L. Shane - 15.6-1.inferit - Modified to use MSVSphere Secure Boot certificates - Disabled aarch64 architecture until we support it -- Rebuilt for MSVSphere 9.1 -* Mon Jun 06 2022 Peter Jones - 15.6-1.el9 +* Wed Jul 26 2023 MSVSphere Packaging Team - 15.6-1 +- Rebuilt for MSVSphere 8.8 + +* Mon Jun 06 2022 Peter Jones - 15.6-1 - Update to shim-15.6 Resolves: CVE-2022-28737 -* Thu Apr 14 2022 Peter Jones - 15.5-2.el9 -- Attempt to make aarch64 build. - Related: rhbz#1932057 - -* Thu Apr 14 2022 Peter Jones - 15.5-1.el9 -- Rebuild for rhel-9.0.0 - Resolves: rhbz#1932057 - * Mon Sep 21 2020 Javier Martinez Canillas - 15-16 - Fix an incorrect allocation size + Resolves: rhbz#1877253 * Fri Jul 31 2020 Peter Jones - 15-15 - Update once again for new signed shim builds. + Resolves: rhbz#1861977 * Tue Jul 28 2020 Peter Jones - 15-14 - Get rid of our %%dist hack for now. * Tue Jul 28 2020 Peter Jones - 15-13 - New signing keys + Related: CVE-2020-10713 + Related: CVE-2020-14308 + Related: CVE-2020-14309 + Related: CVE-2020-14310 + Related: CVE-2020-14311 * Thu Jun 11 2020 Javier Martinez Canillas - 15-12 - Fix firmware update bug in aarch64 caused by shim ignoring arguments + Resolves: rhbz#1830871 - Fix a shim crash when attempting to netboot + Resolves: rhbz#1795654 * Fri Jun 07 2019 Javier Martinez Canillas - 15-11 - Update the shim-unsigned-aarch64 version number + Related: rhbz#1715879 * Fri Jun 07 2019 Javier Martinez Canillas - 15-10 - Add a gating.yaml file so the package can be properly gated + Related: rhbz#1681809 * Wed Jun 05 2019 Javier Martinez Canillas - 15-9 - Bump the NVR + Related: rhbz#1715879 * Wed Jun 05 2019 Javier Martinez Canillas - 15-7 - Make EFI variable copying fatal only on secureboot enabled systems + Resolves: rhbz#1715879 - Fix booting shim from an EFI shell using a relative path + Resolves: rhbz#1717061 * Thu Mar 14 2019 Peter Jones - 15-6 - Fix MoK mirroring issue which breaks kdump without intervention + Resolves: rhbz#1668966 * Thu Jan 24 2019 Peter Jones - 15-5 - Rebuild for signing once again. If the signer actually works, then: + Resolves: rhbz#1620941 * Tue Oct 16 2018 Peter Jones - 15-4 - Rebuild for signing + Resolves: rhbz#1620941 * Mon Aug 13 2018 Troy Dawson - Release Bumped for el8 Mass Rebuild