From 862700c5f969faff2e64d459d0005d4318f55f01 Mon Sep 17 00:00:00 2001 From: tigro Date: Fri, 22 Dec 2023 22:36:09 +0300 Subject: [PATCH] Fix build --- .shim.metadata | 5 ++- SOURCES/BOOTIA32.CSV | Bin 0 -> 122 bytes SOURCES/shim.rpmmacros | 72 +++++++++++++---------------------------- SPECS/shim.spec | 53 ++++++++++++++++++------------ 4 files changed, 57 insertions(+), 73 deletions(-) create mode 100644 SOURCES/BOOTIA32.CSV diff --git a/.shim.metadata b/.shim.metadata index a99a2be..f1dd333 100644 --- a/.shim.metadata +++ b/.shim.metadata @@ -1,3 +1,2 @@ -a90efeb1562bde896b930fe40a09d22284cad2fc SOURCES/fbx64.efi -03da6effba89aa015501640bf486973b8b74f47f SOURCES/mmx64.efi -888dfe2b9f8c3eaec7db4ecf282dacd81229b5d0 SOURCES/shimx64.efi +be027373ba823a967e6d92f3aaa855869ca0ce30 SOURCES/shimia32.efi +d7cdcbd38a363a458cbe571ea7bc0f592ab5f52b SOURCES/shimx64.efi diff --git a/SOURCES/BOOTIA32.CSV b/SOURCES/BOOTIA32.CSV new file mode 100644 index 0000000000000000000000000000000000000000..568e0a72d20f3380d5405a87019274646e742904 GIT binary patch literal 122 zcmZXMOA3H65JTVEQ+R;lLa*Wl6k2rQhqegb-ltm$nam_%3JWWnoEYfoh$OF|SGeS9 hBa&qh= 1:0.3.0-1 \ Requires: efi-filesystem \ Provides: shim-signed-%{-a*} = %{version}-%{release} \ Requires: dbxtool >= 0.6-3 \ +Requires: %{efi_esp_dir}/grub%{-a*}.efi \ %{expand:%%if 0%%{-p*} \ Provides: shim = %{version}-%{release} \ Provides: shim-signed = %{version}-%{release} \ @@ -77,17 +69,15 @@ version signed by the UEFI signing service. \ # -a # -i -%define hash(a:i:d:) \ - if [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ - pesign -i %{-i*} -h -P > shim.hash \ - read file0 hash0 < shim.hash \ - read file1 hash1 < %{-d*}/shim%{-a*}.hash \ - if ! [ "$hash0" = "$hash1" ] ; then \ - echo Invalid signature\! > /dev/stderr \ - echo $hash0 vs $hash1 \ - exit 1 \ - fi \ - fi \ +%define hash(a:i:d:) \ + pesign -i %{-i*} -h -P > shim.hash \ + read file0 hash0 < shim.hash \ + read file1 hash1 < %{-d*}/shim%{-a*}.hash \ + if ! [ "$hash0" = "$hash1" ]; then \ + echo Invalid signature\! > /dev/stderr \ + echo $hash0 vs $hash1 \ + exit 1 \ + fi \ %{nil} # -i @@ -99,25 +89,9 @@ version signed by the UEFI signing service. \ # -b # -a # -i -%define distrosign(b:a:d:) \ - if [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ - if [ "%{-b*}%{-a*}" = "shim%{efi_arch}" ] ; then \ - cp -av "%{shimefi}" %{-b*}%{-a*}-unsigned.efi \ - elif [ "%{-b*}%{-a*}" = "shim%{efi_alt_arch}" ] ; then \ - cp -av "%{shimefialt}" %{-b*}%{-a*}-unsigned.efi \ - elif [ "%{-b*}%{-a*}" = "mm%{efi_arch}" ] ; then \ - cp -av "%{mmefi}" %{-b*}%{-a*}-unsigned.efi \ - elif [ "%{-b*}%{-a*}" = "mm%{efi_alt_arch}" ] ; then \ - cp -av "%{mmefialt}" %{-b*}%{-a*}-unsigned.efi \ - elif [ "%{-b*}%{-a*}" = "fb%{efi_arch}" ] ; then \ - cp -av "%{fbefi}" %{-b*}%{-a*}-unsigned.efi \ - elif [ "%{-b*}%{-a*}" = "fb%{efi_alt_arch}" ] ; then \ - cp -av "%{fbefialt}" %{-b*}%{-a*}-unsigned.efi \ - fi \ - else \ - cp -av %{-d*}/%{-b*}%{-a*}.efi %{-b*}%{-a*}-unsigned.efi \ - fi \ - %{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi -n redhatsecureboot501 -a %{SOURCE2} -c %{SOURCE1} } \ +%define distrosign(b:a:d:) \ + cp -av %{-d*}/%{-b*}%{-a*}.efi %{-b*}%{-a*}-unsigned.efi \ + %{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi -n redhatsecureboot501 -a %{SOURCE2} -c %{SOURCE1} }\ %{nil} # -a @@ -125,18 +99,16 @@ version signed by the UEFI signing service. \ # -b <1|0> # signed by this builder? # -c <1|0> # signed by UEFI CA? # -i -# -d /usr/share dir for this build (full path) %define define_build(a:A:b:c:i:d:) \ if [ "%{-c*}" = "yes-temporarily-disabled-20180723" ]; then \ %{expand:%%hash -i %{-i*} -a %{-a*} -d %{-d*}} \ fi \ cp %{-i*} shim%{-a*}.efi \ -if [ "%{-b*}" = "yes" ] ; then \ +if [ "%{-b*}" = "yes" ]; then \ %{expand:%%distrosign -b shim -a %{-a*} -d %{-d*}} \ mv shim%{-a*}-signed.efi shim%{-a*}-%{efi_vendor}.efi \ fi \ -if [ "%{-c*}" = "no" ] || \ - [ 0%{?_unsigned_test_build:%{_unsigned_test_build}} -ne 0 ] ; then \ +if [ "%{-c*}" = "no" ]; then \ cp shim%{-a*}-%{efi_vendor}.efi shim%{-a*}.efi \ fi \ %{expand:%%distrosign -b mm -a %{-a*} -d %{-d*}} \ @@ -179,7 +151,7 @@ install -m 0700 fb%{-a*}.efi \\\ %ifarch x86_64 %global is_signed yes -%global is_alt_signed no +%global is_alt_signed yes %global provide_legacy_shim 1 %endif %ifarch aarch64 diff --git a/SPECS/shim.spec b/SPECS/shim.spec index 9f94092..db8875c 100644 --- a/SPECS/shim.spec +++ b/SPECS/shim.spec @@ -1,3 +1,7 @@ +%global efi_vendor msvsphere +%global efidir msvsphere +%global efi_esp_dir /boot/efi/EFI/%{efidir} + Name: shim Version: 15.6 Release: 1.el8.inferit @@ -8,8 +12,10 @@ BuildRequires: efi-filesystem BuildRequires: efi-srpm-macros >= 3-2 ExclusiveArch: %{efi} +# but we don't build a .i686 package, just a shim-ia32.x86_64 package +ExcludeArch: %{ix86} # and we don't have shim-unsigned-arm builds *yet* -ExcludeArch: %{arm} %{ix86} +ExcludeArch: %{arm} Source0: shim.rpmmacros Source1: spheresecureboot001.cer @@ -19,17 +25,13 @@ Source2: spheresecurebootca.cer # match, 1 and 11 match, ... #Source10: BOOTAA64.CSV #Source20: shimaa64.efi -#Source30: mmaa64.efi -#Source40: fbaa64.efi -# MSVSphere note: currently we support only the x86_64 architecture +# MSVSphere note: currently we support only ia32 and x86 architecture +Source11: BOOTIA32.CSV +Source21: shimia32.efi Source12: BOOTX64.CSV Source22: shimx64.efi -Source32: mmx64.efi -Source42: fbx64.efi #Source13: BOOTARM.CSV #Source23: shimarm.efi -#Source33: mmarm.efi -#Source43: fbarm.efi %include %{SOURCE0} @@ -40,8 +42,8 @@ BuildRequires: pesign >= 0.112-20.fc27 # (shim 16+) by making the unsigned packages all provide "shim-unsigned", so # we can just BuildRequires that. %ifarch x86_64 -## BuildRequires: %% {unsignedx64} = %% {shimverx64} BuildRequires: shim-unsigned-x64 = 15.6-1.el8.inferit +BuildRequires: shim-unsigned-ia32 = 15.6-1.el8.inferit %endif %ifarch aarch64 BuildRequires: %{unsignedaa64} = %{shimveraa64} @@ -104,60 +106,71 @@ install -m 0700 %{shimefi} $RPM_BUILD_ROOT%{efi_esp_dir}/shim.efi %endif %changelog -* Fri Mar 24 2023 Eugene Zamriy - 15.6-1.inferit +* Fri Dec 22 2023 Arkady L. Shane - 15.6-1.inferit - Modified to use MSVSphere Secure Boot certificates - Disabled aarch64 architecture until we support it -- Rebuilt for MSVSphere 9.1 -* Mon Jun 06 2022 Peter Jones - 15.6-1.el9 +* Wed Jul 26 2023 MSVSphere Packaging Team - 15.6-1 +- Rebuilt for MSVSphere 8.8 + +* Mon Jun 06 2022 Peter Jones - 15.6-1 - Update to shim-15.6 Resolves: CVE-2022-28737 -* Thu Apr 14 2022 Peter Jones - 15.5-2.el9 -- Attempt to make aarch64 build. - Related: rhbz#1932057 - -* Thu Apr 14 2022 Peter Jones - 15.5-1.el9 -- Rebuild for rhel-9.0.0 - Resolves: rhbz#1932057 - * Mon Sep 21 2020 Javier Martinez Canillas - 15-16 - Fix an incorrect allocation size + Resolves: rhbz#1877253 * Fri Jul 31 2020 Peter Jones - 15-15 - Update once again for new signed shim builds. + Resolves: rhbz#1861977 * Tue Jul 28 2020 Peter Jones - 15-14 - Get rid of our %%dist hack for now. * Tue Jul 28 2020 Peter Jones - 15-13 - New signing keys + Related: CVE-2020-10713 + Related: CVE-2020-14308 + Related: CVE-2020-14309 + Related: CVE-2020-14310 + Related: CVE-2020-14311 * Thu Jun 11 2020 Javier Martinez Canillas - 15-12 - Fix firmware update bug in aarch64 caused by shim ignoring arguments + Resolves: rhbz#1830871 - Fix a shim crash when attempting to netboot + Resolves: rhbz#1795654 * Fri Jun 07 2019 Javier Martinez Canillas - 15-11 - Update the shim-unsigned-aarch64 version number + Related: rhbz#1715879 * Fri Jun 07 2019 Javier Martinez Canillas - 15-10 - Add a gating.yaml file so the package can be properly gated + Related: rhbz#1681809 * Wed Jun 05 2019 Javier Martinez Canillas - 15-9 - Bump the NVR + Related: rhbz#1715879 * Wed Jun 05 2019 Javier Martinez Canillas - 15-7 - Make EFI variable copying fatal only on secureboot enabled systems + Resolves: rhbz#1715879 - Fix booting shim from an EFI shell using a relative path + Resolves: rhbz#1717061 * Thu Mar 14 2019 Peter Jones - 15-6 - Fix MoK mirroring issue which breaks kdump without intervention + Resolves: rhbz#1668966 * Thu Jan 24 2019 Peter Jones - 15-5 - Rebuild for signing once again. If the signer actually works, then: + Resolves: rhbz#1620941 * Tue Oct 16 2018 Peter Jones - 15-4 - Rebuild for signing + Resolves: rhbz#1620941 * Mon Aug 13 2018 Troy Dawson - Release Bumped for el8 Mass Rebuild