diff --git a/.gitignore b/.gitignore index e57fc72..adbd4d4 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,9 @@ +SOURCES/BOOTX64.CSV +SOURCES/fbaa64.efi SOURCES/fbx64.efi +SOURCES/mmaa64.efi SOURCES/mmx64.efi +SOURCES/redhatsecureboot501.cer +SOURCES/redhatsecurebootca5.cer SOURCES/shimaa64.efi SOURCES/shimx64.efi diff --git a/.shim.metadata b/.shim.metadata index bd1dd4b..553f2d9 100644 --- a/.shim.metadata +++ b/.shim.metadata @@ -1,4 +1,9 @@ -9ca9cfa834aedfaf3efe2216bfa1cb7c286ee1c0 SOURCES/fbx64.efi -5eb0ac78eee6aeeaf44a3f11d002b4fe00af6916 SOURCES/mmx64.efi -4312f246b6ba692040383f10358ac9a5927207de SOURCES/shimaa64.efi -783fb77783e9d0c4c400b723dfd0f02f006616ae SOURCES/shimx64.efi +6801abf1c4d54f15f869470c99e480433940407a SOURCES/BOOTX64.CSV +62b636517840e4f3027a3ecd549b7b3a95b05795 SOURCES/fbaa64.efi +9f6113ea26646fa3322c531e43c7522802bb3ecf SOURCES/fbx64.efi +211c4c134f7e1375f4618daa1e4858dd4259444a SOURCES/mmaa64.efi +933fe1154b024bfdab69346e78eaf4778fc2b76d SOURCES/mmx64.efi +ba0b760e594ff668ee72ae348adf3e49b97f75fb SOURCES/redhatsecureboot501.cer +e6f506462069aa17d2e8610503635c20f3a995c3 SOURCES/redhatsecurebootca5.cer +9c8bae2617420ba18ca6b6ac061a5bae6beb0040 SOURCES/shimaa64.efi +51bb003a7527b85e31fed0db68254a504c559dad SOURCES/shimx64.efi diff --git a/SOURCES/BOOTX64.CSV b/SOURCES/BOOTX64.CSV deleted file mode 100644 index 77b070b..0000000 Binary files a/SOURCES/BOOTX64.CSV and /dev/null differ diff --git a/SOURCES/fbaa64.efi b/SOURCES/fbaa64.efi deleted file mode 100644 index e69de29..0000000 diff --git a/SOURCES/mmaa64.efi b/SOURCES/mmaa64.efi deleted file mode 100644 index e69de29..0000000 diff --git a/SOURCES/redhatsecureboot501.cer b/SOURCES/redhatsecureboot501.cer deleted file mode 100644 index dfa7afb..0000000 Binary files a/SOURCES/redhatsecureboot501.cer and /dev/null differ diff --git a/SOURCES/redhatsecurebootca5.cer b/SOURCES/redhatsecurebootca5.cer deleted file mode 100644 index dfb0284..0000000 Binary files a/SOURCES/redhatsecurebootca5.cer and /dev/null differ diff --git a/SOURCES/shim.rpmmacros b/SOURCES/shim.rpmmacros index d1379ff..ccd0a92 100644 --- a/SOURCES/shim.rpmmacros +++ b/SOURCES/shim.rpmmacros @@ -3,6 +3,8 @@ %global vendor_token_str %{expand:%%{nil}%%{?vendor_token_name:-t "%{vendor_token_name}"}} %global vendor_cert_str %{expand:%%{!?vendor_cert_nickname:-c "Red Hat Test Certificate"}%%{?vendor_cert_nickname:-c "%%{vendor_cert_nickname}"}} +%global grub_version 2.06-27.el9_0.12 + %global bootcsvaa64 %{expand:%{SOURCE10}} %global bootcsvx64 %{expand:%{SOURCE12}} #%%global bootcsvarm %%{expand:%%{SOURCE13}} @@ -19,8 +21,8 @@ %global mmefix64 %{expand:%{SOURCE42}} #%%global mmefiarm %%{expand:%%{SOURCE43} -%global shimveraa64 15-6.el9 -%global shimverx64 15.6-1.el9 +%global shimveraa64 15.8-2.el9 +%global shimverx64 15.8-2.el9 #%%global shimverarm 15-1.el8 %global shimdiraa64 %{_datadir}/shim/%{shimveraa64}/aa64 @@ -55,6 +57,7 @@ Requires: mokutil >= 1:0.3.0-1 \ Requires: efi-filesystem \ Provides: shim-signed-%{-a*} = %{version}-%{release} \ Requires: dbxtool >= 0.6-3 \ +Conflicts: grub2-efi-%{-a*} < %{grub_version} \ %{expand:%%if 0%%{-p*} \ Provides: shim = %{version}-%{release} \ Provides: shim-signed = %{version}-%{release} \ @@ -169,10 +172,10 @@ install -m 0700 fb%{-a*}.efi \\\ # -A %define define_files(a:A:) \ %{expand:%%files -n shim-%{-a*}} \ -%{efi_esp_dir}/*%{-a*}*.efi \ -%{efi_esp_dir}/BOOT%{-A*}.CSV \ -%{efi_esp_boot}/*%{-a*}.efi \ -%{efi_esp_boot}/*%{-A*}.EFI \ +%%verify(not mtime) %{efi_esp_dir}/*%{-a*}*.efi \ +%%verify(not mtime) %{efi_esp_dir}/BOOT%{-A*}.CSV \ +%%verify(not mtime) %{efi_esp_boot}/*%{-a*}.efi \ +%%verify(not mtime) %{efi_esp_boot}/*%{-A*}.EFI \ %{nil} %ifarch x86_64 diff --git a/SPECS/shim.spec b/SPECS/shim.spec index c80796c..25bf08b 100644 --- a/SPECS/shim.spec +++ b/SPECS/shim.spec @@ -1,6 +1,6 @@ Name: shim -Version: 15.6 -Release: 1.el9 +Version: 15.8 +Release: 4%{?dist} Summary: First-stage UEFI bootloader License: BSD URL: https://github.com/rhboot/shim/ @@ -33,18 +33,17 @@ Source42: fbx64.efi %include %{SOURCE0} BuildRequires: pesign >= 0.112-20.fc27 -# We need this because %%{efi} won't expand before choosing where to make -# the src.rpm in koji, and we could be on a non-efi architecture, in which -# case we won't have a valid expansion here... To be solved in the future -# (shim 16+) by making the unsigned packages all provide "shim-unsigned", so -# we can just BuildRequires that. -%ifarch x86_64 -## BuildRequires: %% {unsignedx64} = %% {shimverx64} -BuildRequires: shim-unsigned-x64 = 15.6-1.el9 -%endif -%ifarch aarch64 -BuildRequires: %{unsignedaa64} = %{shimveraa64} -%endif +# Right now we're just including all of the parts from them as sources here +# to make the build+errata process less maddening. We do this because +# %%{efi} won't expand before choosing where to make the src.rpm in koji, +# and we could be on a non-efi architecture, in which case we won't have a +# valid expansion here... +#%% ifarch x86_64 +#BuildRequires: %% {unsignedx64} = %% {shimverx64} +#%% endif +#%% ifarch aarch64 +#BuildRequires: %% {unsignedaa64} = %% {shimveraa64} +#%% endif #%%ifarch arm #BuildRequires: %%{unsignedarm} = %%{shimverarm} #%%endif @@ -71,7 +70,8 @@ cd shim-%{version} %if %{efi_has_alt_arch} %define_build -a %{efi_alt_arch} -A %{efi_alt_arch_upper} -i %{shimefialt} -b yes -c %{is_alt_signed} -d %{shimdiralt} %endif -%define_build -a %{efi_arch} -A %{efi_arch_upper} -i %{shimefi} -b yes -c %{is_signed} -d %{shimdir} +# Temporarily using _sourcedir to avoid build dep annoyances. +%define_build -a %{efi_arch} -A %{efi_arch_upper} -i %{shimefi} -b yes -c %{is_signed} -d %{_sourcedir} %install rm -rf $RPM_BUILD_ROOT @@ -100,16 +100,28 @@ install -m 0700 %{shimefi} $RPM_BUILD_ROOT%{efi_esp_dir}/shim.efi %endif %if %{provide_legacy_shim} -%{efi_esp_dir}/shim.efi +%verify(not mtime) %{efi_esp_dir}/shim.efi %endif %changelog -* Wed Mar 15 2023 MSVSphere Packaging Team - 15.6-1 -- Rebuilt for MSVSphere 9.1. +* Tue Apr 16 2024 Peter Jones - 15.8-4 +- Rebuild to work around build system quirks. + Related: RHEL-11262 + +* Wed Apr 03 2024 Peter Jones - 15.8-3.el9 +- Fix rpm verification due to mtime granularity on FAT. + Related: RHEL-11262 -* Mon Jun 06 2022 Peter Jones - 15.6-1.el9 -- Update to shim-15.6 - Resolves: CVE-2022-28737 +* Thu Mar 21 2024 Peter Jones - 15.8-2.el9 +- Add the grub2-efi-ARCH conflict for SBAT. + Resolves: RHEL-11262 + +* Thu Mar 21 2024 Peter Jones - 15.8-1.el9 +- Update to shim-15.8 for CVE-2023-40547 + Resolves: RHEL-11262 + +* Wed Mar 15 2023 MSVSphere Packaging Team - 15.5-2.el9 +- Rebuilt for MSVSphere 9.1. * Thu Apr 14 2022 Peter Jones - 15.5-2.el9 - Attempt to make aarch64 build.