Compare commits
No commits in common. "rawhide" and "f27" have entirely different histories.
8
.gitignore
vendored
8
.gitignore
vendored
@ -1,6 +1,4 @@
|
||||
shim*.efi
|
||||
*.tar.*
|
||||
clog
|
||||
*.rpm
|
||||
*/
|
||||
.build*.log
|
||||
*~
|
||||
.*.sw?
|
||||
/rhtest.cer
|
||||
|
||||
BIN
BOOTAA64.CSV
BIN
BOOTAA64.CSV
Binary file not shown.
|
BIN
BOOTARM.CSV
BIN
BOOTARM.CSV
Binary file not shown.
|
BIN
BOOTIA32.CSV
BIN
BOOTIA32.CSV
Binary file not shown.
|
BIN
BOOTX64.CSV
BIN
BOOTX64.CSV
Binary file not shown.
|
BIN
fedora-ca.cer
Normal file
BIN
fedora-ca.cer
Normal file
Binary file not shown.
174
shim.rpmmacros
174
shim.rpmmacros
@ -1,174 +0,0 @@
|
||||
%global debug_package %{nil}
|
||||
%global __brp_mangle_shebangs_exclude_from_file %{expand:%{_builddir}/shim-%{efi_arch}-%{version}-%{release}.%{_target_cpu}-shebangs.txt}
|
||||
%global vendor_token_str %{expand:%%{nil}%%{?vendor_token_name:-t "%{vendor_token_name}"}}
|
||||
%global vendor_cert_str %{expand:%%{!?vendor_cert_nickname:-c "Red Hat Test Certificate"}%%{?vendor_cert_nickname:-c "%%{vendor_cert_nickname}"}}
|
||||
|
||||
%global grub_version 2.06~rc1
|
||||
%global fwupd_version 1.5.8
|
||||
|
||||
%global bootcsvaa64 %{expand:%{SOURCE10}}
|
||||
%global bootcsvarm %{expand:%{SOURCE13}}
|
||||
%global bootcsvia32 %{expand:%{SOURCE11}}
|
||||
%global bootcsvx64 %{expand:%{SOURCE12}}
|
||||
|
||||
%global shimefiaa64 %{expand:%{SOURCE20}}
|
||||
%global shimefiarm %{expand:%{SOURCE23}}
|
||||
%global shimefiia32 %{expand:%{SOURCE21}}
|
||||
%global shimefix64 %{expand:%{SOURCE22}}
|
||||
|
||||
%global shimveraa64 15.6-2
|
||||
%global shimverarm 15.4-1.fc34
|
||||
%global shimveria32 15.6-1
|
||||
%global shimverx64 15.6-1
|
||||
|
||||
%global shimdiraa64 %{_datadir}/shim/%{shimveraa64}/aa64
|
||||
%global shimdirarm %{_datadir}/shim/%{shimverarm}/arm
|
||||
%global shimdiria32 %{_datadir}/shim/%{shimveria32}/ia32
|
||||
%global shimdirx64 %{_datadir}/shim/%{shimverx64}/x64
|
||||
|
||||
%global unsignedaa64 shim-unsigned-aarch64
|
||||
%global unsignedarm shim-unsigned-arm
|
||||
%global unsignedia32 shim-unsigned-ia32
|
||||
%global unsignedx64 shim-unsigned-x64
|
||||
|
||||
%global bootcsv %{expand:%{bootcsv%{efi_arch}}}
|
||||
%global bootcsvalt %{expand:%{bootcsv%{?efi_alt_arch}}}
|
||||
%global shimefi %{expand:%{shimefi%{efi_arch}}}
|
||||
%global shimefialt %{expand:%{shimefi%{?efi_alt_arch}}}
|
||||
%global shimver %{expand:%{shimver%{efi_arch}}}
|
||||
%global shimveralt %{expand:%{shimver%{?efi_alt_arch}}}
|
||||
%global shimdir %{expand:%{shimdir%{efi_arch}}}
|
||||
%global shimdiralt %{expand:%{shimdir%{?efi_alt_arch}}}
|
||||
|
||||
%global unsignednone shim-unsigned-none
|
||||
%global unsigned %{expand:%%{unsigned%{efi_arch}}}
|
||||
%global unsignedalt %{expand:%%{unsigned%{efi_alt_arch}}}
|
||||
|
||||
%define define_pkg(a:p:) \
|
||||
%{expand:%%package -n shim-%{-a*}} \
|
||||
Summary: First-stage UEFI bootloader \
|
||||
Requires: mokutil >= 1:0.3.0-15 \
|
||||
Requires: efi-filesystem \
|
||||
Provides: shim-signed-%{-a*} = %{version}-%{release} \
|
||||
Conflicts: fwupd < %{fwupd_version} \
|
||||
Requires: grub2-efi-%{-a*} >= %{grub_version} \
|
||||
Conflicts: grub2-efi-%{-a*} < %{grub_version} \
|
||||
%{expand:%%if 0%%{-p*} \
|
||||
Provides: shim = %{version}-%{release} \
|
||||
Provides: shim-signed = %{version}-%{release} \
|
||||
Obsoletes: shim-signed < %{version}-%{release} \
|
||||
Obsoletes: shim < %{version}-%{release} \
|
||||
%%endif} \
|
||||
# Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI \
|
||||
# is not compatible with SysV (there's no red zone under UEFI) and \
|
||||
# there isn't a POSIX-style C library. \
|
||||
# BuildRequires: OpenSSL \
|
||||
Provides: bundled(openssl) = 1.0.2j \
|
||||
\
|
||||
%{expand:%%description -n shim-%{-a*}} \
|
||||
Initial UEFI bootloader that handles chaining to a trusted full \
|
||||
bootloader under secure boot environments. This package contains the \
|
||||
version signed by the UEFI signing service. \
|
||||
%{nil}
|
||||
|
||||
# -a <efiarch>
|
||||
# -i <input>
|
||||
%define hash(a:i:d:) \
|
||||
pesign -i %{-i*} -h -P > shim.hash \
|
||||
read file0 hash0 < shim.hash \
|
||||
read file1 hash1 < %{-d*}/shim%{-a*}.hash \
|
||||
if ! [ "$hash0" = "$hash1" ]; then \
|
||||
echo Invalid signature\! > /dev/stderr \
|
||||
echo $hash0 vs $hash1 \
|
||||
exit 1 \
|
||||
fi \
|
||||
%{nil}
|
||||
|
||||
# -i <input>
|
||||
# -o <output>
|
||||
%define sign(i:o:) \
|
||||
%{expand:%%pesign -s -i %{-i*} -o %{-o*}} \
|
||||
%{nil}
|
||||
|
||||
# -b <binary prefix>
|
||||
# -a <efiarch>
|
||||
# -i <input>
|
||||
%define distrosign(b:a:d:) \
|
||||
cp -av %{-d*}/%{-b*}%{-a*}.efi %{-b*}%{-a*}-unsigned.efi \
|
||||
%{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi}\
|
||||
%{nil}
|
||||
|
||||
# -a <efiarch>
|
||||
# -A <EFIARCH>
|
||||
# -b <1|0> # signed by this builder?
|
||||
# -c <1|0> # signed by UEFI CA?
|
||||
# -i <shimARCH.efi>
|
||||
%define define_build(a:A:b:c:i:d:) \
|
||||
if [ "%{-c*}" = "yes" ]; then \
|
||||
%{expand:%%hash -i %{-i*} -a %{-a*} -d %{-d*}} \
|
||||
fi \
|
||||
cp %{-i*} shim%{-a*}.efi \
|
||||
if [ "%{-b*}" = "yes" ]; then \
|
||||
%{expand:%%distrosign -b shim -a %{-a*} -d %{-d*}} \
|
||||
mv shim%{-a*}-signed.efi shim%{-a*}-%{efi_vendor}.efi \
|
||||
fi \
|
||||
if [ "%{-c*}" = "no" ] && [ "%{-b*}" = "yes" ]; then \
|
||||
cp shim%{-a*}-%{efi_vendor}.efi shim%{-a*}.efi \
|
||||
fi \
|
||||
%{expand:%%distrosign -b mm -a %{-a*} -d %{-d*}} \
|
||||
mv mm%{-a*}-signed.efi mm%{-a*}.efi \
|
||||
%{expand:%%distrosign -b fb -a %{-a*} -d %{-d*}} \
|
||||
mv fb%{-a*}-signed.efi fb%{-a*}.efi \
|
||||
rm -vf \\\
|
||||
mm%{-a*}-unsigned.efi \\\
|
||||
fb%{-a*}-unsigned.efi \\\
|
||||
shim%{-a*}-unsigned.efi \
|
||||
%{nil}
|
||||
|
||||
# -a <efiarch>
|
||||
# -A <EFIARCH>
|
||||
# -b <BOOTCSV>
|
||||
%define do_install(a:A:b:) \
|
||||
install -m 0700 shim%{-a*}.efi \\\
|
||||
$RPM_BUILD_ROOT%{efi_esp_dir}/shim%{-a*}.efi \
|
||||
install -m 0700 mm%{-a*}.efi \\\
|
||||
$RPM_BUILD_ROOT%{efi_esp_dir}/mm%{-a*}.efi \
|
||||
install -m 0700 %{-b*} \\\
|
||||
$RPM_BUILD_ROOT%{efi_esp_dir}/BOOT%{-A*}.CSV \
|
||||
install -m 0700 shim%{-a*}.efi \\\
|
||||
$RPM_BUILD_ROOT%{efi_esp_boot}/BOOT%{-A*}.EFI \
|
||||
install -m 0700 fb%{-a*}.efi \\\
|
||||
$RPM_BUILD_ROOT%{efi_esp_boot}/fb%{-a*}.efi \
|
||||
%nil
|
||||
|
||||
# -a <efiarch>
|
||||
# -A <EFIARCH>
|
||||
%define define_files(a:A:) \
|
||||
%{expand:%%files -n shim-%{-a*}} \
|
||||
%{efi_esp_dir}/*%{-a*}*.efi \
|
||||
%{efi_esp_dir}/BOOT%{-A*}.CSV \
|
||||
%{efi_esp_boot}/*%{-a*}.efi \
|
||||
%{efi_esp_boot}/*%{-A*}.EFI \
|
||||
%{nil}
|
||||
|
||||
%ifarch x86_64
|
||||
%global is_signed yes
|
||||
%global is_alt_signed no
|
||||
%global provide_legacy_shim 1
|
||||
%endif
|
||||
%ifarch aarch64
|
||||
%global is_signed no
|
||||
%global is_alt_signed no
|
||||
%global provide_legacy_shim 1
|
||||
%endif
|
||||
%ifnarch x86_64 aarch64
|
||||
%global is_signed no
|
||||
%global is_alt_signed no
|
||||
%global provide_legacy_shim 0
|
||||
%endif
|
||||
|
||||
%if ! 0%{?vendor:1}
|
||||
%global vendor nopenopenope
|
||||
%endif
|
||||
|
||||
# vim:filetype=rpmmacros
|
||||
383
shim.spec
383
shim.spec
@ -1,304 +1,151 @@
|
||||
# this is to make us only expand %%{dist} if we're on a modularity build.
|
||||
# it's 2 macros make vim's \c not put a brace at the end of the changelog.
|
||||
%global _dist %{expand:%{?_module_build:%%{?dist}}}
|
||||
%global dist %{expand:%%{_dist}}
|
||||
Name: shim
|
||||
Version: 0.9
|
||||
Release: 1%{?dist}
|
||||
Summary: First-stage UEFI bootloader
|
||||
|
||||
Name: shim
|
||||
Version: 15.6
|
||||
Release: 2%{?dist}
|
||||
Summary: First-stage UEFI bootloader
|
||||
License: BSD-3-Clause
|
||||
URL: https://github.com/rhboot/shim/
|
||||
BuildRequires: efi-filesystem
|
||||
BuildRequires: efi-srpm-macros >= 5-1
|
||||
License: BSD
|
||||
URL: https://github.com/rhinstaller/shim
|
||||
Source0: https://github.com/rhinstaller/shim/releases/download/%{version}/shim-%{version}.tar.bz2
|
||||
Source1: fedora-ca.cer
|
||||
|
||||
ExclusiveArch: %{efi}
|
||||
# but we don't build a .i686 package, just a shim-ia32.x86_64 package
|
||||
ExcludeArch: %{ix86}
|
||||
# but we don't build a .arm package, just a shim-arm.aarch64 package
|
||||
ExcludeArch: %{arm}
|
||||
# currently here's what's in our dbx:
|
||||
# grub2-efi-2.00-11.fc18.x86_64:
|
||||
# grubx64.efi 6ac839881e73504047c06a1aac0c4763408ecb3642783c8acf77a2d393ea5cd7
|
||||
# gcdx64.efi 065cd63bab696ad2f4732af9634d66f2c0d48f8a3134b8808750d378550be151
|
||||
# grub2-efi-2.00-11.fc19.x86_64:
|
||||
# grubx64.efi 49ece9a10a9403b32c8e0c892fd9afe24a974323c96f2cc3dd63608754bf9b45
|
||||
# gcdx64.efi 99fcaa957786c155a92b40be9c981c4e4685b8c62b408cb0f6cb2df9c30b9978
|
||||
# woops.
|
||||
Source2: dbx.esl
|
||||
Source3: rhtest.cer
|
||||
|
||||
Source0: shim.rpmmacros
|
||||
Source1: shim.conf
|
||||
BuildRequires: git openssl-devel openssl
|
||||
BuildRequires: pesign >= 0.106-1
|
||||
BuildRequires: gnu-efi >= 3.0.3-3
|
||||
BuildRequires: gnu-efi-devel >= 3.0.3-3
|
||||
|
||||
# keep these two lists of sources synched up arch-wise. That is 0 and 10
|
||||
# match, 1 and 11 match, ...
|
||||
Source10: BOOTAA64.CSV
|
||||
Source20: shimaa64.efi
|
||||
Source11: BOOTIA32.CSV
|
||||
Source21: shimia32.efi
|
||||
Source12: BOOTX64.CSV
|
||||
Source22: shimx64.efi
|
||||
#Source13: BOOTARM.CSV
|
||||
#Source23: shimarm.efi
|
||||
# Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not
|
||||
# compatible with SysV (there's no red zone under UEFI) and there isn't a
|
||||
# POSIX-style C library.
|
||||
# BuildRequires: OpenSSL
|
||||
Provides: bundled(openssl) = 0.9.8zb
|
||||
|
||||
%include %{SOURCE0}
|
||||
# Shim is only required on platforms implementing the UEFI secure boot
|
||||
# protocol. The only one of those we currently wish to support is 64-bit x86.
|
||||
# Adding further platforms will require adding appropriate relocation code.
|
||||
ExclusiveArch: x86_64
|
||||
|
||||
BuildRequires: pesign >= 0.112-20.fc27
|
||||
# We need this because %%{efi} won't expand before choosing where to make
|
||||
# the src.rpm in koji, and we could be on a non-efi architecture, in which
|
||||
# case we won't have a valid expansion here... To be solved in the future
|
||||
# (shim 16+) by making the unsigned packages all provide "shim-unsigned", so
|
||||
# we can just BuildRequires that.
|
||||
%ifarch x86_64
|
||||
BuildRequires: %{unsignedx64} = %{shimverx64}
|
||||
BuildRequires: %{unsignedia32} = %{shimveria32}
|
||||
%global efiarch x64
|
||||
|
||||
# Figure out the right file path to use
|
||||
%if 0%{?rhel}
|
||||
%global efidir redhat
|
||||
%endif
|
||||
%ifarch aarch64
|
||||
BuildRequires: %{unsignedaa64} = %{shimveraa64}
|
||||
#BuildRequires: %% {unsignedarm} = %% {shimverarm}
|
||||
%if 0%{?fedora}
|
||||
%global efidir fedora
|
||||
%endif
|
||||
|
||||
%description
|
||||
Initial UEFI bootloader that handles chaining to a trusted full bootloader
|
||||
under secure boot environments. This package contains the version signed by
|
||||
the UEFI signing service.
|
||||
under secure boot environments.
|
||||
|
||||
%define_pkg -a %{efi_arch} -p 1
|
||||
%if %{efi_has_alt_arch}
|
||||
%define_pkg -a %{efi_alt_arch}
|
||||
%endif
|
||||
%package -n shim-unsigned
|
||||
Summary: First-stage UEFI bootloader (unsigned data)
|
||||
|
||||
%description -n shim-unsigned
|
||||
Initial UEFI bootloader that handles chaining to a trusted full bootloader
|
||||
under secure boot environments.
|
||||
|
||||
%prep
|
||||
cd %{_builddir}
|
||||
rm -rf shim-%{version}
|
||||
mkdir shim-%{version}
|
||||
%setup -q
|
||||
git init
|
||||
git config user.email "%{name}-owner@fedoraproject.org"
|
||||
git config user.name "Fedora Ninjas"
|
||||
git add .
|
||||
git commit -a -q -m "%{version} baseline."
|
||||
git am --ignore-whitespace %{patches} </dev/null
|
||||
git config --unset user.email
|
||||
git config --unset user.name
|
||||
|
||||
%build
|
||||
|
||||
cd shim-%{version}
|
||||
%if %{efi_has_alt_arch}
|
||||
%define_build -a %{efi_alt_arch} -A %{efi_alt_arch_upper} -i %{shimefialt} -b no -c %{is_alt_signed} -d %{shimdiralt}
|
||||
%endif
|
||||
%define_build -a %{efi_arch} -A %{efi_arch_upper} -i %{shimefi} -b no -c %{is_signed} -d %{shimdir}
|
||||
MAKEFLAGS=""
|
||||
if [ -f "%{SOURCE3}" ]; then
|
||||
MAKEFLAGS="VENDOR_CERT_FILE=%{SOURCE3} VENDOR_DBX_FILE=%{SOURCE2}"
|
||||
fi
|
||||
MAKEFLAGS="$MAKEFLAGS RELEASE=%{release}"
|
||||
make 'DEFAULT_LOADER=\\\\grub%{efiarch}.efi' ${MAKEFLAGS} shim.efi MokManager.efi fallback.efi
|
||||
|
||||
%install
|
||||
rm -rf $RPM_BUILD_ROOT
|
||||
cd shim-%{version}
|
||||
install -D -d -m 0755 $RPM_BUILD_ROOT/boot/
|
||||
install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_root}/
|
||||
install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_efi}/
|
||||
install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_dir}/
|
||||
install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_boot}/
|
||||
pesign -h -P -i shim.efi -h > shim.hash
|
||||
install -D -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/shim/
|
||||
install -m 0644 shim.efi $RPM_BUILD_ROOT%{_datadir}/shim/shim.efi
|
||||
install -m 0644 shim.hash $RPM_BUILD_ROOT%{_datadir}/shim/shim.hash
|
||||
install -m 0644 fallback.efi $RPM_BUILD_ROOT%{_datadir}/shim/fallback.efi
|
||||
install -m 0644 MokManager.efi $RPM_BUILD_ROOT%{_datadir}/shim/MokManager.efi
|
||||
# now install our .debug files...
|
||||
install -D -d -m 0755 $RPM_BUILD_ROOT/usr/lib/debug/%{_datadir}/shim/
|
||||
install -m 0644 shim.efi.debug $RPM_BUILD_ROOT/usr/lib/debug/%{_datadir}/shim/shim.efi.debug
|
||||
install -m 0644 fallback.efi.debug $RPM_BUILD_ROOT/usr/lib/debug/%{_datadir}/shim/fallback.efi.debug
|
||||
install -m 0644 MokManager.efi.debug $RPM_BUILD_ROOT/usr/lib/debug/%{_datadir}/shim/MokManager.efi.debug
|
||||
|
||||
%do_install -a %{efi_arch} -A %{efi_arch_upper} -b %{bootcsv}
|
||||
%if %{efi_has_alt_arch}
|
||||
%do_install -a %{efi_alt_arch} -A %{efi_alt_arch_upper} -b %{bootcsvalt}
|
||||
%endif
|
||||
|
||||
%if %{provide_legacy_shim}
|
||||
install -m 0700 %{shimefi} $RPM_BUILD_ROOT%{efi_esp_dir}/shim.efi
|
||||
%endif
|
||||
install -D -d -m 0755 $RPM_BUILD_ROOT%{_sysconfdir}/dnf/protected.d/
|
||||
install -m 0644 %{SOURCE1} $RPM_BUILD_ROOT%{_sysconfdir}/dnf/protected.d/
|
||||
|
||||
( cd $RPM_BUILD_ROOT ; find .%{efi_esp_root} -type f ) \
|
||||
| sed -e 's/\./\^/' -e 's,^\\\./,.*/,' -e 's,$,$,' > %{__brp_mangle_shebangs_exclude_from_file}
|
||||
|
||||
%define_files -a %{efi_arch} -A %{efi_arch_upper}
|
||||
%if %{provide_legacy_shim}
|
||||
%{efi_esp_dir}/shim.efi
|
||||
%endif
|
||||
%{_sysconfdir}/dnf/protected.d/shim.conf
|
||||
|
||||
%if %{efi_has_alt_arch}
|
||||
%define_files -a %{efi_alt_arch} -A %{efi_alt_arch_upper}
|
||||
%{_sysconfdir}/dnf/protected.d/shim.conf
|
||||
%endif
|
||||
%files -n shim-unsigned
|
||||
%doc
|
||||
%dir %{_datadir}/shim
|
||||
%{_datadir}/shim/*
|
||||
|
||||
%changelog
|
||||
* Thu Jul 07 2022 Robbie Harwood <rharwood@redhat.com> - 15.6-2
|
||||
- Update aarch64 (only) with relocation fixes
|
||||
- Resolves: #2101248
|
||||
* Fri Apr 28 2017 Petr Šabata <contyk@redhat.com> - 0.9-1
|
||||
- Updating to 0.9 to enable building with gcc7
|
||||
- Mostly mirroring the key shim-unsigned-aarch64 0.9 changes
|
||||
|
||||
* Wed Jun 15 2022 Peter Jones <pjones@redhat.com> - 15.6-1
|
||||
- Update to shim-15.6
|
||||
Resolves: CVE-2022-28737
|
||||
* Wed Dec 03 2014 Peter Jones <pjones@redhat.com> - 0.8-2
|
||||
- Fix bootloader path and whitelist certificates on ARM Aarch64.
|
||||
Resolves: rhbz#1170289
|
||||
|
||||
* Wed May 05 2021 Javier Martinez Canillas <javierm@redhat.com> - 15.4-5
|
||||
- Bump release to build for F35
|
||||
* Tue Oct 14 2014 Peter Jones <pjones@redhat.com> - 0.8-1
|
||||
- Update to 0.8
|
||||
Related: rhbz#1148230
|
||||
Related: rhbz#1148231
|
||||
Related: rhbz#1148232
|
||||
|
||||
* Wed Apr 21 2021 Javier Martinez Canillas <javierm@redhat.com> - 15.4-4
|
||||
- Fix handling of ignore_db and user_insecure_mode (pjones)
|
||||
- Fix booting on pre-UEFI Macs (pjones)
|
||||
- Fix mok variable storage allocation region (glin)
|
||||
Resolves: rhbz#1948432
|
||||
- Fix the package version in the .sbat data (pjones)
|
||||
* Wed Nov 06 2013 Peter Jones <pjones@redhat.com> - 0.7-1
|
||||
- Fix logic to handle SetupMode efi variable.
|
||||
|
||||
* Tue Apr 06 2021 Peter Jones <pjones@redhat.com> - 15.4-3
|
||||
- Mark signed shim packages as protected in dnf.
|
||||
Resolves: rhbz#1874541
|
||||
- Conflict with older fwupd, but don't require it.
|
||||
Resolves: rhbz#1877751
|
||||
* Thu Oct 31 2013 Peter Jones <pjones@redhat.com> - 0.6-1
|
||||
- Fix a FreePool(NULL) call on machines too old for SB
|
||||
|
||||
* Tue Apr 06 2021 Peter Jones <pjones@redhat.com> - 15.4-2
|
||||
- Update to shim 15.4
|
||||
- Support for revocations via the ".sbat" section and SBAT EFI variable
|
||||
- A new unit test framework and a bunch of unit tests
|
||||
- No external gnu-efi dependency
|
||||
- Better CI
|
||||
Resolves: CVE-2020-14372
|
||||
Resolves: CVE-2020-25632
|
||||
Resolves: CVE-2020-25647
|
||||
Resolves: CVE-2020-27749
|
||||
Resolves: CVE-2020-27779
|
||||
Resolves: CVE-2021-20225
|
||||
Resolves: CVE-2021-20233
|
||||
* Fri Oct 04 2013 Peter Jones <pjones@redhat.com> - 0.5-1
|
||||
- Update to 0.5
|
||||
|
||||
* Tue Oct 02 2018 Peter Jones <pjones@redhat.com> - 15-8
|
||||
- Build a -8 because I can't tag -7 into f30 for pretty meh reasons.
|
||||
* Tue Jun 11 2013 Peter Jones <pjones@redhat.com> - 0.4-1
|
||||
- Update to 0.4
|
||||
|
||||
* Tue Oct 02 2018 Peter Jones <pjones@redhat.com> - 15-7
|
||||
- Rebuild just because I'm dumb.
|
||||
* Fri Jun 07 2013 Peter Jones <pjones@redhat.com> - 0.3-2
|
||||
- Require gnu-efi-3.0q for now.
|
||||
- Don't allow mmx or sse during compilation.
|
||||
- Re-organize this so all real signing happens in shim-signed instead.
|
||||
- Split out mokutil
|
||||
|
||||
* Tue Oct 02 2018 Peter Jones <pjones@redhat.com> - 15-6
|
||||
- Put the legacy shim.efi binary in the right subpackage
|
||||
Resolves: rhbz#1631989
|
||||
* Wed Dec 12 2012 Peter Jones <pjones@redhat.com> - 0.2-3
|
||||
- Fix mokutil's idea of signature sizes.
|
||||
|
||||
* Fri May 04 2018 Peter Jones <pjones@redhat.com> - 15-5
|
||||
- Rework the .spec to use efi-rpm-macros.
|
||||
* Wed Nov 28 2012 Matthew Garrett <mjg59@srcf.ucam.org> - 0.2-2
|
||||
- Fix secure_mode() always returning true
|
||||
|
||||
* Fri May 04 2018 Peter Jones <pjones@redhat.com> - 15-4
|
||||
- Fix directory permissions to be 0700 on FAT filesystems
|
||||
* Mon Nov 26 2012 Matthew Garrett <mjg59@srcf.ucam.org> - 0.2-1
|
||||
- Update shim
|
||||
- Include mokutil
|
||||
- Add debuginfo package since mokutil is a userspace executable
|
||||
|
||||
* Mon Apr 30 2018 Peter Jones <pjones@redhat.com> - 15-3
|
||||
- Pick a release value that'll be higher than what's in F28.
|
||||
* Mon Oct 22 2012 Peter Jones <pjones@redhat.com> - 0.1-4
|
||||
- Produce an unsigned shim
|
||||
|
||||
* Mon Apr 30 2018 Peter Jones <pjones@redhat.com> - 15-1
|
||||
- Fix BOOT*.CSV and update release to -1
|
||||
* Tue Aug 14 2012 Peter Jones <pjones@redhat.com> - 0.1-3
|
||||
- Update how embedded cert and signing work.
|
||||
|
||||
* Tue Apr 24 2018 Peter Jones <pjones@redhat.com> - 15-0.1
|
||||
- Update to shim 15.
|
||||
- more reproduceable build
|
||||
- better checking for bad linker output
|
||||
- flicker-free console if there's no error output
|
||||
- improved http boot support
|
||||
- better protocol re-installation
|
||||
- dhcp proxy support
|
||||
- tpm measurement even when verification is disabled
|
||||
- more reproducable builds
|
||||
- measurement of everything verified through shim_verify()
|
||||
- coverity and scan-build checker make targets
|
||||
- misc cleanups
|
||||
* Mon Aug 13 2012 Josh Boyer <jwboyer@redhat.com> - 0.1-2
|
||||
- Add patch to fix image size calculation
|
||||
|
||||
* Tue Mar 06 2018 Peter Jones <pjones@redhat.com> - 13-5
|
||||
- Back off to the thing we had in 13-0.8 until I get new signatures.
|
||||
|
||||
* Wed Feb 28 2018 Peter Jones <pjones@redhat.com> - 13-4
|
||||
- Fix an inverted test that crept in in the signing macro. (Woops.)
|
||||
|
||||
* Wed Feb 28 2018 Peter Jones <pjones@redhat.com> - 13-2
|
||||
- Pivot the shim-signed package to be here.
|
||||
|
||||
* Wed Nov 01 2017 Peter Jones <pjones@redhat.com> - 13-1
|
||||
- Now with the actual signed 64-bit build of shim 13 for x64 as well.
|
||||
- Make everything under /boot/efi be mode 0700, since that's what FAT will
|
||||
show anyway, so that rpm -V is correct.
|
||||
Resolves: rhbz#1508516
|
||||
|
||||
* Tue Oct 24 2017 Peter Jones <pjones@redhat.com> - 13-0.8
|
||||
- Now with signed 32-bit x86 build.
|
||||
Related: rhbz#1474861
|
||||
|
||||
* Wed Oct 04 2017 Peter Jones <pjones@redhat.com> - 13-0.7
|
||||
- Make /boot/efi/EFI/fedora/shim.efi still exist on aarch64 as well.
|
||||
Resolves: rhbz#1497854
|
||||
|
||||
* Tue Sep 19 2017 Peter Jones <pjones@redhat.com> - 13-0.6
|
||||
- Fix binary format issue on Aarch64
|
||||
Resolves: rhbz#1489604
|
||||
|
||||
* Tue Sep 05 2017 Peter Jones <pjones@redhat.com> - 13-0.5
|
||||
- Make /boot/efi/EFI/fedora/shim.efi still exist on x86_64, since some
|
||||
machines have boot entries that point to it.
|
||||
|
||||
* Tue Aug 29 2017 Peter Jones <pjones@redhat.com> - 13-0.4
|
||||
- Make our provides not get silently ignore by rpmbuild...
|
||||
|
||||
* Fri Aug 25 2017 Peter Jones <pjones@redhat.com> - 13-0.3
|
||||
- x64: use the new fbx64.efi and mm64.efi as fallback.efi and MokManager.efi
|
||||
- Provide: "shim" in x64 and aa64 builds
|
||||
|
||||
* Thu Aug 24 2017 Peter Jones <pjones@redhat.com> - 13-0.2
|
||||
- Obsolete old shim builds.
|
||||
|
||||
* Tue Aug 22 2017 Peter Jones <pjones@redhat.com> - 13-0.1
|
||||
- Initial (partially unsigned) build for multi-arch support on x64/ia32.
|
||||
|
||||
* Thu Mar 23 2017 Petr Šabata <contyk@redhat.com> - 0.8-9
|
||||
- Re-enable dist tag for module builds
|
||||
|
||||
* Tue Feb 17 2015 Peter Jones <pjones@redhat.com> - 0.8-8
|
||||
- Don't dual-sign shim-%%{efidir}.efi either.
|
||||
Resolves: rhbz#1184765
|
||||
|
||||
* Tue Feb 17 2015 Peter Jones <pjones@redhat.com> - 0.8-8
|
||||
- Require dbxtool
|
||||
|
||||
* Wed Dec 17 2014 Peter Jones <pjones@redhat.com> - 0.8-7
|
||||
- Wrong -signed changes got built for aarch64 last time, for dumb reasons.
|
||||
Related: rhbz#1170289
|
||||
|
||||
* Fri Dec 05 2014 Peter Jones <pjones@redhat.com> - 0.8-6
|
||||
- Rebuild once more so we can use a different -unsigned version on different
|
||||
arches (because we can't tag a newer build into aarch64 without an x86
|
||||
update to match.)
|
||||
Related: rhbz#1170289
|
||||
|
||||
* Wed Dec 03 2014 Peter Jones <pjones@redhat.com> - 0.8-5
|
||||
- Rebuild for aarch64 path fixes
|
||||
Related: rhbz#1170289
|
||||
|
||||
* Thu Oct 30 2014 Peter Jones <pjones@redhat.com> - 0.8-2
|
||||
- Remove the dist tag so people don't complain about what it says.
|
||||
|
||||
* Fri Oct 24 2014 Peter Jones <pjones@redhat.com> - 0.8-1
|
||||
- Update to shim 0.8
|
||||
rhbz#1148230
|
||||
rhbz#1148231
|
||||
rhbz#1148232
|
||||
- Handle building on aarch64 as well
|
||||
|
||||
* Fri Jul 18 2014 Peter Jones <pjones@redhat.com> - 0.7-2
|
||||
- Don't do multi-signing; too many machines screw up verification.
|
||||
Resolves: rhbz#1049749
|
||||
|
||||
* Wed Nov 13 2013 Peter Jones <pjones@redhat.com> - 0.7-1
|
||||
- Update to shim 0.7
|
||||
Resolves: rhbz#1023767
|
||||
|
||||
* Thu Oct 24 2013 Peter Jones <pjones@redhat.com> - 0.5-1
|
||||
- Update to shim 0.5
|
||||
|
||||
* Thu Jun 20 2013 Peter Jones <pjones@redhat.com> - 0.4-1
|
||||
- Provide a fallback for uninitialized Boot#### and BootOrder
|
||||
Resolves: rhbz#963359
|
||||
- Move all signing from shim-unsigned to here
|
||||
- properly compare our generated hash from shim-unsigned with the hash of
|
||||
the signed binary (as opposed to doing it manually)
|
||||
|
||||
* Fri May 31 2013 Peter Jones <pjones@redhat.com> - 0.2-4.4
|
||||
- Re-sign to get alignments that match the new specification.
|
||||
Resolves: rhbz#963361
|
||||
|
||||
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.2-4.3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
|
||||
|
||||
* Wed Jan 02 2013 Peter Jones <pjones@redhat.com> - 0.2-3.3
|
||||
- Add obsoletes and provides for earlier shim-signed packages, to cover
|
||||
the package update cases where previous versions were installed.
|
||||
Related: rhbz#888026
|
||||
|
||||
* Mon Dec 17 2012 Peter Jones <pjones@redhat.com> - 0.2-3.2
|
||||
- Make the shim-unsigned dep be on the subpackage.
|
||||
|
||||
* Sun Dec 16 2012 Peter Jones <pjones@redhat.com> - 0.2-3.1
|
||||
- Rebuild to provide "shim" package directly instead of just as a Provides:
|
||||
|
||||
* Sat Dec 15 2012 Peter Jones <pjones@redhat.com> - 0.2-3
|
||||
- Also provide shim-fedora.efi, signed only by the fedora signer.
|
||||
- Fix the fedora signature on the result to actually be correct.
|
||||
- Update for shim-unsigned 0.2-3
|
||||
|
||||
* Mon Dec 03 2012 Peter Jones <pjones@redhat.com> - 0.2-2
|
||||
- Initial build
|
||||
* Mon Aug 13 2012 Matthew Garrett <mjg@redhat.com> - 0.1-1
|
||||
- initial release
|
||||
|
||||
5
sources
5
sources
@ -1,3 +1,2 @@
|
||||
SHA512 (shimx64.efi) = 06488f3f5daf09b3e37e160721e9bf4c68a3ea17dcd19fad7dd1d7edbcf4c218a5b6264e7780bef46e400213459c1a8c9a0c4c1c48f7fe5d7b55b868dbdc3823
|
||||
SHA512 (shimia32.efi) = 8241bed8c3e2789741da15e265efb6a1d35d02c4ffbfd21428910c9e366575137a3d9d0c73aa10e62d59d81a98496668a05c5ac7f18a677ccb54e884db48f507
|
||||
SHA512 (shimaa64.efi) = b2b77ebbdeda9f9110dd9a6ef4ad15ae57b53ce01ef5c912163159226dc39d5ed35e0dbcfa46dc8ab9f714b63aaea52cd42746aa54155313b43dd27dd57a62f5
|
||||
SHA512 (shim-0.9.tar.bz2) = 780f3eb3bfae366f25591eb5c46f7853614c03d79f88f0890f5e1bd614f2a9e859b355faa333894a16c048f50cbe9dc65ebe414e8fe07ce0657edec42836be0c
|
||||
SHA512 (rhtest.cer) = 33d20ec3540e75aca39d92971b65c7d0b6e35fde85dda2426f097fa4a8506d95693201de13e231fa06afce3bc0e05faf05976a7481ed3db1b9795b8fc045d468
|
||||
|
||||
Loading…
Reference in New Issue
Block a user