rpms/shim
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
97c61b1f4c
shim/shim.spec
Jason Montleon 97c61b1f4c Bump release for f41 rebuild 
Signed-off-by: Jason Montleon <jmontleo@redhat.com>
2024-09-11 19:28:30 -04:00

313 lines
11 KiB
RPMSpec
Raw Blame History

# this is to make us only expand %%{dist} if we're on a modularity build.
# it's 2 macros make vim's \c not put a brace at the end of the changelog.
%global _dist %{expand:%{?_module_build:%%{?dist}}}
%global dist %{expand:%%{_dist}}
%define debug_package %{nil}
%define shim_git_sha 0287c6b14c77eeb3e3c61996330850d43d937a2b
%define gnu_efi_git_sha 33727c2abe8a77dca612f04abd19e10cc5e487fd
Name: shim-unsigned-riscv64
Version: 15.8
Release: 3.1.riscv64%{?dist}
Summary: First-stage UEFI bootloader
License: BSD-3-Clause
URL: https://github.com/rhboot/shim/
BuildRequires: efi-filesystem
BuildRequires: efi-srpm-macros >= 5-1
ExclusiveArch: %{efi}
# but we don't build a .i686 package, just a shim-ia32.x86_64 package
ExcludeArch: %{ix86}
# but we don't build a .arm package, just a shim-arm.aarch64 package
ExcludeArch: %{arm}
Source0: shim-%{shim_git_sha}.tar.gz
Source1: gnu-efi-%{gnu_efi_git_sha}.tar.gz
Source2: BOOTRISCV64.csv
Source3: shim.rpmmacros
Source4: shim.conf
Patch1: 0002-Initial-RISC-V-support.patch
Patch2: 0003-bug-Remove-extraneous-configuration-from-RISC-V.patch
Patch3: 0004-Sync-elf_riscv64_efi.lds-with-gnu-efi.patch
Patch4: 0005-Implement-__riscv_flush_icache.patch
Patch5: 0006-Use-correct-ReallocatePool-ABI.patch
Patch6: 0007-Correct-signedness-when-calling-string-functions.patch
BuildRequires: gcc
BuildRequires: make
BuildRequires: pesign >= 0.112-20.fc27
# We need this because %%{efi} won't expand before choosing where to make
# the src.rpm in koji, and we could be on a non-efi architecture, in which
# case we won't have a valid expansion here... To be solved in the future
# (shim 16+) by making the unsigned packages all provide "shim-unsigned", so
# we can just BuildRequires that.
%ifarch x86_64
BuildRequires: %{unsignedx64} = %{shimverx64}
BuildRequires: %{unsignedia32} = %{shimveria32}
%endif
%ifarch aarch64
BuildRequires: %{unsignedaa64} = %{shimveraa64}
#BuildRequires: %% {unsignedarm} = %% {shimverarm}
%endif
%description
Initial UEFI bootloader that handles chaining to a trusted full bootloader
under secure boot environments. This package contains the version signed by
the UEFI signing service.
%define_pkg -a %{efi_arch} -p 1
%if %{efi_has_alt_arch}
%define_pkg -a %{efi_alt_arch}
%endif
%prep
%setup -n shim-%{shim_git_sha}
%patch 1 -p1
%patch 2 -p1
%patch 3 -p1
%patch 4 -p1
%patch 5 -p1
%patch 6 -p1
tar zxf %{SOURCE1}
rm -rf gnu-efi
mv gnu-efi-%{gnu_efi_git_sha} gnu-efi
%build
# Setting CFLAGS seems to break shim/gnu-efi/lib build
unset CFLAGS
make
%install
rm -rf $RPM_BUILD_ROOT
install -D -d -m 0755 $RPM_BUILD_ROOT/boot/
install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_root}/
install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_efi}/
install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_dir}/
install -D -d -m 0700 $RPM_BUILD_ROOT%{efi_esp_boot}/
install -m 0700 shim%{efi_arch}.efi $RPM_BUILD_ROOT%{efi_esp_dir}/shim%{efi_arch}.efi
install -m 0700 mm%{efi_arch}.efi $RPM_BUILD_ROOT%{efi_esp_dir}/mm%{efi_arch}.efi
install -m 0700 %{SOURCE2} $RPM_BUILD_ROOT%{efi_esp_dir}/BOOT%{efi_arch_upper}.CSV
install -m 0700 shim%{efi_arch}.efi $RPM_BUILD_ROOT%{efi_esp_boot}/BOOT%{efi_arch_upper}.EFI
install -m 0700 fb%{efi_arch}.efi $RPM_BUILD_ROOT%{efi_esp_boot}/fb%{efi_arch}.efi
install -D -d -m 0755 $RPM_BUILD_ROOT%{_sysconfdir}/dnf/protected.d/
install -m 0644 %{SOURCE4} $RPM_BUILD_ROOT%{_sysconfdir}/dnf/protected.d/
( cd $RPM_BUILD_ROOT ; find .%{efi_esp_root} -type f ) \
| sed -e 's/\./\^/' -e 's,^\\\./,.*/,' -e 's,$,$,' > %{__brp_mangle_shebangs_exclude_from_file}
%files
%{efi_esp_dir}/shim%{efi_arch}.efi
%{efi_esp_dir}/mm%{efi_arch}.efi
%{efi_esp_dir}/BOOT%{efi_arch_upper}.CSV
%{efi_esp_boot}/BOOT%{efi_arch_upper}.EFI
%{efi_esp_boot}/fb%{efi_arch}.efi
%{_sysconfdir}/dnf/protected.d/shim.conf
%changelog
* Wed Sep 11 2024 Jason Montleon <jmontleo@redhat.com> - 15.8-3.1.riscv64
- Bump release for f41 rebuild
* Tue Jun 25 2024 Jason Montleon <jmontleo@redhat.com> - 15.8-3.0.riscv64
- Build for riscv64
* Thu Jul 07 2022 Robbie Harwood <rharwood@redhat.com> - 15.6-2
- Update aarch64 (only) with relocation fixes
- Resolves: #2101248
* Wed Jun 15 2022 Peter Jones <pjones@redhat.com> - 15.6-1
- Update to shim-15.6
Resolves: CVE-2022-28737
* Wed May 05 2021 Javier Martinez Canillas <javierm@redhat.com> - 15.4-5
- Bump release to build for F35
* Wed Apr 21 2021 Javier Martinez Canillas <javierm@redhat.com> - 15.4-4
- Fix handling of ignore_db and user_insecure_mode (pjones)
- Fix booting on pre-UEFI Macs (pjones)
- Fix mok variable storage allocation region (glin)
Resolves: rhbz#1948432
- Fix the package version in the .sbat data (pjones)
* Tue Apr 06 2021 Peter Jones <pjones@redhat.com> - 15.4-3
- Mark signed shim packages as protected in dnf.
Resolves: rhbz#1874541
- Conflict with older fwupd, but don't require it.
Resolves: rhbz#1877751
* Tue Apr 06 2021 Peter Jones <pjones@redhat.com> - 15.4-2
- Update to shim 15.4
- Support for revocations via the ".sbat" section and SBAT EFI variable
- A new unit test framework and a bunch of unit tests
- No external gnu-efi dependency
- Better CI
Resolves: CVE-2020-14372
Resolves: CVE-2020-25632
Resolves: CVE-2020-25647
Resolves: CVE-2020-27749
Resolves: CVE-2020-27779
Resolves: CVE-2021-20225
Resolves: CVE-2021-20233
* Tue Oct 02 2018 Peter Jones <pjones@redhat.com> - 15-8
- Build a -8 because I can't tag -7 into f30 for pretty meh reasons.
* Tue Oct 02 2018 Peter Jones <pjones@redhat.com> - 15-7
- Rebuild just because I'm dumb.
* Tue Oct 02 2018 Peter Jones <pjones@redhat.com> - 15-6
- Put the legacy shim.efi binary in the right subpackage
Resolves: rhbz#1631989
* Fri May 04 2018 Peter Jones <pjones@redhat.com> - 15-5
- Rework the .spec to use efi-rpm-macros.
* Fri May 04 2018 Peter Jones <pjones@redhat.com> - 15-4
- Fix directory permissions to be 0700 on FAT filesystems
* Mon Apr 30 2018 Peter Jones <pjones@redhat.com> - 15-3
- Pick a release value that'll be higher than what's in F28.
* Mon Apr 30 2018 Peter Jones <pjones@redhat.com> - 15-1
- Fix BOOT*.CSV and update release to -1
* Tue Apr 24 2018 Peter Jones <pjones@redhat.com> - 15-0.1
- Update to shim 15.
- more reproduceable build
- better checking for bad linker output
- flicker-free console if there's no error output
- improved http boot support
- better protocol re-installation
- dhcp proxy support
- tpm measurement even when verification is disabled
- more reproducable builds
- measurement of everything verified through shim_verify()
- coverity and scan-build checker make targets
- misc cleanups
* Tue Mar 06 2018 Peter Jones <pjones@redhat.com> - 13-5
- Back off to the thing we had in 13-0.8 until I get new signatures.
* Wed Feb 28 2018 Peter Jones <pjones@redhat.com> - 13-4
- Fix an inverted test that crept in in the signing macro. (Woops.)
* Wed Feb 28 2018 Peter Jones <pjones@redhat.com> - 13-2
- Pivot the shim-signed package to be here.
* Wed Nov 01 2017 Peter Jones <pjones@redhat.com> - 13-1
- Now with the actual signed 64-bit build of shim 13 for x64 as well.
- Make everything under /boot/efi be mode 0700, since that's what FAT will
show anyway, so that rpm -V is correct.
Resolves: rhbz#1508516
* Tue Oct 24 2017 Peter Jones <pjones@redhat.com> - 13-0.8
- Now with signed 32-bit x86 build.
Related: rhbz#1474861
* Wed Oct 04 2017 Peter Jones <pjones@redhat.com> - 13-0.7
- Make /boot/efi/EFI/fedora/shim.efi still exist on aarch64 as well.
Resolves: rhbz#1497854
* Tue Sep 19 2017 Peter Jones <pjones@redhat.com> - 13-0.6
- Fix binary format issue on Aarch64
Resolves: rhbz#1489604
* Tue Sep 05 2017 Peter Jones <pjones@redhat.com> - 13-0.5
- Make /boot/efi/EFI/fedora/shim.efi still exist on x86_64, since some
machines have boot entries that point to it.
* Tue Aug 29 2017 Peter Jones <pjones@redhat.com> - 13-0.4
- Make our provides not get silently ignore by rpmbuild...
* Fri Aug 25 2017 Peter Jones <pjones@redhat.com> - 13-0.3
- x64: use the new fbx64.efi and mm64.efi as fallback.efi and MokManager.efi
- Provide: "shim" in x64 and aa64 builds
* Thu Aug 24 2017 Peter Jones <pjones@redhat.com> - 13-0.2
- Obsolete old shim builds.
* Tue Aug 22 2017 Peter Jones <pjones@redhat.com> - 13-0.1
- Initial (partially unsigned) build for multi-arch support on x64/ia32.
* Thu Mar 23 2017 Petr Šabata <contyk@redhat.com> - 0.8-9
- Re-enable dist tag for module builds
* Tue Feb 17 2015 Peter Jones <pjones@redhat.com> - 0.8-8
- Don't dual-sign shim-%%{efidir}.efi either.
Resolves: rhbz#1184765
* Tue Feb 17 2015 Peter Jones <pjones@redhat.com> - 0.8-8
- Require dbxtool
* Wed Dec 17 2014 Peter Jones <pjones@redhat.com> - 0.8-7
- Wrong -signed changes got built for aarch64 last time, for dumb reasons.
Related: rhbz#1170289
* Fri Dec 05 2014 Peter Jones <pjones@redhat.com> - 0.8-6
- Rebuild once more so we can use a different -unsigned version on different
arches (because we can't tag a newer build into aarch64 without an x86
update to match.)
Related: rhbz#1170289
* Wed Dec 03 2014 Peter Jones <pjones@redhat.com> - 0.8-5
- Rebuild for aarch64 path fixes
Related: rhbz#1170289
* Thu Oct 30 2014 Peter Jones <pjones@redhat.com> - 0.8-2
- Remove the dist tag so people don't complain about what it says.
* Fri Oct 24 2014 Peter Jones <pjones@redhat.com> - 0.8-1
- Update to shim 0.8
rhbz#1148230
rhbz#1148231
rhbz#1148232
- Handle building on aarch64 as well
* Fri Jul 18 2014 Peter Jones <pjones@redhat.com> - 0.7-2
- Don't do multi-signing; too many machines screw up verification.
Resolves: rhbz#1049749
* Wed Nov 13 2013 Peter Jones <pjones@redhat.com> - 0.7-1
- Update to shim 0.7
Resolves: rhbz#1023767
* Thu Oct 24 2013 Peter Jones <pjones@redhat.com> - 0.5-1
- Update to shim 0.5
* Thu Jun 20 2013 Peter Jones <pjones@redhat.com> - 0.4-1
- Provide a fallback for uninitialized Boot#### and BootOrder
Resolves: rhbz#963359
- Move all signing from shim-unsigned to here
- properly compare our generated hash from shim-unsigned with the hash of
the signed binary (as opposed to doing it manually)
* Fri May 31 2013 Peter Jones <pjones@redhat.com> - 0.2-4.4
- Re-sign to get alignments that match the new specification.
Resolves: rhbz#963361
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.2-4.3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
* Wed Jan 02 2013 Peter Jones <pjones@redhat.com> - 0.2-3.3
- Add obsoletes and provides for earlier shim-signed packages, to cover
the package update cases where previous versions were installed.
Related: rhbz#888026
* Mon Dec 17 2012 Peter Jones <pjones@redhat.com> - 0.2-3.2
- Make the shim-unsigned dep be on the subpackage.
* Sun Dec 16 2012 Peter Jones <pjones@redhat.com> - 0.2-3.1
- Rebuild to provide "shim" package directly instead of just as a Provides:
* Sat Dec 15 2012 Peter Jones <pjones@redhat.com> - 0.2-3
- Also provide shim-fedora.efi, signed only by the fedora signer.
- Fix the fedora signature on the result to actually be correct.
- Update for shim-unsigned 0.2-3
* Mon Dec 03 2012 Peter Jones <pjones@redhat.com> - 0.2-2
- Initial build
Reference in New Issue View Git Blame Copy Permalink