|
 |
112f40 |
Name: shim-signed
|
|
|
112f40 |
Version: 15
|
|
|
112f40 |
Release: 2%{?dist}%{?buildid}
|
|
|
112f40 |
Summary: First-stage UEFI bootloader
|
|
|
112f40 |
%define unsigned_release 5%{?dist}
|
|
|
112f40 |
|
|
|
112f40 |
License: BSD
|
|
|
112f40 |
URL: https://github.com/rhboot/shim/
|
|
|
112f40 |
# incorporate mokutil for packaging simplicity
|
|
|
112f40 |
%global mokutil_version 0.3.0
|
|
|
112f40 |
Source0: https://github.com/lcp/mokutil/archive/mokutil-%{mokutil_version}.tar.gz
|
|
|
112f40 |
Source1: secureboot.cer
|
|
|
112f40 |
Source2: securebootca.cer
|
|
|
112f40 |
Source10: shimx64.efi
|
|
|
112f40 |
Source11: shimia32.efi
|
|
|
112f40 |
Source12: shimaa64.efi
|
|
|
112f40 |
Source20: BOOTX64.CSV
|
|
|
112f40 |
Source21: BOOTIA32.CSV
|
|
|
112f40 |
Source22: BOOTAA64.CSV
|
|
|
112f40 |
|
|
|
112f40 |
Patch0001: 0001-Fix-the-potential-buffer-overflow.patch
|
|
|
112f40 |
Patch0002: 0002-Fix-the-32bit-signedness-comparison.patch
|
|
|
112f40 |
Patch0003: 0003-Build-with-fshort-wchar-so-toggle-passwords-work-rig.patch
|
|
|
112f40 |
Patch0004: 0004-Don-t-allow-sha1-on-the-mokutil-command-line.patch
|
|
|
112f40 |
Patch0005: 0005-Make-all-efi_guid_t-const.patch
|
|
|
112f40 |
Patch0006: 0006-mokutil-be-explicit-about-file-modes-in-all-cases.patch
|
|
|
112f40 |
Patch0007: 0007-Add-bash-completion-file.patch
|
|
|
112f40 |
Patch0008: 0008-Fix-typo-in-error-message-when-the-system-lacks-Secu.patch
|
|
|
112f40 |
Patch0009: 0009-list_keys_in_var-check-errno-correctly-not-ret-twice.patch
|
|
|
112f40 |
Patch0010: 0010-generate_hash-generate_pw_hash-don-t-use-strlen-for-.patch
|
|
|
112f40 |
|
|
|
112f40 |
%ifarch x86_64
|
|
|
112f40 |
%global efiarch X64
|
|
|
112f40 |
%global efiarchlc x64
|
|
|
112f40 |
%global shimsrc %{SOURCE10}
|
|
|
112f40 |
%global bootsrc %{SOURCE20}
|
|
|
112f40 |
|
|
|
112f40 |
%global shimsrcia32 %{SOURCE11}
|
|
|
112f40 |
%global bootsrcia32 %{SOURCE21}
|
|
|
112f40 |
%define unsigned_dir_ia32 %{_datadir}/shim/ia32-%{version}-%{unsigned_release}/
|
|
|
112f40 |
%endif
|
|
|
112f40 |
%ifarch aarch64
|
|
|
112f40 |
%global efiarch AA64
|
|
|
112f40 |
%global efiarchlc aa64
|
|
|
112f40 |
%global shimsrc %{SOURCE12}
|
|
|
112f40 |
%global bootsrc %{SOURCE22}
|
|
|
112f40 |
%endif
|
|
|
112f40 |
%define unsigned_dir %{_datadir}/shim/%{efiarchlc}-%{version}-%{unsigned_release}/
|
|
|
112f40 |
|
|
|
112f40 |
BuildRequires: git
|
|
|
112f40 |
BuildRequires: openssl-devel openssl
|
|
|
112f40 |
BuildRequires: pesign >= 0.106-5%{dist}
|
|
|
112f40 |
BuildRequires: efivar-devel
|
|
|
112f40 |
BuildRequires: shim-unsigned-%{efiarchlc} = %{version}-%{unsigned_release}
|
|
|
112f40 |
%ifarch x86_64
|
|
|
112f40 |
BuildRequires: shim-unsigned-ia32 = %{version}-%{unsigned_release}
|
|
|
112f40 |
%endif
|
|
|
112f40 |
|
|
|
112f40 |
# for mokutil's configure
|
|
|
112f40 |
BuildRequires: autoconf automake
|
|
|
112f40 |
|
|
|
112f40 |
# Shim is only required on platforms implementing the UEFI secure boot
|
|
|
112f40 |
# protocol. The only one of those we currently wish to support is 64-bit x86.
|
|
|
112f40 |
# Adding further platforms will require adding appropriate relocation code.
|
|
|
112f40 |
ExclusiveArch: x86_64 aarch64
|
|
|
112f40 |
|
|
|
112f40 |
%define debug_package \
|
|
|
112f40 |
%ifnarch noarch\
|
|
|
112f40 |
%global __debug_package 1\
|
|
|
112f40 |
%package -n mokutil-debuginfo\
|
|
|
112f40 |
Summary: Debug information for package %{name}\
|
|
|
112f40 |
Group: Development/Debug\
|
|
|
112f40 |
AutoReqProv: 0\
|
|
|
112f40 |
%description -n mokutil-debuginfo\
|
|
|
112f40 |
This package provides debug information for package %{name}.\
|
|
|
112f40 |
Debug information is useful when developing applications that use this\
|
|
|
112f40 |
package or when debugging this package.\
|
|
|
112f40 |
%files -n mokutil-debuginfo -f debugfiles.list\
|
|
|
112f40 |
%defattr(-,root,root,-)\
|
|
|
112f40 |
%endif\
|
|
|
112f40 |
%{nil}
|
|
|
112f40 |
|
|
|
112f40 |
# Figure out the right file path to use
|
|
|
112f40 |
%global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/'))
|
|
|
112f40 |
|
|
|
112f40 |
%define ca_signed_arches x86_64
|
|
|
112f40 |
%define rh_signed_arches x86_64 aarch64
|
|
|
112f40 |
|
|
|
112f40 |
%description
|
|
|
112f40 |
Initial UEFI bootloader that handles chaining to a trusted full bootloader
|
|
|
112f40 |
under secure boot environments. This package contains the version signed by
|
|
|
112f40 |
the UEFI signing service.
|
|
|
112f40 |
|
|
|
112f40 |
%package -n shim-%{efiarchlc}
|
|
|
112f40 |
Summary: First-stage UEFI bootloader
|
|
|
112f40 |
Requires: mokutil = %{version}-%{release}
|
|
|
112f40 |
Provides: shim = %{version}-%{release}
|
|
|
112f40 |
Obsoletes: shim <= 12
|
|
|
112f40 |
# Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not
|
|
|
112f40 |
# compatible with SysV (there's no red zone under UEFI) and there isn't a
|
|
|
112f40 |
# POSIX-style C library.
|
|
|
112f40 |
# BuildRequires: OpenSSL
|
|
|
112f40 |
Provides: bundled(openssl) = 0.9.8zb
|
|
|
112f40 |
|
|
|
112f40 |
%description -n shim-%{efiarchlc}
|
|
|
112f40 |
Initial UEFI bootloader that handles chaining to a trusted full bootloader
|
|
|
112f40 |
under secure boot environments. This package contains the version signed by
|
|
|
112f40 |
the UEFI signing service.
|
|
|
112f40 |
|
|
|
112f40 |
%ifarch x86_64
|
|
|
112f40 |
%package -n shim-ia32
|
|
|
112f40 |
Summary: First-stage UEFI bootloader
|
|
|
112f40 |
Requires: mokutil = %{version}-%{release}
|
|
|
112f40 |
# Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not
|
|
|
112f40 |
# compatible with SysV (there's no red zone under UEFI) and there isn't a
|
|
|
112f40 |
# POSIX-style C library.
|
|
|
112f40 |
# BuildRequires: OpenSSL
|
|
|
112f40 |
Provides: bundled(openssl) = 0.9.8zb
|
|
|
112f40 |
|
|
|
112f40 |
%description -n shim-ia32
|
|
|
112f40 |
Initial UEFI bootloader that handles chaining to a trusted full bootloader
|
|
|
112f40 |
under secure boot environments. This package contains the version signed by
|
|
|
112f40 |
the UEFI signing service.
|
|
|
112f40 |
%endif
|
|
|
112f40 |
|
|
|
112f40 |
%package -n mokutil
|
|
|
112f40 |
Summary: Utilities for managing Secure Boot/MoK keys.
|
|
|
112f40 |
|
|
|
112f40 |
%description -n mokutil
|
|
|
112f40 |
Utilities for managing the "Machine's Own Keys" list.
|
|
|
112f40 |
|
|
|
112f40 |
%prep
|
|
|
112f40 |
%setup -T -q -a 0 -n shim-signed-%{version} -c
|
|
|
112f40 |
git init
|
|
|
112f40 |
git config user.email "example@example.com"
|
|
|
112f40 |
git config user.name "rpmbuild -bp"
|
|
|
112f40 |
git add .
|
|
|
112f40 |
git commit -a -q -m "%{version} baseline."
|
|
|
112f40 |
cd mokutil-%{mokutil_version}
|
|
|
112f40 |
git am --ignore-whitespace --directory=mokutil-%{mokutil_version} %{patches}
|
|
|
112f40 |
git config --unset user.email
|
|
|
112f40 |
git config --unset user.name
|
|
|
112f40 |
cd ..
|
|
|
112f40 |
|
|
|
112f40 |
%build
|
|
|
112f40 |
%define vendor_token_str %{expand:%%{nil}%%{?vendor_token_name:-t "%{vendor_token_name}"}}
|
|
|
112f40 |
%define vendor_cert_str %{expand:%%{!?vendor_cert_nickname:-c "Red Hat Test Certificate"}%%{?vendor_cert_nickname:-c "%%{vendor_cert_nickname}"}}
|
|
|
112f40 |
|
|
|
112f40 |
%ifarch %{ca_signed_arches}
|
|
|
112f40 |
pesign -i %{shimsrc} -h -P > shim%{efiarchlc}.hash
|
|
|
112f40 |
if ! cmp shim%{efiarchlc}.hash %{unsigned_dir}shim%{efiarchlc}.hash ; then
|
|
|
112f40 |
echo Invalid signature\! > /dev/stderr
|
|
|
112f40 |
echo saved hash is $(cat %{unsigned_dir}shim%{efiarchlc}.hash) > /dev/stderr
|
|
|
112f40 |
echo shim%{efiarchlc}.efi hash is $(cat shim%{efiarchlc}.hash) > /dev/stderr
|
|
|
112f40 |
exit 1
|
|
|
112f40 |
fi
|
|
|
112f40 |
cp %{shimsrc} shim%{efiarchlc}.efi
|
|
|
112f40 |
%ifarch x86_64
|
|
|
112f40 |
pesign -i %{shimsrcia32} -h -P > shimia32.hash
|
|
|
112f40 |
if ! cmp shimia32.hash %{unsigned_dir_ia32}shimia32.hash ; then
|
|
|
112f40 |
echo Invalid signature\! > /dev/stderr
|
|
|
112f40 |
echo saved hash is $(cat %{unsigned_dir_ia32}shimia32.hash) > /dev/stderr
|
|
|
112f40 |
echo shimia32.efi hash is $(cat shimia32.hash) > /dev/stderr
|
|
|
112f40 |
exit 1
|
|
|
112f40 |
fi
|
|
|
112f40 |
cp %{shimsrcia32} shimia32.efi
|
|
|
112f40 |
%endif
|
|
|
112f40 |
%endif
|
|
|
112f40 |
%ifarch %{rh_signed_arches}
|
|
|
112f40 |
%pesign -s -i %{unsigned_dir}shim%{efiarchlc}.efi -a %{SOURCE2} -c %{SOURCE1} -n redhatsecureboot301 -o shim%{efiarchlc}-%{efidir}.efi
|
|
|
112f40 |
%ifarch x86_64
|
|
|
112f40 |
%pesign -s -i %{unsigned_dir_ia32}shimia32.efi -a %{SOURCE2} -c %{SOURCE1} -n redhatsecureboot301 -o shimia32-%{efidir}.efi
|
|
|
112f40 |
%endif
|
|
|
112f40 |
%endif
|
|
|
112f40 |
%ifarch %{rh_signed_arches}
|
|
|
112f40 |
%ifnarch %{ca_signed_arches}
|
|
|
112f40 |
cp shim%{efiarchlc}-%{efidir}.efi shim%{efiarchlc}.efi
|
|
|
112f40 |
%endif
|
|
|
112f40 |
%endif
|
|
|
112f40 |
|
|
|
112f40 |
%pesign -s -i %{unsigned_dir}mm%{efiarchlc}.efi -o mm%{efiarchlc}.efi -a %{SOURCE2} -c %{SOURCE1} -n redhatsecureboot301
|
|
|
112f40 |
%pesign -s -i %{unsigned_dir}fb%{efiarchlc}.efi -o fb%{efiarchlc}.efi -a %{SOURCE2} -c %{SOURCE1} -n redhatsecureboot301
|
|
|
112f40 |
|
|
|
112f40 |
%ifarch x86_64
|
|
|
112f40 |
%pesign -s -i %{unsigned_dir_ia32}mmia32.efi -o mmia32.efi -a %{SOURCE2} -c %{SOURCE1} -n redhatsecureboot301
|
|
|
112f40 |
%pesign -s -i %{unsigned_dir_ia32}fbia32.efi -o fbia32.efi -a %{SOURCE2} -c %{SOURCE1} -n redhatsecureboot301
|
|
|
112f40 |
%endif
|
|
|
112f40 |
|
|
|
112f40 |
cd mokutil-%{mokutil_version}
|
|
|
112f40 |
./autogen.sh
|
|
|
112f40 |
%configure
|
|
|
112f40 |
make %{?_smp_mflags}
|
|
|
112f40 |
|
|
|
112f40 |
%install
|
|
|
112f40 |
rm -rf $RPM_BUILD_ROOT
|
|
|
112f40 |
install -D -d -m 0700 $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/
|
|
|
112f40 |
install -m 0700 shim%{efiarchlc}.efi $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shim%{efiarchlc}.efi
|
|
|
112f40 |
install -m 0700 shim%{efiarchlc}-%{efidir}.efi $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shim%{efiarchlc}-%{efidir}.efi
|
|
|
112f40 |
install -m 0700 mm%{efiarchlc}.efi $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/mm%{efiarchlc}.efi
|
|
|
112f40 |
install -m 0700 %{bootsrc} $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/BOOT%{efiarch}.CSV
|
|
|
112f40 |
|
|
|
112f40 |
install -D -d -m 0700 $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/
|
|
|
112f40 |
install -m 0700 shim%{efiarchlc}.efi $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/BOOT%{efiarch}.EFI
|
|
|
112f40 |
install -m 0700 fb%{efiarchlc}.efi $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/fb%{efiarchlc}.efi
|
|
|
112f40 |
|
|
|
112f40 |
%ifarch aarch64
|
|
|
112f40 |
# In case old boot entries aren't updated
|
|
|
112f40 |
install -m 0700 %{shimsrc} $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shim.efi
|
|
|
112f40 |
%endif
|
|
|
112f40 |
|
|
|
112f40 |
%ifarch x86_64
|
|
|
112f40 |
# In case old boot entries aren't updated
|
|
|
112f40 |
install -m 0700 shimx64.efi $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shim.efi
|
|
|
112f40 |
install -m 0700 %{bootsrc} $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/BOOT.CSV
|
|
|
112f40 |
|
|
|
112f40 |
install -m 0700 shimia32.efi $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shimia32.efi
|
|
|
112f40 |
install -m 0700 shimia32.efi $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shimia32.efi
|
|
|
112f40 |
install -m 0700 shimia32-%{efidir}.efi $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shimia32-%{efidir}.efi
|
|
|
112f40 |
install -m 0700 mmia32.efi $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/mmia32.efi
|
|
|
112f40 |
install -m 0700 %{bootsrcia32} $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/BOOTIA32.CSV
|
|
|
112f40 |
|
|
|
112f40 |
install -m 0700 shimia32.efi $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/BOOTIA32.EFI
|
|
|
112f40 |
install -m 0700 fbia32.efi $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/fbia32.efi
|
|
|
112f40 |
%endif
|
|
|
112f40 |
|
|
|
112f40 |
cd mokutil-%{mokutil_version}
|
|
|
112f40 |
make PREFIX=%{_prefix} LIBDIR=%{_libdir} DESTDIR=%{buildroot} install
|
|
|
112f40 |
|
|
|
112f40 |
%files -n shim-%{efiarchlc}
|
|
|
112f40 |
%defattr(0700,root,root,-)
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/%{efidir}/shim%{efiarchlc}.efi
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/%{efidir}/shim%{efiarchlc}-%{efidir}.efi
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/%{efidir}/mm%{efiarchlc}.efi
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/%{efidir}/BOOT%{efiarch}.CSV
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/BOOT/BOOT%{efiarch}.EFI
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/BOOT/fb%{efiarchlc}.efi
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/%{efidir}/shim.efi
|
|
|
112f40 |
|
|
|
112f40 |
%ifarch x86_64
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/%{efidir}/BOOT.CSV
|
|
|
112f40 |
|
|
|
112f40 |
%files -n shim-ia32
|
|
|
112f40 |
%defattr(0700,root,root,-)
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/%{efidir}/shimia32.efi
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/%{efidir}/shimia32-%{efidir}.efi
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/%{efidir}/mmia32.efi
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/%{efidir}/BOOTIA32.CSV
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/BOOT/BOOTIA32.EFI
|
|
|
112f40 |
%verify(not mtime) /boot/efi/EFI/BOOT/fbia32.efi
|
|
|
112f40 |
%endif
|
|
|
112f40 |
|
|
|
112f40 |
%files -n mokutil
|
|
|
112f40 |
%{!?_licensedir:%global license %%doc}
|
|
|
112f40 |
%license mokutil-%{mokutil_version}/COPYING
|
|
|
112f40 |
%doc mokutil-%{mokutil_version}/README
|
|
|
112f40 |
%{_bindir}/mokutil
|
|
|
112f40 |
%{_mandir}/man1/*
|
|
|
112f40 |
%{_datadir}/bash-completion/completions/mokutil
|
|
|
112f40 |
|
|
|
112f40 |
%changelog
|
|
|
112f40 |
* Thu Mar 21 2019 Peter Jones <pjones@redhat.com> - 15-2
|
|
|
112f40 |
- Fix MoK mirroring issue which breaks kdump without intervention
|
|
|
112f40 |
Related: rhbz#1649270
|
|
|
112f40 |
|
|
|
112f40 |
* Fri Jul 20 2018 Peter Jones <pjones@redhat.com> - 15-1
|
|
|
112f40 |
- Update to shim version 15
|
|
|
112f40 |
Resolves: rhbz#1589962
|
|
|
112f40 |
|
|
|
112f40 |
* Wed Jul 11 2018 Peter Jones <pjones@redhat.com> - 12-3
|
|
|
112f40 |
- Fix broken file owner/modes
|
|
|
112f40 |
Resolves: rhbz#1595677
|
|
|
112f40 |
|
|
|
112f40 |
* Sat Jun 23 2018 Peter Jones <pjones@redhat.com> - 12-2
|
|
|
112f40 |
- Fix /boot/efi/... permissions to match the filesystem's requirements
|
|
|
112f40 |
Related: rhbz#1512749
|
|
|
112f40 |
- Minor .spec cleanups
|
|
|
112f40 |
Related: rhbz#1512749
|
|
|
112f40 |
|
|
|
112f40 |
* Mon May 01 2017 Peter Jones <pjones@redhat.com> - 12-1
|
|
|
112f40 |
- Update to 12-1 to work around a signtool.exe bug
|
|
|
112f40 |
Resolves: rhbz#1445393
|
|
|
112f40 |
|
|
|
112f40 |
* Mon Apr 24 2017 Peter Jones <pjones@redhat.com> - 11-4
|
|
|
112f40 |
- Another shot at better obsoletes.
|
|
|
112f40 |
Related: rhbz#1310764
|
|
|
112f40 |
|
|
|
112f40 |
* Mon Apr 24 2017 Peter Jones <pjones@redhat.com> - 11-3
|
|
|
112f40 |
- Fix Obsoletes
|
|
|
112f40 |
Related: rhbz#1310764
|
|
|
112f40 |
|
|
|
112f40 |
* Thu Apr 13 2017 Peter Jones <pjones@redhat.com> - 11-2
|
|
|
112f40 |
- Make sure Aarch64 still has shim.efi as well
|
|
|
112f40 |
Related: rhbz#1310766
|
|
|
112f40 |
|
|
|
112f40 |
* Wed Apr 12 2017 Peter Jones <pjones@redhat.com> - 11-1
|
|
|
112f40 |
- Rebuild with signed shim
|
|
|
112f40 |
Related: rhbz#1310766
|
|
|
112f40 |
|
|
|
112f40 |
* Mon Apr 03 2017 Peter Jones <pjones@redhat.com> - 11-0.1
|
|
|
112f40 |
- Update to 11-0.1 to match shim-11-1
|
|
|
112f40 |
Related: rhbz#1310766
|
|
|
112f40 |
- Fix regression in PE loader
|
|
|
112f40 |
Related: rhbz#1310766
|
|
|
112f40 |
- Fix case where BDS invokes us wrong and we exec shim again as a result
|
|
|
112f40 |
Related: rhbz#1310766
|
|
|
112f40 |
|
|
|
112f40 |
* Mon Mar 27 2017 Peter Jones <pjones@redhat.com> - 10-0.1
|
|
|
112f40 |
- Support ia32
|
|
|
112f40 |
Resolves: rhbz#1310766
|
|
|
112f40 |
- Handle various different load option implementation differences
|
|
|
112f40 |
- TPM 1 and TPM 2 support.
|
|
|
112f40 |
- Update to OpenSSL 1.0.2k
|
|
|
112f40 |
|
|
|
112f40 |
* Mon Jul 20 2015 Peter Jones <pjones@redhat.com> - 0.9-2
|
|
|
112f40 |
- Apparently I'm *never* going to learn to build this in the right target
|
|
|
112f40 |
the first time through.
|
|
|
112f40 |
Related: rhbz#1100048
|
|
|
112f40 |
|
|
|
112f40 |
* Mon Jun 29 2015 Peter Jones <pjones@redhat.com> - 0.9-0.1
|
|
|
112f40 |
- Bump version for 0.9
|
|
|
112f40 |
Also use mokutil-0.3.0
|
|
|
112f40 |
Related: rhbz#1100048
|
|
|
112f40 |
|
|
|
112f40 |
* Tue Jun 23 2015 Peter Jones <pjones@redhat.com> - 0.7-14.1
|
|
|
112f40 |
- Fix mokutil_version usage.
|
|
|
112f40 |
Related: rhbz#1100048
|
|
|
112f40 |
|
|
|
112f40 |
* Mon Jun 22 2015 Peter Jones <pjones@redhat.com> - 0.7-14
|
|
|
112f40 |
- Pull in aarch64 build so they can compose that tree.
|
|
|
112f40 |
(-14 to match -unsigned)
|
|
|
112f40 |
Related: rhbz#1100048
|
|
|
112f40 |
|
|
|
112f40 |
* Wed Feb 25 2015 Peter Jones <pjones@redhat.com> - 0.7-12
|
|
|
112f40 |
- Fix some minor build bugs on Aarch64
|
|
|
112f40 |
Related: rhbz#1190191
|
|
|
112f40 |
|
|
|
112f40 |
* Tue Feb 24 2015 Peter Jones <pjones@redhat.com> - 0.7-11
|
|
|
112f40 |
- Fix section loading on Aarch64
|
|
|
112f40 |
Related: rhbz#1190191
|
|
|
112f40 |
|
|
|
112f40 |
* Wed Dec 17 2014 Peter Jones <pjones@redhat.com> - 0.7-10
|
|
|
112f40 |
- Rebuild for Aarch64 to get \EFI\BOOT\BOOTAA64.EFI named right.
|
|
|
112f40 |
(I managed to fix the inputs but not the outputs in -9.)
|
|
|
112f40 |
Related: rhbz#1100048
|
|
|
112f40 |
|
|
|
112f40 |
* Wed Dec 17 2014 Peter Jones <pjones@redhat.com> - 0.7-9
|
|
|
112f40 |
- Rebuild for Aarch64 to get \EFI\BOOT\BOOTAA64.EFI named right.
|
|
|
112f40 |
Related: rhbz#1100048
|
|
|
112f40 |
|
|
|
112f40 |
* Tue Oct 21 2014 Peter Jones <pjones@redhat.com> - 0.7-8
|
|
|
112f40 |
- Build for aarch64 as well
|
|
|
112f40 |
Related: rhbz#1100048
|
|
|
112f40 |
- out-of-bounds memory read flaw in DHCPv6 packet processing
|
|
|
112f40 |
Resolves: CVE-2014-3675
|
|
|
112f40 |
- heap-based buffer overflow flaw in IPv6 address parsing
|
|
|
112f40 |
Resolves: CVE-2014-3676
|
|
|
112f40 |
- memory corruption flaw when processing Machine Owner Keys (MOKs)
|
|
|
112f40 |
Resolves: CVE-2014-3677
|
|
|
112f40 |
|
|
|
112f40 |
* Tue Sep 23 2014 Peter Jones <pjones@redhat.com> - 0.7-7
|
|
|
112f40 |
- Make sure we use the right keys on Aarch64.
|
|
|
112f40 |
(It's only a demo at this stage.)
|
|
|
112f40 |
Related: rhbz#1100048
|
|
|
112f40 |
|
|
|
112f40 |
* Tue Sep 23 2014 Peter Jones <pjones@redhat.com> - 0.7-6
|
|
|
112f40 |
- Add ARM Aarch64.
|
|
|
112f40 |
Related: rhbz#1100048
|
|
|
112f40 |
|
|
|
112f40 |
* Thu Feb 27 2014 Peter Jones <pjones@redhat.com> - 0.7-5.2
|
|
|
112f40 |
- Get the right signatures on shim-redhat.efi
|
|
|
112f40 |
Related: rhbz#1064449
|
|
|
112f40 |
|
|
|
112f40 |
* Thu Feb 27 2014 Peter Jones <pjones@redhat.com> - 0.7-5.1
|
|
|
112f40 |
- Update for signed shim for RHEL 7
|
|
|
112f40 |
Resolves: rhbz#1064449
|
|
|
112f40 |
|
|
|
112f40 |
* Thu Nov 21 2013 Peter Jones <pjones@redhat.com> - 0.7-5
|
|
|
112f40 |
- Fix shim-unsigned deps.
|
|
|
112f40 |
Related: rhbz#1032583
|
|
|
112f40 |
|
|
|
112f40 |
* Thu Nov 21 2013 Peter Jones <pjones@redhat.com> - 0.7-4
|
|
|
112f40 |
- Make dhcp4 work better.
|
|
|
112f40 |
Related: rhbz#1032583
|
|
|
112f40 |
|
|
|
112f40 |
* Thu Nov 14 2013 Peter Jones <pjones@redhat.com> - 0.7-3
|
|
|
112f40 |
- Make lockdown include UEFI and other KEK/DB entries.
|
|
|
112f40 |
Related: rhbz#1030492
|
|
|
112f40 |
|
|
|
112f40 |
* Fri Nov 08 2013 Peter Jones <pjones@redhat.com> - 0.7-2
|
|
|
112f40 |
- Handle SetupMode better in lockdown as well
|
|
|
112f40 |
Related: rhbz#996863
|
|
|
112f40 |
|
|
|
112f40 |
* Wed Nov 06 2013 Peter Jones <pjones@redhat.com> - 0.7-1
|
|
|
112f40 |
- Don't treat SetupMode variable's presence as meaning we're in SetupMode.
|
|
|
112f40 |
Related: rhbz#996863
|
|
|
112f40 |
|
|
|
112f40 |
* Wed Nov 06 2013 Peter Jones <pjones@redhat.com> - 0.6-3
|
|
|
112f40 |
- Use the correct CA and signer certificates.
|
|
|
112f40 |
Related: rhbz#996863
|
|
|
112f40 |
|
|
|
112f40 |
* Thu Oct 31 2013 Peter Jones <pjones@redhat.com> - 0.6-1
|
|
|
112f40 |
- Update to 0.6-1
|
|
|
112f40 |
Resolves: rhbz#1008379
|
|
|
112f40 |
|
|
|
112f40 |
* Wed Aug 07 2013 Peter Jones <pjones@redhat.com> - 0.4-3.2
|
|
|
112f40 |
- Depend on newer pesign.
|
|
|
112f40 |
Related: rhbz#989442
|
|
|
112f40 |
|
|
|
112f40 |
* Tue Aug 06 2013 Peter Jones <pjones@redhat.com> - 0.4-3.1
|
|
|
112f40 |
- Rebuild with newer pesign
|
|
|
112f40 |
Related: rhbz#989442
|
|
|
112f40 |
|
|
|
112f40 |
* Tue Aug 06 2013 Peter Jones <pjones@redhat.com> - 0.4-3
|
|
|
112f40 |
- Update for RHEL signing with early test keys.
|
|
|
112f40 |
Related: rhbz#989442
|
|
|
112f40 |
|
|
|
112f40 |
* Thu Jun 20 2013 Peter Jones <pjones@redhat.com> - 0.4-1
|
|
|
112f40 |
- Provide a fallback for uninitialized Boot#### and BootOrder
|
|
|
112f40 |
Resolves: rhbz#963359
|
|
|
112f40 |
- Move all signing from shim-unsigned to here
|
|
|
112f40 |
- properly compare our generated hash from shim-unsigned with the hash of
|
|
|
112f40 |
the signed binary (as opposed to doing it manually)
|
|
|
112f40 |
|
|
|
112f40 |
* Fri May 31 2013 Peter Jones <pjones@redhat.com> - 0.2-4.4
|
|
|
112f40 |
- Re-sign to get alignments that match the new specification.
|
|
|
112f40 |
Resolves: rhbz#963361
|
|
|
112f40 |
|
|
|
112f40 |
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.2-4.3
|
|
|
112f40 |
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
|
|
|
112f40 |
|
|
|
112f40 |
* Wed Jan 02 2013 Peter Jones <pjones@redhat.com> - 0.2-3.3
|
|
|
112f40 |
- Add obsoletes and provides for earlier shim-signed packages, to cover
|
|
|
112f40 |
the package update cases where previous versions were installed.
|
|
|
112f40 |
Related: rhbz#888026
|
|
|
112f40 |
|
|
|
112f40 |
* Mon Dec 17 2012 Peter Jones <pjones@redhat.com> - 0.2-3.2
|
|
|
112f40 |
- Make the shim-unsigned dep be on the subpackage.
|
|
|
112f40 |
|
|
|
112f40 |
* Sun Dec 16 2012 Peter Jones <pjones@redhat.com> - 0.2-3.1
|
|
|
112f40 |
- Rebuild to provide "shim" package directly instead of just as a Provides:
|
|
|
112f40 |
|
|
|
112f40 |
* Sat Dec 15 2012 Peter Jones <pjones@redhat.com> - 0.2-3
|
|
|
112f40 |
- Also provide shim-fedora.efi, signed only by the fedora signer.
|
|
|
112f40 |
- Fix the fedora signature on the result to actually be correct.
|
|
|
112f40 |
- Update for shim-unsigned 0.2-3
|
|
|
112f40 |
|
|
|
112f40 |
* Mon Dec 03 2012 Peter Jones <pjones@redhat.com> - 0.2-2
|
|
|
112f40 |
- Initial build
|