diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..6af0766 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/shim-15.tar.bz2 diff --git a/.shim.metadata b/.shim.metadata new file mode 100644 index 0000000..5677fcd --- /dev/null +++ b/.shim.metadata @@ -0,0 +1 @@ +2dc6308584187bf3ee88bf9b119938c72c5a5088 SOURCES/shim-15.tar.bz2 diff --git a/README.md b/README.md deleted file mode 100644 index 0e7897f..0000000 --- a/README.md +++ /dev/null @@ -1,5 +0,0 @@ -The master branch has no content - -Look at the c7 branch if you are working with CentOS-7, or the c4/c5/c6 branch for CentOS-4, 5 or 6 - -If you find this file in a distro specific branch, it means that no content has been checked in yet diff --git a/SOURCES/securebootca.cer b/SOURCES/securebootca.cer new file mode 100644 index 0000000..b235400 Binary files /dev/null and b/SOURCES/securebootca.cer differ diff --git a/SOURCES/shim-find-debuginfo.sh b/SOURCES/shim-find-debuginfo.sh new file mode 100755 index 0000000..ce3d69e --- /dev/null +++ b/SOURCES/shim-find-debuginfo.sh @@ -0,0 +1,412 @@ +#!/bin/bash +#find-debuginfo.sh - automagically generate debug info and file list +#for inclusion in an rpm spec file. +# +# Usage: find-debuginfo.sh [--strict-build-id] [-g] [-r] +# [-o debugfiles.list] +# [[-l filelist]... [-p 'pattern'] -o debuginfo.list] +# [builddir] +# +# The -g flag says to use strip -g instead of full strip on DSOs or EXEs. +# The --strict-build-id flag says to exit with failure status if +# any ELF binary processed fails to contain a build-id note. +# The -r flag says to use eu-strip --reloc-debug-sections. +# +# A single -o switch before any -l or -p switches simply renames +# the primary output file from debugfiles.list to something else. +# A -o switch that follows a -p switch or some -l switches produces +# an additional output file with the debuginfo for the files in +# the -l filelist file, or whose names match the -p pattern. +# The -p argument is an grep -E -style regexp matching the a file name, +# and must not use anchors (^ or $). +# +# All file names in switches are relative to builddir (. if not given). +# + +# With -g arg, pass it to strip on libraries or executables. +strip_g=false + +# with -r arg, pass --reloc-debug-sections to eu-strip. +strip_r=false + +# Barf on missing build IDs. +strict=false + +BUILDDIR=. +out=debugfiles.list +nout=0 +while [ $# -gt 0 ]; do + case "$1" in + --strict-build-id) + strict=true + ;; + -g) + strip_g=true + ;; + -o) + if [ -z "${lists[$nout]}" -a -z "${ptns[$nout]}" ]; then + out=$2 + else + outs[$nout]=$2 + ((nout++)) + fi + shift + ;; + -l) + lists[$nout]="${lists[$nout]} $2" + shift + ;; + -p) + ptns[$nout]=$2 + shift + ;; + -r) + strip_r=true + ;; + *) + BUILDDIR=$1 + shift + break + ;; + esac + shift +done + +i=0 +while ((i < nout)); do + outs[$i]="$BUILDDIR/${outs[$i]}" + l='' + for f in ${lists[$i]}; do + l="$l $BUILDDIR/$f" + done + lists[$i]=$l + ((++i)) +done + +LISTFILE="$BUILDDIR/$out" +SOURCEFILE="$BUILDDIR/debugsources.list" +LINKSFILE="$BUILDDIR/debuglinks.list" + +> "$SOURCEFILE" +> "$LISTFILE" +> "$LINKSFILE" + +debugdir="${RPM_BUILD_ROOT}/usr/lib/debug" + +strip_to_debug() +{ + local g= + local r= + $strip_r && r=--reloc-debug-sections + $strip_g && case "$(file -bi "$2")" in + application/x-sharedlib*) g=-g ;; + application/x-executable*) g=-g ;; + esac + eu-strip --remove-comment $r $g -f "$1" "$2" || exit + chmod 444 "$1" || exit +} + +# Make a relative symlink to $1 called $3$2 +shopt -s extglob +link_relative() +{ + local t="$1" f="$2" pfx="$3" + local fn="${f#/}" tn="${t#/}" + local fd td d + + while fd="${fn%%/*}"; td="${tn%%/*}"; [ "$fd" = "$td" ]; do + fn="${fn#*/}" + tn="${tn#*/}" + done + + d="${fn%/*}" + if [ "$d" != "$fn" ]; then + d="${d//+([!\/])/..}" + tn="${d}/${tn}" + fi + + mkdir -p "$(dirname "$pfx$f")" && ln -snf "$tn" "$pfx$f" +} + +# Make a symlink in /usr/lib/debug/$2 to $1 +debug_link() +{ + local l="/usr/lib/debug$2" + local t="$1" + echo >> "$LINKSFILE" "$l $t" + link_relative "$t" "$l" "$RPM_BUILD_ROOT" +} + +# Provide .2, .3, ... symlinks to all filename instances of this build-id. +make_id_dup_link() +{ + local id="$1" file="$2" idfile + + local n=1 + while true; do + idfile=".build-id/${id:0:2}/${id:2}.$n" + [ $# -eq 3 ] && idfile="${idfile}$3" + if [ ! -L "$RPM_BUILD_ROOT/usr/lib/debug/$idfile" ]; then + break + fi + n=$[$n+1] + done + debug_link "$file" "/$idfile" +} + +# Make a build-id symlink for id $1 with suffix $3 to file $2. +make_id_link() +{ + local id="$1" file="$2" + local idfile=".build-id/${id:0:2}/${id:2}" + [ $# -eq 3 ] && idfile="${idfile}$3" + local root_idfile="$RPM_BUILD_ROOT/usr/lib/debug/$idfile" + + if [ ! -L "$root_idfile" ]; then + debug_link "$file" "/$idfile" + return + fi + + make_id_dup_link "$@" + + [ $# -eq 3 ] && return 0 + + local other=$(readlink -m "$root_idfile") + other=${other#$RPM_BUILD_ROOT} + if cmp -s "$root_idfile" "$RPM_BUILD_ROOT$file" || + eu-elfcmp -q "$root_idfile" "$RPM_BUILD_ROOT$file" 2> /dev/null; then + # Two copies. Maybe one has to be setuid or something. + echo >&2 "*** WARNING: identical binaries are copied, not linked:" + echo >&2 " $file" + echo >&2 " and $other" + else + # This is pathological, break the build. + echo >&2 "*** ERROR: same build ID in nonidentical files!" + echo >&2 " $file" + echo >&2 " and $other" + exit 2 + fi +} + +get_debugfn() +{ + dn=$(dirname "${1#$RPM_BUILD_ROOT}") + [ "$dn" == "." ] && dn="" + bn=$(basename "$1" .so).debug + bn=$(basename "$bn" .debug).debug + + debugdn=${debugdir}${dn} + debugfn=${debugdn}/${bn} + + [ -n "$2" ] && shadowfn=$(basename "$2") +} + +set -o pipefail + +strict_error=ERROR +$strict || strict_error=WARNING + +handle_single_file() +{ + nlinks=$1 && shift + inum=$1 && shift + f=$1 && shift + shadow=$1 && shift + zf="$f" + [ -n "${shadowfn}" ] && zf="${shadowfn}" + + get_debugfn "$f" "$shadow" + [ -f "${debugfn}" ] && return + + # If this file has multiple links, keep track and make + # the corresponding .debug files all links to one file too. + if [ $nlinks -gt 1 ]; then + eval linked=\$linked_$inum + if [ -n "$linked" ]; then + eval id=\$linkedid_$inum + make_id_dup_link "$id" "$dn/$(basename ${zf})" + make_id_dup_link "$id" "/usr/lib/debug$dn/$bn" .debug + link=$debugfn + get_debugfn "$linked" + echo "hard linked $link to $debugfn" + mkdir -p "$(dirname "$link")" && ln -nf "$debugfn" "$link" + return + else + eval linked_$inum=\$f + echo "file $f has $[$nlinks - 1] other hard links" + fi + fi + + echo "extracting debug info from $f" + echo /usr/lib/rpm/debugedit -b "$RPM_BUILD_DIR" -d /usr/src/debug \ + -i -l "$SOURCEFILE" "$f" + id=$(/usr/lib/rpm/debugedit -b "$RPM_BUILD_DIR" -d /usr/src/debug \ + -i -l "$SOURCEFILE" "$f") || exit + if [ $nlinks -gt 1 ]; then + eval linkedid_$inum=\$id + fi + if [ -z "$id" ]; then + echo >&2 "*** ${strict_error}: No build ID note found in $zf" + $strict && exit 2 + fi + + [ -x /usr/bin/gdb-add-index ] && /usr/bin/gdb-add-index "$zf" > /dev/null 2>&1 + + # A binary already copied into /usr/lib/debug doesn't get stripped, + # just has its file names collected and adjusted. + case "$dn" in + /usr/lib/debug/*) + [ -z "$id" ] || make_id_link "$id" "$dn/$(basename $zf)" + return ;; + esac + + mkdir -p "${debugdn}" + if test -w "$f"; then + strip_to_debug "${debugfn}" "$f" + else + chmod u+w "$f" + strip_to_debug "${debugfn}" "$f" + chmod u-w "$f" + fi + + if [ -n "$id" ]; then + make_id_link "$id" "$dn/$(basename ${zf})" + make_id_link "$id" "/usr/lib/debug$dn/$bn" .debug + fi +} + +# Strip ELF binaries +find "$RPM_BUILD_ROOT" ! -path "${debugdir}/*.debug" -type f \ + \( -perm -0100 -or -perm -0010 -or -perm -0001 \) \ + -print | +file -N -f - | sed -n -e 's/^\(.*\):[ ]*.*ELF.*, not stripped.*/\1/p' | +xargs --no-run-if-empty stat -c '%h %D_%i %n' | +while read nlinks inum f; do + handle_single_file $nlinks $inum $f +done || exit + +find "$RPM_BUILD_ROOT" ! -path "${debugdir}/*.debug" -type f \ + -iname '*.efi' -print | +file -N -f - | sed -n -e 's/^\(.*\):[ ]*.*PE32.*EFI .*/\1/p' | +xargs --no-run-if-empty stat -c '%h %D_%i %n' | +while read nlinks inum f; do + [ -f "$f" ] || continue + [ -f "${f%%.efi}.so" ] || continue + handle_single_file $nlinks $inum ${f%%.efi}.so $f +done || exit + +# On Aarch64 file tells us "MS-DOS" instead of PE32+. Why not. +find "$RPM_BUILD_ROOT" ! -path "${debugdir}/*.debug" -type f \ + -iname '*.efi' -print | +file -N -f - | sed -n -e 's/^\(.*\):[ ]MS-DOS.*/\1/p' | +xargs --no-run-if-empty stat -c '%h %D_%i %n' | +while read nlinks inum f; do + [ -f "$f" ] || continue + [ -f "${f%%.efi}.so" ] || continue + handle_single_file $nlinks $inum ${f%%.efi}.so $f +done || exit +# For each symlink whose target has a .debug file, +# make a .debug symlink to that file. +find "$RPM_BUILD_ROOT" ! -path "${debugdir}/*" -type l -print | +while read f +do + t=$(readlink -m "$f").debug + f=${f#$RPM_BUILD_ROOT} + t=${t#$RPM_BUILD_ROOT} + if [ -f "$debugdir$t" ]; then + echo "symlinked /usr/lib/debug$t to /usr/lib/debug${f}.debug" + debug_link "/usr/lib/debug$t" "${f}.debug" + fi +done + +if [ -s "$SOURCEFILE" ]; then + mkdir -p "${RPM_BUILD_ROOT}/usr/src/debug" + LC_ALL=C sort -z -u "$SOURCEFILE" | grep -E -v -z '(|)$' | + (cd "$RPM_BUILD_DIR"; cpio -pd0mL "${RPM_BUILD_ROOT}/usr/src/debug") + # stupid cpio creates new directories in mode 0700, fixup + find "${RPM_BUILD_ROOT}/usr/src/debug" -type d -print0 | + xargs --no-run-if-empty -0 chmod a+rx +fi + +if [ -d "${RPM_BUILD_ROOT}/usr/lib" -o -d "${RPM_BUILD_ROOT}/usr/src" ]; then + ((nout > 0)) || + test ! -d "${RPM_BUILD_ROOT}/usr/lib" || + (cd "${RPM_BUILD_ROOT}/usr/lib"; find debug -type d) | + sed 's,^,%dir /usr/lib/,' >> "$LISTFILE" + + (cd "${RPM_BUILD_ROOT}/usr" + test ! -d lib/debug || find lib/debug ! -type d + test ! -d src/debug || find src/debug -mindepth 1 -maxdepth 1 + ) | sed 's,^,/usr/,' >> "$LISTFILE" +fi + +# Append to $1 only the lines from stdin not already in the file. +append_uniq() +{ + grep -F -f "$1" -x -v >> "$1" +} + +# Helper to generate list of corresponding .debug files from a file list. +filelist_debugfiles() +{ + local extra="$1" + shift + sed 's/^%[a-z0-9_][a-z0-9_]*([^)]*) *// +s/^%[a-z0-9_][a-z0-9_]* *// +/^$/d +'"$extra" "$@" +} + +# Write an output debuginfo file list based on given input file lists. +filtered_list() +{ + local out="$1" + shift + test $# -gt 0 || return + grep -F -f <(filelist_debugfiles 's,^.*$,/usr/lib/debug&.debug,' "$@") \ + -x $LISTFILE >> $out + sed -n -f <(filelist_debugfiles 's/[\\.*+#]/\\&/g +h +s,^.*$,s# &$##p,p +g +s,^.*$,s# /usr/lib/debug&.debug$##p,p +' "$@") "$LINKSFILE" | append_uniq "$out" +} + +# Write an output debuginfo file list based on an grep -E -style regexp. +pattern_list() +{ + local out="$1" ptn="$2" + test -n "$ptn" || return + grep -E -x -e "$ptn" "$LISTFILE" >> "$out" + sed -n -r "\#^$ptn #s/ .*\$//p" "$LINKSFILE" | append_uniq "$out" +} + +# +# When given multiple -o switches, split up the output as directed. +# +i=0 +while ((i < nout)); do + > ${outs[$i]} + filtered_list ${outs[$i]} ${lists[$i]} + pattern_list ${outs[$i]} "${ptns[$i]}" + grep -Fvx -f ${outs[$i]} "$LISTFILE" > "${LISTFILE}.new" + mv "${LISTFILE}.new" "$LISTFILE" + ((++i)) +done +if ((nout > 0)); then + # Now add the right %dir lines to each output list. + (cd "${RPM_BUILD_ROOT}"; find usr/lib/debug -type d) | + sed 's#^.*$#\\@^/&/@{h;s@^.*$@%dir /&@p;g;}#' | + LC_ALL=C sort -ur > "${LISTFILE}.dirs.sed" + i=0 + while ((i < nout)); do + sed -n -f "${LISTFILE}.dirs.sed" "${outs[$i]}" | sort -u > "${outs[$i]}.new" + cat "${outs[$i]}" >> "${outs[$i]}.new" + mv -f "${outs[$i]}.new" "${outs[$i]}" + ((++i)) + done + sed -n -f "${LISTFILE}.dirs.sed" "${LISTFILE}" | sort -u > "${LISTFILE}.new" + cat "$LISTFILE" >> "${LISTFILE}.new" + mv "${LISTFILE}.new" "$LISTFILE" +fi diff --git a/SPECS/shim.spec b/SPECS/shim.spec new file mode 100644 index 0000000..97117dd --- /dev/null +++ b/SPECS/shim.spec @@ -0,0 +1,352 @@ +Name: shim +Version: 15 +Release: 1%{?dist} +Summary: First-stage UEFI bootloader + +License: BSD +URL: http://www.codon.org.uk/~mjg59/shim/ +Source0: https://github.com/mjg59/shim/releases/download/%{version}/shim-%{version}.tar.bz2 +Source1: securebootca.cer +# currently here's what's in our dbx: # nothing. +#Source2: dbx-x64.esl +#Source3: dbx-aa64.esl +Source4: shim-find-debuginfo.sh + +BuildRequires: git openssl-devel openssl +BuildRequires: pesign >= 0.106-1 +BuildRequires: gnu-efi >= 1:3.0.5-6.el7, gnu-efi-devel >= 1:3.0.5-6.el7 + +# for xxd +BuildRequires: vim-common + +# Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not +# compatible with SysV (there's no red zone under UEFI) and there isn't a +# POSIX-style C library. +Provides: bundled(openssl) = 1.0.2j + +# Shim is only required on platforms implementing the UEFI secure boot +# protocol. The only one of those we currently wish to support is 64-bit x86. +# Adding further platforms will require adding appropriate relocation code. +ExclusiveArch: x86_64 aarch64 + +%ifarch x86_64 +%global efiarch x64 +%endif +%ifarch aarch64 +%global efiarch aa64 +%endif + +# Figure out the right file path to use +%global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/')) + +%define debug_package %{nil} +%global __debug_package 1 + +%global _binaries_in_noarch_packages_terminate_build 0 + +%description +Initial UEFI bootloader that handles chaining to a trusted full bootloader +under secure boot environments. + +%package -n shim-unsigned-%{efiarch} +Summary: First-stage UEFI bootloader (unsigned data) + +%description -n shim-unsigned-%{efiarch} +Initial UEFI bootloader that handles chaining to a trusted full bootloader +under secure boot environments. + +%package -n shim-unsigned-%{efiarch}-debuginfo +Obsoletes: shim-debuginfo < 0.9 +Summary: Debug information for package %{name} +Group: Development/Debug +AutoReqProv: 0 +BuildArch: noarch + +%description -n shim-unsigned-%{efiarch}-debuginfo +This package provides debug information for package %{name}. +Debug information is useful when developing applications that use this +package or when debugging this package. + +%ifarch x86_64 +%package -n shim-unsigned-ia32 +Summary: First-stage UEFI bootloader (unsigned data) + +%description -n shim-unsigned-ia32 +Initial UEFI bootloader that handles chaining to a trusted full bootloader +under secure boot environments. + +%package -n shim-unsigned-ia32-debuginfo +Obsoletes: shim-debuginfo < 0.9 +Summary: Debug information for package %{name} +Group: Development/Debug +AutoReqProv: 0 +BuildArch: noarch + +%description -n shim-unsigned-ia32-debuginfo +This package provides debug information for package %{name}. +Debug information is useful when developing applications that use this +package or when debugging this package. +%endif + +%prep +%setup -T -n %{name}-%{version}-%{release} -c +%{__tar} -xo -f %{SOURCE0} +mv %{name}-%{version} %{name}-%{version}-%{efiarch} +cd %{name}-%{version}-%{efiarch} +git init +git config user.email "example@example.com" +git config user.name "rpmbuild -bp" +git add . +git commit -a -q -m "%{version} baseline." +git am --ignore-whitespace %{patches} shim%{efiarch}.hash +install -D -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/ +install -m 0644 shim%{efiarch}.hash $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/shim%{efiarch}.hash +for x in shim%{efiarch} mm%{efiarch} fb%{efiarch} ; do + install -m 0644 $x.efi $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/ + install -m 0644 $x.so $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/ +done + +%ifarch x86_64 +cd ../%{name}-%{version}-ia32 +pesign -h -P -i shimia32.efi -h > shimia32.hash +install -D -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/shim/ia32-%{version}-%{release}/ +install -m 0644 shimia32.hash $RPM_BUILD_ROOT%{_datadir}/shim/ia32-%{version}-%{release}/shimia32.hash +for x in shimia32 mmia32 fbia32 ; do + install -m 0644 $x.efi $RPM_BUILD_ROOT%{_datadir}/shim/ia32-%{version}-%{release}/ + install -m 0644 $x.so $RPM_BUILD_ROOT%{_datadir}/shim/ia32-%{version}-%{release}/ +done +cd ../%{name}-%{version}-%{efiarch} +%endif + +%ifarch x86_64 +%global __debug_install_post \ + bash %{SOURCE4} \\\ + %{?_missing_build_ids_terminate_build:--strict-build-id}\\\ + %{?_find_debuginfo_opts} \\\ + "%{_builddir}/%{?buildsubdir}/%{name}-%{version}-%{efiarch}" \ + rm -f $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/*.so \ + mv debugfiles.list ../debugfiles-%{efiarch}.list \ + cd .. \ + cd %{name}-%{version}-ia32 \ + bash %{SOURCE4} \\\ + %{?_missing_build_ids_terminate_build:--strict-build-id}\\\ + %{?_find_debuginfo_opts} \\\ + "%{_builddir}/%{?buildsubdir}/%{name}-%{version}-ia32" \ + rm -f $RPM_BUILD_ROOT%{_datadir}/shim/ia32-%{version}-%{release}/*.so \ + mv debugfiles.list ../debugfiles-ia32.list \ + cd .. \ + %{nil} +%else +%global __debug_install_post \ + bash %{SOURCE4} \\\ + %{?_missing_build_ids_terminate_build:--strict-build-id}\\\ + %{?_find_debuginfo_opts} \\\ + "%{_builddir}/%{?buildsubdir}/%{name}-%{version}-%{efiarch}" \ + rm -f $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/*.so \ + mv debugfiles.list ../debugfiles-%{efiarch}.list \ + cd .. \ + %{nil} +%endif + +%files -n shim-unsigned-%{efiarch} +%dir %{_datadir}/shim +%dir %{_datadir}/shim/%{efiarch}-%{version}-%{release}/ +%{_datadir}/shim/%{efiarch}-%{version}-%{release}/*.efi +%{_datadir}/shim/%{efiarch}-%{version}-%{release}/*.hash + +%files -n shim-unsigned-%{efiarch}-debuginfo -f debugfiles-%{efiarch}.list +%defattr(-,root,root) + +%ifarch x86_64 +%files -n shim-unsigned-ia32 +%dir %{_datadir}/shim +%dir %{_datadir}/shim/ia32-%{version}-%{release}/ +%{_datadir}/shim/ia32-%{version}-%{release}/*.efi +%{_datadir}/shim/ia32-%{version}-%{release}/*.hash + +%files -n shim-unsigned-ia32-debuginfo -f debugfiles-ia32.list +%defattr(-,root,root) +%endif + +%changelog +* Mon Jun 18 2018 Peter Jones - 15-1 +- Update to shim 15 + Resolves: rhbz#1589961 + +* Thu Apr 27 2017 Peter Jones - 12-1 +- Update to 12-1 to work around a signtool.exe bug + Related: rhbz#1445393 + +* Mon Apr 03 2017 Peter Jones - 11-1 +- Update to 11-1 + Related: rhbz#1310766 +- Fix regression in PE loader + Related: rhbz#1310766 +- Fix case where BDS invokes us wrong and we exec shim again as a result + Related: rhbz#1310766 + +* Tue Mar 21 2017 Peter Jones - 10-1 +- Update to 10-1 +- Support ia32 + Resolves: rhbz#1310766 +- Handle various different load option implementation differences +- TPM 1 and TPM 2 support. +- Update to OpenSSL 1.0.2k + +* Mon Jun 22 2015 Peter Jones - 0.9-1 +- Update to 0.9-1 +- Fix early call to BS->Exit() + Resolves: rhbz#1115843 +- Implement shim on aarch64 + Resolves: rhbz#1100048 + Resolves: rhbz#1190191 + +* Mon Jun 22 2015 Peter Jones - 0.7-14 +- Excise mokutil. + Related: rhbz#1100048 + +* Mon Jun 22 2015 Peter Jones - 0.7-13 +- Do a build for Aarch64 to make the tree composable. + Related: rhbz#1100048 + +* Wed Feb 25 2015 Peter Jones - 0.7-10 +- Fix a couple more minor bugs aavmf has found in fallback. + Related: rhbz#1190191 +- Build lib/ with the right CFLAGS + Related: rhbz#1190191 + +* Tue Feb 24 2015 Peter Jones - 0.7-9 +- Fix aarch64 section loading. + Related: rhbz#1190191 + +* Tue Sep 30 2014 Peter Jones - 0.7-8 +- Build -8 for arm as well. + Related: rhbz#1100048 +- out-of-bounds memory read flaw in DHCPv6 packet processing + Resolves: CVE-2014-3675 +- heap-based buffer overflow flaw in IPv6 address parsing + Resolves: CVE-2014-3676 +- memory corruption flaw when processing Machine Owner Keys (MOKs) + Resolves: CVE-2014-3677 + +* Tue Sep 23 2014 Peter Jones - 0.7-7 +- Use the right key for ARM Aarch64. + +* Sun Sep 21 2014 Peter Jones - 0.7-6 +- Preliminary build for ARM Aarch64. + +* Tue Feb 18 2014 Peter Jones - 0.7-5 +- Update for production signing + Resolves: rhbz#1064424 + Related: rhbz#1064449 + +* Thu Nov 21 2013 Peter Jones - 0.7-4 +- Make dhcpv4 paths work better when netbooting. + Resolves: rhbz#1032583 + +* Thu Nov 14 2013 Peter Jones - 0.7-3 +- Make lockdown include UEFI and other KEK/DB entries. + Resolves: rhbz#1030492 + +* Fri Nov 08 2013 Peter Jones - 0.7-2 +- Update lockdown to reflect SetupMode better as well + Related: rhbz#996863 + +* Wed Nov 06 2013 Peter Jones - 0.7-1 +- Fix logic to handle SetupMode efi variable. + Related: rhbz#996863 + +* Thu Oct 31 2013 Peter Jones - 0.6-1 +- Fix a FreePool(NULL) call on machines too old for SB + +* Fri Oct 04 2013 Peter Jones - 0.5-1 +- Update to 0.5 + +* Tue Aug 06 2013 Peter Jones - 0.4-3 +- Build with early RHEL test keys. + Related: rhbz#989442 + +* Thu Jul 25 2013 Peter Jones - 0.4-2 +- Fix minor RHEL 7.0 build issues + Resolves: rhbz#978766 +- Be less verbose by default + +* Tue Jun 11 2013 Peter Jones - 0.4-1 +- Update to 0.4 + +* Fri Jun 07 2013 Peter Jones - 0.3-2 +- Require gnu-efi-3.0q for now. +- Don't allow mmx or sse during compilation. +- Re-organize this so all real signing happens in shim-signed instead. +- Split out mokutil + +* Wed Dec 12 2012 Peter Jones - 0.2-3 +- Fix mokutil's idea of signature sizes. + +* Wed Nov 28 2012 Matthew Garrett - 0.2-2 +- Fix secure_mode() always returning true + +* Mon Nov 26 2012 Matthew Garrett - 0.2-1 +- Update shim +- Include mokutil +- Add debuginfo package since mokutil is a userspace executable + +* Mon Oct 22 2012 Peter Jones - 0.1-4 +- Produce an unsigned shim + +* Tue Aug 14 2012 Peter Jones - 0.1-3 +- Update how embedded cert and signing work. + +* Mon Aug 13 2012 Josh Boyer - 0.1-2 +- Add patch to fix image size calculation + +* Mon Aug 13 2012 Matthew Garrett - 0.1-1 +- initial release