Blame SPECS/shim-signed.spec

3bee5b
Name:           shim-signed
3bee5b
Version:        0.7
3bee5b
Release:        5%{?dist}
3bee5b
Summary:        First-stage UEFI bootloader
3bee5b
Provides:	shim = %{version}-%{release}
3bee5b
%define unsigned_release 4%{?dist}
3bee5b
3bee5b
License:        BSD
3bee5b
URL:            http://www.codon.org.uk/~mjg59/shim/
3bee5b
Source1:	BOOT.CSV
3bee5b
Source2:	redhatsecureboot003.cer
3bee5b
Source3:	redhatsecurebootca2.cer
3bee5b
3bee5b
BuildRequires: shim-unsigned = %{version}-%{unsigned_release}
3bee5b
BuildRequires: pesign >= 0.106-5%{dist}
3bee5b
3bee5b
# Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not
3bee5b
# compatible with SysV (there's no red zone under UEFI) and there isn't a
3bee5b
# POSIX-style C library.
3bee5b
# BuildRequires: OpenSSL
3bee5b
Provides: bundled(openssl) = 0.9.8w
3bee5b
3bee5b
# Shim is only required on platforms implementing the UEFI secure boot
3bee5b
# protocol. The only one of those we currently wish to support is 64-bit x86.
3bee5b
# Adding further platforms will require adding appropriate relocation code.
3bee5b
ExclusiveArch: x86_64
3bee5b
3bee5b
%global debug_package %{nil}
3bee5b
3bee5b
# Figure out the right file path to use
3bee5b
%if 0%{?rhel}
3bee5b
%global efidir redhat
3bee5b
%endif
3bee5b
%if 0%{?fedora}
3bee5b
%global efidir fedora
3bee5b
%endif
3bee5b
3bee5b
%description
3bee5b
Initial UEFI bootloader that handles chaining to a trusted full bootloader
3bee5b
under secure boot environments. This package contains the version signed by
3bee5b
the UEFI signing service.
3bee5b
3bee5b
%package -n shim
3bee5b
Summary: First-stage UEFI bootloader
3bee5b
Requires: shim-unsigned = %{version}-%{unsigned_release}
3bee5b
Requires: mokutil = %{version}-%{unsigned_release}
3bee5b
Provides: shim-signed = %{version}-%{release}
3bee5b
Obsoletes: shim-signed < %{version}-%{release}
3bee5b
3bee5b
%description -n shim
3bee5b
Initial UEFI bootloader that handles chaining to a trusted full bootloader
3bee5b
under secure boot environments. This package contains the version signed by
3bee5b
the UEFI signing service.
3bee5b
3bee5b
%prep
3bee5b
cd %{_builddir}
3bee5b
rm -rf shim-signed-%{version}
3bee5b
mkdir shim-signed-%{version}
3bee5b
3bee5b
%build
3bee5b
%define vendor_token_str %{expand:%%{nil}%%{?vendor_token_name:-t "%{vendor_token_name}"}}
3bee5b
%define vendor_cert_str %{expand:%%{!?vendor_cert_nickname:-c "Red Hat Test Certificate"}%%{?vendor_cert_nickname:-c "%%{vendor_cert_nickname}"}}
3bee5b
3bee5b
cd shim-signed-%{version}
3bee5b
pesign -i %{_datadir}/shim/shim.efi -h -P > shim.hash
3bee5b
if ! cmp shim.hash %{_datadir}/shim/shim.hash ; then
3bee5b
	echo Invalid signature\! > /dev/stderr
3bee5b
	exit 1
3bee5b
fi
3bee5b
%pesign -s -i %{_datadir}/shim/shim.efi -o shim.efi -a %{SOURCE3} -c %{SOURCE2} -n redhatsecureboot003
3bee5b
%pesign -s -i %{_datadir}/shim/MokManager.efi -o MokManager.efi -a %{SOURCE3} -c %{SOURCE2} -n redhatsecureboot003
3bee5b
%pesign -s -i %{_datadir}/shim/fallback.efi -o fallback.efi -a %{SOURCE3} -c %{SOURCE2} -n redhatsecureboot003
3bee5b
3bee5b
%install
3bee5b
rm -rf $RPM_BUILD_ROOT
3bee5b
cd shim-signed-%{version}
3bee5b
install -D -d -m 0755 $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/
3bee5b
install -m 0644 shim.efi $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shim.efi
3bee5b
install -m 0644 MokManager.efi $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/MokManager.efi
3bee5b
install -m 0644 %{SOURCE1} $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/BOOT.CSV
3bee5b
3bee5b
install -D -d -m 0755 $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/
3bee5b
install -m 0644 shim.efi $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/BOOTX64.EFI
3bee5b
install -m 0644 fallback.efi $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/fallback.efi
3bee5b
3bee5b
%files -n shim
3bee5b
/boot/efi/EFI/%{efidir}/shim.efi
3bee5b
/boot/efi/EFI/%{efidir}/MokManager.efi
3bee5b
/boot/efi/EFI/%{efidir}/BOOT.CSV
3bee5b
/boot/efi/EFI/BOOT/BOOTX64.EFI
3bee5b
/boot/efi/EFI/BOOT/fallback.efi
3bee5b
3bee5b
%changelog
3bee5b
* Thu Nov 21 2013 Peter Jones <pjones@redhat.com> - 0.7-5
3bee5b
- Fix shim-unsigned deps.
3bee5b
  Related: rhbz#1032583
3bee5b
3bee5b
* Thu Nov 21 2013 Peter Jones <pjones@redhat.com> - 0.7-4
3bee5b
- Make dhcp4 work better.
3bee5b
  Related: rhbz#1032583
3bee5b
3bee5b
* Thu Nov 14 2013 Peter Jones <pjones@redhat.com> - 0.7-3
3bee5b
- Make lockdown include UEFI and other KEK/DB entries.
3bee5b
  Related: rhbz#1030492
3bee5b
3bee5b
* Fri Nov 08 2013 Peter Jones <pjones@redhat.com> - 0.7-2
3bee5b
- Handle SetupMode better in lockdown as well
3bee5b
  Related: rhbz#996863
3bee5b
3bee5b
* Wed Nov 06 2013 Peter Jones <pjones@redhat.com> - 0.7-1
3bee5b
- Don't treat SetupMode variable's presence as meaning we're in SetupMode.
3bee5b
  Related: rhbz#996863
3bee5b
3bee5b
* Wed Nov 06 2013 Peter Jones <pjones@redhat.com> - 0.6-3
3bee5b
- Use the correct CA and signer certificates.
3bee5b
  Related: rhbz#996863
3bee5b
3bee5b
* Thu Oct 31 2013 Peter Jones <pjones@redhat.com> - 0.6-1
3bee5b
- Update to 0.6-1
3bee5b
  Resolves: rhbz#1008379
3bee5b
3bee5b
* Wed Aug 07 2013 Peter Jones <pjones@redhat.com> - 0.4-3.2
3bee5b
- Depend on newer pesign.
3bee5b
  Related: rhbz#989442
3bee5b
3bee5b
* Tue Aug 06 2013 Peter Jones <pjones@redhat.com> - 0.4-3.1
3bee5b
- Rebuild with newer pesign
3bee5b
  Related: rhbz#989442
3bee5b
3bee5b
* Tue Aug 06 2013 Peter Jones <pjones@redhat.com> - 0.4-3
3bee5b
- Update for RHEL signing with early test keys.
3bee5b
  Related: rhbz#989442
3bee5b
3bee5b
* Thu Jun 20 2013 Peter Jones <pjones@redhat.com> - 0.4-1
3bee5b
- Provide a fallback for uninitialized Boot#### and BootOrder
3bee5b
  Resolves: rhbz#963359
3bee5b
- Move all signing from shim-unsigned to here
3bee5b
- properly compare our generated hash from shim-unsigned with the hash of
3bee5b
  the signed binary (as opposed to doing it manually)
3bee5b
3bee5b
* Fri May 31 2013 Peter Jones <pjones@redhat.com> - 0.2-4.4
3bee5b
- Re-sign to get alignments that match the new specification.
3bee5b
  Resolves: rhbz#963361
3bee5b
3bee5b
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.2-4.3
3bee5b
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
3bee5b
3bee5b
* Wed Jan 02 2013 Peter Jones <pjones@redhat.com> - 0.2-3.3
3bee5b
- Add obsoletes and provides for earlier shim-signed packages, to cover
3bee5b
  the package update cases where previous versions were installed.
3bee5b
  Related: rhbz#888026
3bee5b
3bee5b
* Mon Dec 17 2012 Peter Jones <pjones@redhat.com> - 0.2-3.2
3bee5b
- Make the shim-unsigned dep be on the subpackage.
3bee5b
3bee5b
* Sun Dec 16 2012 Peter Jones <pjones@redhat.com> - 0.2-3.1
3bee5b
- Rebuild to provide "shim" package directly instead of just as a Provides:
3bee5b
3bee5b
* Sat Dec 15 2012 Peter Jones <pjones@redhat.com> - 0.2-3
3bee5b
- Also provide shim-fedora.efi, signed only by the fedora signer.
3bee5b
- Fix the fedora signature on the result to actually be correct.
3bee5b
- Update for shim-unsigned 0.2-3
3bee5b
3bee5b
* Mon Dec 03 2012 Peter Jones <pjones@redhat.com> - 0.2-2
3bee5b
- Initial build