shim package update
Signed-off-by: basebuilder_pel7x64builder0 <basebuilder@powerel.org>master
basebuilder_pel7x64builder0
parent
44fb971b39
commit
036978e38d
Binary file not shown.
|
|
@ -0,0 +1,412 @@
|
|||
#!/bin/bash
|
||||
#find-debuginfo.sh - automagically generate debug info and file list
|
||||
#for inclusion in an rpm spec file.
|
||||
#
|
||||
# Usage: find-debuginfo.sh [--strict-build-id] [-g] [-r]
|
||||
# [-o debugfiles.list]
|
||||
# [[-l filelist]... [-p 'pattern'] -o debuginfo.list]
|
||||
# [builddir]
|
||||
#
|
||||
# The -g flag says to use strip -g instead of full strip on DSOs or EXEs.
|
||||
# The --strict-build-id flag says to exit with failure status if
|
||||
# any ELF binary processed fails to contain a build-id note.
|
||||
# The -r flag says to use eu-strip --reloc-debug-sections.
|
||||
#
|
||||
# A single -o switch before any -l or -p switches simply renames
|
||||
# the primary output file from debugfiles.list to something else.
|
||||
# A -o switch that follows a -p switch or some -l switches produces
|
||||
# an additional output file with the debuginfo for the files in
|
||||
# the -l filelist file, or whose names match the -p pattern.
|
||||
# The -p argument is an grep -E -style regexp matching the a file name,
|
||||
# and must not use anchors (^ or $).
|
||||
#
|
||||
# All file names in switches are relative to builddir (. if not given).
|
||||
#
|
||||
|
||||
# With -g arg, pass it to strip on libraries or executables.
|
||||
strip_g=false
|
||||
|
||||
# with -r arg, pass --reloc-debug-sections to eu-strip.
|
||||
strip_r=false
|
||||
|
||||
# Barf on missing build IDs.
|
||||
strict=false
|
||||
|
||||
BUILDDIR=.
|
||||
out=debugfiles.list
|
||||
nout=0
|
||||
while [ $# -gt 0 ]; do
|
||||
case "$1" in
|
||||
--strict-build-id)
|
||||
strict=true
|
||||
;;
|
||||
-g)
|
||||
strip_g=true
|
||||
;;
|
||||
-o)
|
||||
if [ -z "${lists[$nout]}" -a -z "${ptns[$nout]}" ]; then
|
||||
out=$2
|
||||
else
|
||||
outs[$nout]=$2
|
||||
((nout++))
|
||||
fi
|
||||
shift
|
||||
;;
|
||||
-l)
|
||||
lists[$nout]="${lists[$nout]} $2"
|
||||
shift
|
||||
;;
|
||||
-p)
|
||||
ptns[$nout]=$2
|
||||
shift
|
||||
;;
|
||||
-r)
|
||||
strip_r=true
|
||||
;;
|
||||
*)
|
||||
BUILDDIR=$1
|
||||
shift
|
||||
break
|
||||
;;
|
||||
esac
|
||||
shift
|
||||
done
|
||||
|
||||
i=0
|
||||
while ((i < nout)); do
|
||||
outs[$i]="$BUILDDIR/${outs[$i]}"
|
||||
l=''
|
||||
for f in ${lists[$i]}; do
|
||||
l="$l $BUILDDIR/$f"
|
||||
done
|
||||
lists[$i]=$l
|
||||
((++i))
|
||||
done
|
||||
|
||||
LISTFILE="$BUILDDIR/$out"
|
||||
SOURCEFILE="$BUILDDIR/debugsources.list"
|
||||
LINKSFILE="$BUILDDIR/debuglinks.list"
|
||||
|
||||
> "$SOURCEFILE"
|
||||
> "$LISTFILE"
|
||||
> "$LINKSFILE"
|
||||
|
||||
debugdir="${RPM_BUILD_ROOT}/usr/lib/debug"
|
||||
|
||||
strip_to_debug()
|
||||
{
|
||||
local g=
|
||||
local r=
|
||||
$strip_r && r=--reloc-debug-sections
|
||||
$strip_g && case "$(file -bi "$2")" in
|
||||
application/x-sharedlib*) g=-g ;;
|
||||
application/x-executable*) g=-g ;;
|
||||
esac
|
||||
eu-strip --remove-comment $r $g -f "$1" "$2" || exit
|
||||
chmod 444 "$1" || exit
|
||||
}
|
||||
|
||||
# Make a relative symlink to $1 called $3$2
|
||||
shopt -s extglob
|
||||
link_relative()
|
||||
{
|
||||
local t="$1" f="$2" pfx="$3"
|
||||
local fn="${f#/}" tn="${t#/}"
|
||||
local fd td d
|
||||
|
||||
while fd="${fn%%/*}"; td="${tn%%/*}"; [ "$fd" = "$td" ]; do
|
||||
fn="${fn#*/}"
|
||||
tn="${tn#*/}"
|
||||
done
|
||||
|
||||
d="${fn%/*}"
|
||||
if [ "$d" != "$fn" ]; then
|
||||
d="${d//+([!\/])/..}"
|
||||
tn="${d}/${tn}"
|
||||
fi
|
||||
|
||||
mkdir -p "$(dirname "$pfx$f")" && ln -snf "$tn" "$pfx$f"
|
||||
}
|
||||
|
||||
# Make a symlink in /usr/lib/debug/$2 to $1
|
||||
debug_link()
|
||||
{
|
||||
local l="/usr/lib/debug$2"
|
||||
local t="$1"
|
||||
echo >> "$LINKSFILE" "$l $t"
|
||||
link_relative "$t" "$l" "$RPM_BUILD_ROOT"
|
||||
}
|
||||
|
||||
# Provide .2, .3, ... symlinks to all filename instances of this build-id.
|
||||
make_id_dup_link()
|
||||
{
|
||||
local id="$1" file="$2" idfile
|
||||
|
||||
local n=1
|
||||
while true; do
|
||||
idfile=".build-id/${id:0:2}/${id:2}.$n"
|
||||
[ $# -eq 3 ] && idfile="${idfile}$3"
|
||||
if [ ! -L "$RPM_BUILD_ROOT/usr/lib/debug/$idfile" ]; then
|
||||
break
|
||||
fi
|
||||
n=$[$n+1]
|
||||
done
|
||||
debug_link "$file" "/$idfile"
|
||||
}
|
||||
|
||||
# Make a build-id symlink for id $1 with suffix $3 to file $2.
|
||||
make_id_link()
|
||||
{
|
||||
local id="$1" file="$2"
|
||||
local idfile=".build-id/${id:0:2}/${id:2}"
|
||||
[ $# -eq 3 ] && idfile="${idfile}$3"
|
||||
local root_idfile="$RPM_BUILD_ROOT/usr/lib/debug/$idfile"
|
||||
|
||||
if [ ! -L "$root_idfile" ]; then
|
||||
debug_link "$file" "/$idfile"
|
||||
return
|
||||
fi
|
||||
|
||||
make_id_dup_link "$@"
|
||||
|
||||
[ $# -eq 3 ] && return 0
|
||||
|
||||
local other=$(readlink -m "$root_idfile")
|
||||
other=${other#$RPM_BUILD_ROOT}
|
||||
if cmp -s "$root_idfile" "$RPM_BUILD_ROOT$file" ||
|
||||
eu-elfcmp -q "$root_idfile" "$RPM_BUILD_ROOT$file" 2> /dev/null; then
|
||||
# Two copies. Maybe one has to be setuid or something.
|
||||
echo >&2 "*** WARNING: identical binaries are copied, not linked:"
|
||||
echo >&2 " $file"
|
||||
echo >&2 " and $other"
|
||||
else
|
||||
# This is pathological, break the build.
|
||||
echo >&2 "*** ERROR: same build ID in nonidentical files!"
|
||||
echo >&2 " $file"
|
||||
echo >&2 " and $other"
|
||||
exit 2
|
||||
fi
|
||||
}
|
||||
|
||||
get_debugfn()
|
||||
{
|
||||
dn=$(dirname "${1#$RPM_BUILD_ROOT}")
|
||||
[ "$dn" == "." ] && dn=""
|
||||
bn=$(basename "$1" .so).debug
|
||||
bn=$(basename "$bn" .debug).debug
|
||||
|
||||
debugdn=${debugdir}${dn}
|
||||
debugfn=${debugdn}/${bn}
|
||||
|
||||
[ -n "$2" ] && shadowfn=$(basename "$2")
|
||||
}
|
||||
|
||||
set -o pipefail
|
||||
|
||||
strict_error=ERROR
|
||||
$strict || strict_error=WARNING
|
||||
|
||||
handle_single_file()
|
||||
{
|
||||
nlinks=$1 && shift
|
||||
inum=$1 && shift
|
||||
f=$1 && shift
|
||||
shadow=$1 && shift
|
||||
zf="$f"
|
||||
[ -n "${shadowfn}" ] && zf="${shadowfn}"
|
||||
|
||||
get_debugfn "$f" "$shadow"
|
||||
[ -f "${debugfn}" ] && return
|
||||
|
||||
# If this file has multiple links, keep track and make
|
||||
# the corresponding .debug files all links to one file too.
|
||||
if [ $nlinks -gt 1 ]; then
|
||||
eval linked=\$linked_$inum
|
||||
if [ -n "$linked" ]; then
|
||||
eval id=\$linkedid_$inum
|
||||
make_id_dup_link "$id" "$dn/$(basename ${zf})"
|
||||
make_id_dup_link "$id" "/usr/lib/debug$dn/$bn" .debug
|
||||
link=$debugfn
|
||||
get_debugfn "$linked"
|
||||
echo "hard linked $link to $debugfn"
|
||||
mkdir -p "$(dirname "$link")" && ln -nf "$debugfn" "$link"
|
||||
return
|
||||
else
|
||||
eval linked_$inum=\$f
|
||||
echo "file $f has $[$nlinks - 1] other hard links"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "extracting debug info from $f"
|
||||
echo /usr/lib/rpm/debugedit -b "$RPM_BUILD_DIR" -d /usr/src/debug \
|
||||
-i -l "$SOURCEFILE" "$f"
|
||||
id=$(/usr/lib/rpm/debugedit -b "$RPM_BUILD_DIR" -d /usr/src/debug \
|
||||
-i -l "$SOURCEFILE" "$f") || exit
|
||||
if [ $nlinks -gt 1 ]; then
|
||||
eval linkedid_$inum=\$id
|
||||
fi
|
||||
if [ -z "$id" ]; then
|
||||
echo >&2 "*** ${strict_error}: No build ID note found in $zf"
|
||||
$strict && exit 2
|
||||
fi
|
||||
|
||||
[ -x /usr/bin/gdb-add-index ] && /usr/bin/gdb-add-index "$zf" > /dev/null 2>&1
|
||||
|
||||
# A binary already copied into /usr/lib/debug doesn't get stripped,
|
||||
# just has its file names collected and adjusted.
|
||||
case "$dn" in
|
||||
/usr/lib/debug/*)
|
||||
[ -z "$id" ] || make_id_link "$id" "$dn/$(basename $zf)"
|
||||
return ;;
|
||||
esac
|
||||
|
||||
mkdir -p "${debugdn}"
|
||||
if test -w "$f"; then
|
||||
strip_to_debug "${debugfn}" "$f"
|
||||
else
|
||||
chmod u+w "$f"
|
||||
strip_to_debug "${debugfn}" "$f"
|
||||
chmod u-w "$f"
|
||||
fi
|
||||
|
||||
if [ -n "$id" ]; then
|
||||
make_id_link "$id" "$dn/$(basename ${zf})"
|
||||
make_id_link "$id" "/usr/lib/debug$dn/$bn" .debug
|
||||
fi
|
||||
}
|
||||
|
||||
# Strip ELF binaries
|
||||
find "$RPM_BUILD_ROOT" ! -path "${debugdir}/*.debug" -type f \
|
||||
\( -perm -0100 -or -perm -0010 -or -perm -0001 \) \
|
||||
-print |
|
||||
file -N -f - | sed -n -e 's/^\(.*\):[ ]*.*ELF.*, not stripped.*/\1/p' |
|
||||
xargs --no-run-if-empty stat -c '%h %D_%i %n' |
|
||||
while read nlinks inum f; do
|
||||
handle_single_file $nlinks $inum $f
|
||||
done || exit
|
||||
|
||||
find "$RPM_BUILD_ROOT" ! -path "${debugdir}/*.debug" -type f \
|
||||
-iname '*.efi' -print |
|
||||
file -N -f - | sed -n -e 's/^\(.*\):[ ]*.*PE32.*EFI .*/\1/p' |
|
||||
xargs --no-run-if-empty stat -c '%h %D_%i %n' |
|
||||
while read nlinks inum f; do
|
||||
[ -f "$f" ] || continue
|
||||
[ -f "${f%%.efi}.so" ] || continue
|
||||
handle_single_file $nlinks $inum ${f%%.efi}.so $f
|
||||
done || exit
|
||||
|
||||
# On Aarch64 file tells us "MS-DOS" instead of PE32+. Why not.
|
||||
find "$RPM_BUILD_ROOT" ! -path "${debugdir}/*.debug" -type f \
|
||||
-iname '*.efi' -print |
|
||||
file -N -f - | sed -n -e 's/^\(.*\):[ ]MS-DOS.*/\1/p' |
|
||||
xargs --no-run-if-empty stat -c '%h %D_%i %n' |
|
||||
while read nlinks inum f; do
|
||||
[ -f "$f" ] || continue
|
||||
[ -f "${f%%.efi}.so" ] || continue
|
||||
handle_single_file $nlinks $inum ${f%%.efi}.so $f
|
||||
done || exit
|
||||
# For each symlink whose target has a .debug file,
|
||||
# make a .debug symlink to that file.
|
||||
find "$RPM_BUILD_ROOT" ! -path "${debugdir}/*" -type l -print |
|
||||
while read f
|
||||
do
|
||||
t=$(readlink -m "$f").debug
|
||||
f=${f#$RPM_BUILD_ROOT}
|
||||
t=${t#$RPM_BUILD_ROOT}
|
||||
if [ -f "$debugdir$t" ]; then
|
||||
echo "symlinked /usr/lib/debug$t to /usr/lib/debug${f}.debug"
|
||||
debug_link "/usr/lib/debug$t" "${f}.debug"
|
||||
fi
|
||||
done
|
||||
|
||||
if [ -s "$SOURCEFILE" ]; then
|
||||
mkdir -p "${RPM_BUILD_ROOT}/usr/src/debug"
|
||||
LC_ALL=C sort -z -u "$SOURCEFILE" | grep -E -v -z '(<internal>|<built-in>)$' |
|
||||
(cd "$RPM_BUILD_DIR"; cpio -pd0mL "${RPM_BUILD_ROOT}/usr/src/debug")
|
||||
# stupid cpio creates new directories in mode 0700, fixup
|
||||
find "${RPM_BUILD_ROOT}/usr/src/debug" -type d -print0 |
|
||||
xargs --no-run-if-empty -0 chmod a+rx
|
||||
fi
|
||||
|
||||
if [ -d "${RPM_BUILD_ROOT}/usr/lib" -o -d "${RPM_BUILD_ROOT}/usr/src" ]; then
|
||||
((nout > 0)) ||
|
||||
test ! -d "${RPM_BUILD_ROOT}/usr/lib" ||
|
||||
(cd "${RPM_BUILD_ROOT}/usr/lib"; find debug -type d) |
|
||||
sed 's,^,%dir /usr/lib/,' >> "$LISTFILE"
|
||||
|
||||
(cd "${RPM_BUILD_ROOT}/usr"
|
||||
test ! -d lib/debug || find lib/debug ! -type d
|
||||
test ! -d src/debug || find src/debug -mindepth 1 -maxdepth 1
|
||||
) | sed 's,^,/usr/,' >> "$LISTFILE"
|
||||
fi
|
||||
|
||||
# Append to $1 only the lines from stdin not already in the file.
|
||||
append_uniq()
|
||||
{
|
||||
grep -F -f "$1" -x -v >> "$1"
|
||||
}
|
||||
|
||||
# Helper to generate list of corresponding .debug files from a file list.
|
||||
filelist_debugfiles()
|
||||
{
|
||||
local extra="$1"
|
||||
shift
|
||||
sed 's/^%[a-z0-9_][a-z0-9_]*([^)]*) *//
|
||||
s/^%[a-z0-9_][a-z0-9_]* *//
|
||||
/^$/d
|
||||
'"$extra" "$@"
|
||||
}
|
||||
|
||||
# Write an output debuginfo file list based on given input file lists.
|
||||
filtered_list()
|
||||
{
|
||||
local out="$1"
|
||||
shift
|
||||
test $# -gt 0 || return
|
||||
grep -F -f <(filelist_debugfiles 's,^.*$,/usr/lib/debug&.debug,' "$@") \
|
||||
-x $LISTFILE >> $out
|
||||
sed -n -f <(filelist_debugfiles 's/[\\.*+#]/\\&/g
|
||||
h
|
||||
s,^.*$,s# &$##p,p
|
||||
g
|
||||
s,^.*$,s# /usr/lib/debug&.debug$##p,p
|
||||
' "$@") "$LINKSFILE" | append_uniq "$out"
|
||||
}
|
||||
|
||||
# Write an output debuginfo file list based on an grep -E -style regexp.
|
||||
pattern_list()
|
||||
{
|
||||
local out="$1" ptn="$2"
|
||||
test -n "$ptn" || return
|
||||
grep -E -x -e "$ptn" "$LISTFILE" >> "$out"
|
||||
sed -n -r "\#^$ptn #s/ .*\$//p" "$LINKSFILE" | append_uniq "$out"
|
||||
}
|
||||
|
||||
#
|
||||
# When given multiple -o switches, split up the output as directed.
|
||||
#
|
||||
i=0
|
||||
while ((i < nout)); do
|
||||
> ${outs[$i]}
|
||||
filtered_list ${outs[$i]} ${lists[$i]}
|
||||
pattern_list ${outs[$i]} "${ptns[$i]}"
|
||||
grep -Fvx -f ${outs[$i]} "$LISTFILE" > "${LISTFILE}.new"
|
||||
mv "${LISTFILE}.new" "$LISTFILE"
|
||||
((++i))
|
||||
done
|
||||
if ((nout > 0)); then
|
||||
# Now add the right %dir lines to each output list.
|
||||
(cd "${RPM_BUILD_ROOT}"; find usr/lib/debug -type d) |
|
||||
sed 's#^.*$#\\@^/&/@{h;s@^.*$@%dir /&@p;g;}#' |
|
||||
LC_ALL=C sort -ur > "${LISTFILE}.dirs.sed"
|
||||
i=0
|
||||
while ((i < nout)); do
|
||||
sed -n -f "${LISTFILE}.dirs.sed" "${outs[$i]}" | sort -u > "${outs[$i]}.new"
|
||||
cat "${outs[$i]}" >> "${outs[$i]}.new"
|
||||
mv -f "${outs[$i]}.new" "${outs[$i]}"
|
||||
((++i))
|
||||
done
|
||||
sed -n -f "${LISTFILE}.dirs.sed" "${LISTFILE}" | sort -u > "${LISTFILE}.new"
|
||||
cat "$LISTFILE" >> "${LISTFILE}.new"
|
||||
mv "${LISTFILE}.new" "$LISTFILE"
|
||||
fi
|
||||
|
|
@ -0,0 +1,351 @@
|
|||
Name: shim
|
||||
Version: 12
|
||||
Release: 1%{?dist}
|
||||
Summary: First-stage UEFI bootloader
|
||||
|
||||
License: BSD
|
||||
URL: http://www.codon.org.uk/~mjg59/shim/
|
||||
Source0: https://github.com/mjg59/shim/releases/download/%{version}/shim-%{version}.tar.bz2
|
||||
Source1: powerel.crt
|
||||
# currently here's what's in our dbx: # nothing.
|
||||
#Source2: dbx-x64.esl
|
||||
#Source3: dbx-aa64.esl
|
||||
Source4: shim-find-debuginfo.sh
|
||||
|
||||
BuildRequires: git openssl-devel openssl
|
||||
BuildRequires: pesign >= 0.106-1
|
||||
BuildRequires: gnu-efi >= 1:3.0.5-6.el7, gnu-efi-devel >= 1:3.0.5-6.el7
|
||||
|
||||
# for xxd
|
||||
BuildRequires: vim-common
|
||||
|
||||
# Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not
|
||||
# compatible with SysV (there's no red zone under UEFI) and there isn't a
|
||||
# POSIX-style C library.
|
||||
Provides: bundled(openssl) = 1.0.2j
|
||||
|
||||
# Shim is only required on platforms implementing the UEFI secure boot
|
||||
# protocol. The only one of those we currently wish to support is 64-bit x86.
|
||||
# Adding further platforms will require adding appropriate relocation code.
|
||||
ExclusiveArch: x86_64 aarch64
|
||||
|
||||
%ifarch x86_64
|
||||
%global efiarch x64
|
||||
%endif
|
||||
%ifarch aarch64
|
||||
%global efiarch aa64
|
||||
%endif
|
||||
|
||||
# Figure out the right file path to use
|
||||
%global efidir powerel
|
||||
|
||||
%define debug_package %{nil}
|
||||
%global __debug_package 1
|
||||
|
||||
%global _binaries_in_noarch_packages_terminate_build 0
|
||||
|
||||
%description
|
||||
Initial UEFI bootloader that handles chaining to a trusted full bootloader
|
||||
under secure boot environments.
|
||||
|
||||
%package -n shim-unsigned-%{efiarch}
|
||||
Summary: First-stage UEFI bootloader (unsigned data)
|
||||
|
||||
%description -n shim-unsigned-%{efiarch}
|
||||
Initial UEFI bootloader that handles chaining to a trusted full bootloader
|
||||
under secure boot environments.
|
||||
|
||||
%package -n shim-unsigned-%{efiarch}-debuginfo
|
||||
Obsoletes: shim-debuginfo < 0.9
|
||||
Summary: Debug information for package %{name}
|
||||
Group: Development/Debug
|
||||
AutoReqProv: 0
|
||||
BuildArch: noarch
|
||||
|
||||
%description -n shim-unsigned-%{efiarch}-debuginfo
|
||||
This package provides debug information for package %{name}.
|
||||
Debug information is useful when developing applications that use this
|
||||
package or when debugging this package.
|
||||
|
||||
%ifarch x86_64
|
||||
%package -n shim-unsigned-ia32
|
||||
Summary: First-stage UEFI bootloader (unsigned data)
|
||||
|
||||
%description -n shim-unsigned-ia32
|
||||
Initial UEFI bootloader that handles chaining to a trusted full bootloader
|
||||
under secure boot environments.
|
||||
|
||||
%package -n shim-unsigned-ia32-debuginfo
|
||||
Obsoletes: shim-debuginfo < 0.9
|
||||
Summary: Debug information for package %{name}
|
||||
Group: Development/Debug
|
||||
AutoReqProv: 0
|
||||
BuildArch: noarch
|
||||
|
||||
%description -n shim-unsigned-ia32-debuginfo
|
||||
This package provides debug information for package %{name}.
|
||||
Debug information is useful when developing applications that use this
|
||||
package or when debugging this package.
|
||||
%endif
|
||||
|
||||
%prep
|
||||
%setup -T -n %{name}-%{version}-%{release} -c
|
||||
%{__tar} -xo -f %{SOURCE0}
|
||||
mv %{name}-%{version} %{name}-%{version}-%{efiarch}
|
||||
cd %{name}-%{version}-%{efiarch}
|
||||
git init
|
||||
git config user.email "example@example.com"
|
||||
git config user.name "rpmbuild -bp"
|
||||
git add .
|
||||
git commit -a -q -m "%{version} baseline."
|
||||
git am --ignore-whitespace %{patches} </dev/null
|
||||
git config --unset user.email
|
||||
git config --unset user.name
|
||||
|
||||
%ifarch x86_64
|
||||
cd ..
|
||||
%{__tar} -xo -f %{SOURCE0}
|
||||
mv %{name}-%{version} %{name}-%{version}-ia32
|
||||
cd %{name}-%{version}-ia32
|
||||
git init
|
||||
git config user.email "example@example.com"
|
||||
git config user.name "rpmbuild -bp"
|
||||
git add .
|
||||
git commit -a -q -m "%{version} baseline."
|
||||
git am --ignore-whitespace %{patches} </dev/null
|
||||
git config --unset user.email
|
||||
git config --unset user.name
|
||||
%endif
|
||||
|
||||
%build
|
||||
COMMITID=$(cat %{name}-%{version}-%{efiarch}/commit)
|
||||
MAKEFLAGS="RELEASE=%{release} ENABLE_HTTPBOOT=true COMMITID=${COMMITID}"
|
||||
%ifarch aarch64
|
||||
if [ -f "%{SOURCE1}" ]; then
|
||||
MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}"
|
||||
fi
|
||||
if [ -f "%{SOURCE3}" ]; then
|
||||
MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE3}"
|
||||
fi
|
||||
%else
|
||||
if [ -f "%{SOURCE1}" ]; then
|
||||
MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}"
|
||||
fi
|
||||
if [ -f "%{SOURCE2}" ]; then
|
||||
MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}"
|
||||
fi
|
||||
%endif
|
||||
cd %{name}-%{version}-%{efiarch}
|
||||
make 'DEFAULT_LOADER=\\\\grub%{efiarch}.efi' ${MAKEFLAGS} shim%{efiarch}.efi mm%{efiarch}.efi fb%{efiarch}.efi
|
||||
|
||||
%ifarch x86_64
|
||||
cd ../%{name}-%{version}-ia32
|
||||
setarch linux32 -B make 'DEFAULT_LOADER=\\\\grubia32.efi' ARCH=ia32 ${MAKEFLAGS} shimia32.efi mmia32.efi fbia32.efi
|
||||
cd ../%{name}-%{version}-%{efiarch}
|
||||
%endif
|
||||
|
||||
%install
|
||||
cd %{name}-%{version}-%{efiarch}
|
||||
pesign -h -P -i shim%{efiarch}.efi -h > shim%{efiarch}.hash
|
||||
install -D -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/
|
||||
install -m 0644 shim%{efiarch}.hash $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/shim%{efiarch}.hash
|
||||
for x in shim%{efiarch} mm%{efiarch} fb%{efiarch} ; do
|
||||
install -m 0644 $x.efi $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/
|
||||
install -m 0644 $x.so $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/
|
||||
done
|
||||
|
||||
%ifarch x86_64
|
||||
cd ../%{name}-%{version}-ia32
|
||||
pesign -h -P -i shimia32.efi -h > shimia32.hash
|
||||
install -D -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/shim/ia32-%{version}-%{release}/
|
||||
install -m 0644 shimia32.hash $RPM_BUILD_ROOT%{_datadir}/shim/ia32-%{version}-%{release}/shimia32.hash
|
||||
for x in shimia32 mmia32 fbia32 ; do
|
||||
install -m 0644 $x.efi $RPM_BUILD_ROOT%{_datadir}/shim/ia32-%{version}-%{release}/
|
||||
install -m 0644 $x.so $RPM_BUILD_ROOT%{_datadir}/shim/ia32-%{version}-%{release}/
|
||||
done
|
||||
cd ../%{name}-%{version}-%{efiarch}
|
||||
%endif
|
||||
|
||||
%ifarch x86_64
|
||||
%global __debug_install_post \
|
||||
bash %{SOURCE4} \\\
|
||||
%{?_missing_build_ids_terminate_build:--strict-build-id}\\\
|
||||
%{?_find_debuginfo_opts} \\\
|
||||
"%{_builddir}/%{?buildsubdir}/%{name}-%{version}-%{efiarch}" \
|
||||
rm -f $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/*.so \
|
||||
mv debugfiles.list ../debugfiles-%{efiarch}.list \
|
||||
cd .. \
|
||||
cd %{name}-%{version}-ia32 \
|
||||
bash %{SOURCE4} \\\
|
||||
%{?_missing_build_ids_terminate_build:--strict-build-id}\\\
|
||||
%{?_find_debuginfo_opts} \\\
|
||||
"%{_builddir}/%{?buildsubdir}/%{name}-%{version}-ia32" \
|
||||
rm -f $RPM_BUILD_ROOT%{_datadir}/shim/ia32-%{version}-%{release}/*.so \
|
||||
mv debugfiles.list ../debugfiles-ia32.list \
|
||||
cd .. \
|
||||
%{nil}
|
||||
%else
|
||||
%global __debug_install_post \
|
||||
bash %{SOURCE4} \\\
|
||||
%{?_missing_build_ids_terminate_build:--strict-build-id}\\\
|
||||
%{?_find_debuginfo_opts} \\\
|
||||
"%{_builddir}/%{?buildsubdir}/%{name}-%{version}-%{efiarch}" \
|
||||
rm -f $RPM_BUILD_ROOT%{_datadir}/shim/%{efiarch}-%{version}-%{release}/*.so \
|
||||
mv debugfiles.list ../debugfiles-%{efiarch}.list \
|
||||
cd .. \
|
||||
%{nil}
|
||||
%endif
|
||||
|
||||
%files -n shim-unsigned-%{efiarch}
|
||||
%dir %{_datadir}/shim
|
||||
%dir %{_datadir}/shim/%{efiarch}-%{version}-%{release}/
|
||||
%{_datadir}/shim/%{efiarch}-%{version}-%{release}/*.efi
|
||||
%{_datadir}/shim/%{efiarch}-%{version}-%{release}/*.hash
|
||||
|
||||
%files -n shim-unsigned-%{efiarch}-debuginfo -f debugfiles-%{efiarch}.list
|
||||
%defattr(-,root,root)
|
||||
|
||||
%ifarch x86_64
|
||||
%files -n shim-unsigned-ia32
|
||||
%dir %{_datadir}/shim
|
||||
%dir %{_datadir}/shim/ia32-%{version}-%{release}/
|
||||
%{_datadir}/shim/ia32-%{version}-%{release}/*.efi
|
||||
%{_datadir}/shim/ia32-%{version}-%{release}/*.hash
|
||||
|
||||
%files -n shim-unsigned-ia32-debuginfo -f debugfiles-ia32.list
|
||||
%defattr(-,root,root)
|
||||
%endif
|
||||
|
||||
%changelog
|
||||
* Tue Aug 08 2017 Karanbir Singh <kbsingh@centos.org> - 12.1.el7.centos
|
||||
- Rebuild with CentOS cert
|
||||
|
||||
* Thu Apr 27 2017 Peter Jones <pjones@redhat.com> - 12-1
|
||||
- Update to 12-1 to work around a signtool.exe bug
|
||||
Related: rhbz#1445393
|
||||
|
||||
* Mon Apr 03 2017 Peter Jones <pjones@redhat.com> - 11-1
|
||||
- Update to 11-1
|
||||
Related: rhbz#1310766
|
||||
- Fix regression in PE loader
|
||||
Related: rhbz#1310766
|
||||
- Fix case where BDS invokes us wrong and we exec shim again as a result
|
||||
Related: rhbz#1310766
|
||||
|
||||
* Tue Mar 21 2017 Peter Jones <pjones@redhat.com> - 10-1
|
||||
- Update to 10-1
|
||||
- Support ia32
|
||||
Resolves: rhbz#1310766
|
||||
- Handle various different load option implementation differences
|
||||
- TPM 1 and TPM 2 support.
|
||||
- Update to OpenSSL 1.0.2k
|
||||
|
||||
* Mon Jun 22 2015 Peter Jones <pjones@redhat.com> - 0.9-1
|
||||
- Update to 0.9-1
|
||||
- Fix early call to BS->Exit()
|
||||
Resolves: rhbz#1115843
|
||||
- Implement shim on aarch64
|
||||
Resolves: rhbz#1100048
|
||||
Resolves: rhbz#1190191
|
||||
|
||||
* Mon Jun 22 2015 Peter Jones <pjones@redhat.com> - 0.7-14
|
||||
- Excise mokutil.
|
||||
Related: rhbz#1100048
|
||||
|
||||
* Mon Jun 22 2015 Peter Jones <pjones@redhat.com> - 0.7-13
|
||||
- Do a build for Aarch64 to make the tree composable.
|
||||
Related: rhbz#1100048
|
||||
|
||||
* Wed Feb 25 2015 Peter Jones <pjones@redhat.com> - 0.7-10
|
||||
- Fix a couple more minor bugs aavmf has found in fallback.
|
||||
Related: rhbz#1190191
|
||||
- Build lib/ with the right CFLAGS
|
||||
Related: rhbz#1190191
|
||||
|
||||
* Tue Feb 24 2015 Peter Jones <pjones@redhat.com> - 0.7-9
|
||||
- Fix aarch64 section loading.
|
||||
Related: rhbz#1190191
|
||||
|
||||
* Tue Sep 30 2014 Peter Jones <pjones@redhat.com> - 0.7-8
|
||||
- Build -8 for arm as well.
|
||||
Related: rhbz#1100048
|
||||
- out-of-bounds memory read flaw in DHCPv6 packet processing
|
||||
Resolves: CVE-2014-3675
|
||||
- heap-based buffer overflow flaw in IPv6 address parsing
|
||||
Resolves: CVE-2014-3676
|
||||
- memory corruption flaw when processing Machine Owner Keys (MOKs)
|
||||
Resolves: CVE-2014-3677
|
||||
|
||||
* Tue Sep 23 2014 Peter Jones <pjones@redhat.com> - 0.7-7
|
||||
- Use the right key for ARM Aarch64.
|
||||
|
||||
* Sun Sep 21 2014 Peter Jones <pjones@redhat.com> - 0.7-6
|
||||
- Preliminary build for ARM Aarch64.
|
||||
|
||||
* Tue Feb 18 2014 Peter Jones <pjones@redhat.com> - 0.7-5
|
||||
- Update for production signing
|
||||
Resolves: rhbz#1064424
|
||||
Related: rhbz#1064449
|
||||
|
||||
* Thu Nov 21 2013 Peter Jones <pjones@redhat.com> - 0.7-4
|
||||
- Make dhcpv4 paths work better when netbooting.
|
||||
Resolves: rhbz#1032583
|
||||
|
||||
* Thu Nov 14 2013 Peter Jones <pjones@redhat.com> - 0.7-3
|
||||
- Make lockdown include UEFI and other KEK/DB entries.
|
||||
Resolves: rhbz#1030492
|
||||
|
||||
* Fri Nov 08 2013 Peter Jones <pjones@redhat.com> - 0.7-2
|
||||
- Update lockdown to reflect SetupMode better as well
|
||||
Related: rhbz#996863
|
||||
|
||||
* Wed Nov 06 2013 Peter Jones <pjones@redhat.com> - 0.7-1
|
||||
- Fix logic to handle SetupMode efi variable.
|
||||
Related: rhbz#996863
|
||||
|
||||
* Thu Oct 31 2013 Peter Jones <pjones@redhat.com> - 0.6-1
|
||||
- Fix a FreePool(NULL) call on machines too old for SB
|
||||
|
||||
* Fri Oct 04 2013 Peter Jones <pjones@redhat.com> - 0.5-1
|
||||
- Update to 0.5
|
||||
|
||||
* Tue Aug 06 2013 Peter Jones <pjones@redhat.com> - 0.4-3
|
||||
- Build with early RHEL test keys.
|
||||
Related: rhbz#989442
|
||||
|
||||
* Thu Jul 25 2013 Peter Jones <pjones@redhat.com> - 0.4-2
|
||||
- Fix minor RHEL 7.0 build issues
|
||||
Resolves: rhbz#978766
|
||||
- Be less verbose by default
|
||||
|
||||
* Tue Jun 11 2013 Peter Jones <pjones@redhat.com> - 0.4-1
|
||||
- Update to 0.4
|
||||
|
||||
* Fri Jun 07 2013 Peter Jones <pjones@redhat.com> - 0.3-2
|
||||
- Require gnu-efi-3.0q for now.
|
||||
- Don't allow mmx or sse during compilation.
|
||||
- Re-organize this so all real signing happens in shim-signed instead.
|
||||
- Split out mokutil
|
||||
|
||||
* Wed Dec 12 2012 Peter Jones <pjones@redhat.com> - 0.2-3
|
||||
- Fix mokutil's idea of signature sizes.
|
||||
|
||||
* Wed Nov 28 2012 Matthew Garrett <mjg59@srcf.ucam.org> - 0.2-2
|
||||
- Fix secure_mode() always returning true
|
||||
|
||||
* Mon Nov 26 2012 Matthew Garrett <mjg59@srcf.ucam.org> - 0.2-1
|
||||
- Update shim
|
||||
- Include mokutil
|
||||
- Add debuginfo package since mokutil is a userspace executable
|
||||
|
||||
* Mon Oct 22 2012 Peter Jones <pjones@redhat.com> - 0.1-4
|
||||
- Produce an unsigned shim
|
||||
|
||||
* Tue Aug 14 2012 Peter Jones <pjones@redhat.com> - 0.1-3
|
||||
- Update how embedded cert and signing work.
|
||||
|
||||
* Mon Aug 13 2012 Josh Boyer <jwboyer@redhat.com> - 0.1-2
|
||||
- Add patch to fix image size calculation
|
||||
|
||||
* Mon Aug 13 2012 Matthew Garrett <mjg@redhat.com> - 0.1-1
|
||||
- initial release
|
||||
Loading…
Reference in New Issue