From 89da5c9f78a20bb13af794d49c661c436b900d90 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 17:57:58 +0000 Subject: [PATCH 1/8] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- sbsigntools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index 92d885e..616db08 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 10%{?dist} +Release: 11%{?dist} Summary: Signing utility for UEFI secure boot # Most source code is GPL-3.0-or-later, except: # LicenseRef-Fedora-Public-Domain: @@ -119,6 +119,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 0.9.5-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Thu Apr 10 2025 Carl George - 0.9.5-10 - Remove openssl engine support on EL10 From bd31748bedce0f3c8ff3b62edcd1171a26c68a9d Mon Sep 17 00:00:00 2001 From: Dominik 'Rathann' Mierzejewski Date: Fri, 3 Oct 2025 10:23:38 +0200 Subject: [PATCH 2/8] avoid wrong --target option usage that was fixed in recent binutils --- sbsigntools-binutils.patch | 12 ++++++++++++ sbsigntools.spec | 8 +++++++- 2 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 sbsigntools-binutils.patch diff --git a/sbsigntools-binutils.patch b/sbsigntools-binutils.patch new file mode 100644 index 0000000..9658db1 --- /dev/null +++ b/sbsigntools-binutils.patch @@ -0,0 +1,12 @@ +diff -up sbsigntools-0.9.5/tests/Makefile.am.orig sbsigntools-0.9.5/tests/Makefile.am +--- sbsigntools-0.9.5/tests/Makefile.am.orig 2025-10-03 10:20:11.676718647 +0200 ++++ sbsigntools-0.9.5/tests/Makefile.am 2025-10-03 10:20:40.506763759 +0200 +@@ -18,7 +18,7 @@ if TEST_BINARY_FORMAT + EFILDFLAGS = --defsym=EFI_SUBSYSTEM=0x0a + FORMAT = -O binary + else +-FORMAT = --target=efi-app-$(EFI_ARCH:x64=x86_64) ++FORMAT = --output-target=efi-app-$(EFI_ARCH:x64=x86_64) + endif + check_DATA = $(test_key) $(test_cert) + check_SCRIPTS = test-wrapper.sh diff --git a/sbsigntools.spec b/sbsigntools.spec index 616db08..fd0cd46 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 11%{?dist} +Release: 12%{?dist} Summary: Signing utility for UEFI secure boot # Most source code is GPL-3.0-or-later, except: # LicenseRef-Fedora-Public-Domain: @@ -41,6 +41,8 @@ Patch1: %{name}-gnuefi.patch Patch2: %{name}-no-wchar_t.patch # revert addition of openssl engine support Patch3: %{name}-no-openssl-engines.patch +# avoid wrong --target option usage that's been fixed in recent binutils +Patch4: %{name}-binutils.patch # same as gnu-efi ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} BuildRequires: make @@ -88,6 +90,7 @@ Tools to add signatures to EFI binaries and Drivers. # EL10 disables openssl engines %patch -p 1 -P 3 %endif +%patch -p 1 -P 4 %build ./autogen.sh @@ -119,6 +122,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Fri Oct 03 2025 Dominik Mierzejewski - 0.9.5-12 +- avoid wrong --target option usage that was fixed in recent binutils + * Fri Jul 25 2025 Fedora Release Engineering - 0.9.5-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From fe6286cbd62b9938fcab4893b2628892e1c45943 Mon Sep 17 00:00:00 2001 From: Marcin Juszkiewicz Date: Fri, 12 Dec 2025 10:10:00 +0100 Subject: [PATCH 3/8] enable RISC-V 64-bit architecture --- sbsigntools.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index fd0cd46..08acb1b 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 12%{?dist} +Release: 13%{?dist} Summary: Signing utility for UEFI secure boot # Most source code is GPL-3.0-or-later, except: # LicenseRef-Fedora-Public-Domain: @@ -44,7 +44,7 @@ Patch3: %{name}-no-openssl-engines.patch # avoid wrong --target option usage that's been fixed in recent binutils Patch4: %{name}-binutils.patch # same as gnu-efi -ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} +ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} riscv64 BuildRequires: make BuildRequires: automake BuildRequires: binutils-devel @@ -122,6 +122,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Fri Dec 12 2025 Marcin Juszkiewicz - 0.9.5-13 +- enable RISC-V 64-bit architecture + * Fri Oct 03 2025 Dominik Mierzejewski - 0.9.5-12 - avoid wrong --target option usage that was fixed in recent binutils From 7184a9cf30b8c4564929f14fc7d149eeb613ab48 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 17 Jan 2026 17:42:53 +0000 Subject: [PATCH 4/8] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- sbsigntools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index 08acb1b..11eba03 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 13%{?dist} +Release: 14%{?dist} Summary: Signing utility for UEFI secure boot # Most source code is GPL-3.0-or-later, except: # LicenseRef-Fedora-Public-Domain: @@ -122,6 +122,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Sat Jan 17 2026 Fedora Release Engineering - 0.9.5-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Fri Dec 12 2025 Marcin Juszkiewicz - 0.9.5-13 - enable RISC-V 64-bit architecture From 7c04329a3f14a20c7e59abe304d5055aebcbd884 Mon Sep 17 00:00:00 2001 From: Dominik 'Rathann' Mierzejewski Date: Fri, 20 Feb 2026 21:12:52 +0100 Subject: [PATCH 5/8] fix build with GCC16 (resolves rhbz#2435092) --- sbsigntools-unused-var.patch | 22 ++++++++++++++++++++++ sbsigntools.spec | 6 ++++++ 2 files changed, 28 insertions(+) create mode 100644 sbsigntools-unused-var.patch diff --git a/sbsigntools-unused-var.patch b/sbsigntools-unused-var.patch new file mode 100644 index 0000000..38356ab --- /dev/null +++ b/sbsigntools-unused-var.patch @@ -0,0 +1,22 @@ +diff -up sbsigntools-0.9.5/src/image.c.orig sbsigntools-0.9.5/src/image.c +--- sbsigntools-0.9.5/src/image.c.orig 2023-05-05 12:56:50.000000000 +0200 ++++ sbsigntools-0.9.5/src/image.c 2026-02-20 21:09:30.332942432 +0100 +@@ -512,17 +512,14 @@ int image_hash_sha256(struct image *imag + { + struct region *region; + SHA256_CTX ctx; +- int rc, i, n; ++ int rc, i; + + rc = SHA256_Init(&ctx); + if (!rc) + return -1; + +- n = 0; +- + for (i = 0; i < image->n_checksum_regions; i++) { + region = &image->checksum_regions[i]; +- n += region->size; + #if 0 + printf("sum region: 0x%04lx -> 0x%04lx [0x%04x bytes]\n", + region->data - image->buf, diff --git a/sbsigntools.spec b/sbsigntools.spec index 11eba03..d135b88 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -43,6 +43,8 @@ Patch2: %{name}-no-wchar_t.patch Patch3: %{name}-no-openssl-engines.patch # avoid wrong --target option usage that's been fixed in recent binutils Patch4: %{name}-binutils.patch +# remove unused variable +Patch5: %{name}-unused-var.patch # same as gnu-efi ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} riscv64 BuildRequires: make @@ -91,6 +93,7 @@ Tools to add signatures to EFI binaries and Drivers. %patch -p 1 -P 3 %endif %patch -p 1 -P 4 +%patch -p 1 -P 5 %build ./autogen.sh @@ -122,6 +125,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Fri Feb 20 2026 Dominik Mierzejewski - 0.9.5-15 +- fix build with GCC16 (resolves rhbz#2435092) + * Sat Jan 17 2026 Fedora Release Engineering - 0.9.5-14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From 7057343a4ef004fdaf1b1b75e984bebb0f43d4b2 Mon Sep 17 00:00:00 2001 From: Carl George Date: Sun, 17 May 2026 17:35:38 -0500 Subject: [PATCH 6/8] Remove openssl engine support Previously openssl engine support was only removed when building on CentOS/RHEL 10, where engines were patched out downstream. Now engines are removed upstream in openssl 4.0, which is planned to land in rawhide/f45. https://www.redhat.com/en/blog/openssl-3-providers-rhel-10 https://openssl-library.org/post/2025-12-18-remove-engines/ https://fedoraproject.org/wiki/Changes/OpenSSL40 --- sbsigntools.spec | 7 ------- 1 file changed, 7 deletions(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index d135b88..ead0448 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -58,10 +58,6 @@ BuildRequires: libuuid-devel BuildRequires: openssl %endif BuildRequires: openssl-devel -%if 0%{?fedora} >= 41 -# https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine -BuildRequires: openssl-devel-engine -%endif Provides: bundled(ccan-array_size) Provides: bundled(ccan-build_assert) Provides: bundled(ccan-check_type) @@ -88,10 +84,7 @@ Tools to add signatures to EFI binaries and Drivers. %patch -p 1 -P 0 %patch -p 1 -P 1 %patch -p 1 -P 2 -%if %{defined el10} -# EL10 disables openssl engines %patch -p 1 -P 3 -%endif %patch -p 1 -P 4 %patch -p 1 -P 5 From 46ba537f8400d4c218d9b59c1941bb8d1a958f4c Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 12 Jun 2026 19:44:37 -0400 Subject: [PATCH 7/8] Rebuilt for openssl 4.0 --- sbsigntools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index ead0448..c45073b 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 14%{?dist} +Release: 15%{?dist} Summary: Signing utility for UEFI secure boot # Most source code is GPL-3.0-or-later, except: # LicenseRef-Fedora-Public-Domain: @@ -118,6 +118,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Fri Jun 12 2026 Yaakov Selkowitz - 0.9.5-15 +- Rebuilt for openssl 4.0 + * Fri Feb 20 2026 Dominik Mierzejewski - 0.9.5-15 - fix build with GCC16 (resolves rhbz#2435092) From 93eac88cc1dbcbeda5d9d2fe18ecee6937915b7f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 17 Jul 2026 06:13:20 +0000 Subject: [PATCH 8/8] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild --- sbsigntools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index c45073b..2c3ba43 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 15%{?dist} +Release: 16%{?dist} Summary: Signing utility for UEFI secure boot # Most source code is GPL-3.0-or-later, except: # LicenseRef-Fedora-Public-Domain: @@ -118,6 +118,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Fri Jul 17 2026 Fedora Release Engineering - 0.9.5-16 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild + * Fri Jun 12 2026 Yaakov Selkowitz - 0.9.5-15 - Rebuilt for openssl 4.0