From 182fd20c335b6cd74fef9995574f904a6b086a03 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 23 Jul 2022 08:05:09 +0000 Subject: [PATCH 01/16] Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sbsigntools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index ed4bcaa..eccb3e8 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.4 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Signing utility for UEFI secure boot License: GPLv3+ URL: https://build.opensuse.org/package/show/home:jejb1:UEFI/sbsigntools @@ -86,6 +86,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Sat Jul 23 2022 Fedora Release Engineering - 0.9.4-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + * Sat Jan 22 2022 Fedora Release Engineering - 0.9.4-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild From 799df6228ce552f4248c0462acd6878f7041d1dc Mon Sep 17 00:00:00 2001 From: Dominik 'Rathann' Mierzejewski Date: Tue, 17 Jan 2023 21:14:35 +0100 Subject: [PATCH 02/16] fix build with GCC 13 --- sbsigntools.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index eccb3e8..5d1e5d6 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -1,9 +1,9 @@ %bcond_without check -%define _warning_options -Wall -Werror=format-security -Wno-deprecated-declarations +%define _warning_options -Wall -Werror=format-security -Wno-deprecated-declarations -Wno-maybe-uninitialized Name: sbsigntools Version: 0.9.4 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Signing utility for UEFI secure boot License: GPLv3+ URL: https://build.opensuse.org/package/show/home:jejb1:UEFI/sbsigntools @@ -86,6 +86,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Tue Jan 17 2023 Dominik Mierzejewski - 0.9.4-10 +- fix build with GCC 13 + * Sat Jul 23 2022 Fedora Release Engineering - 0.9.4-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild From c659c4074baa13816791cffa53763539f959cc88 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 21 Jan 2023 02:43:15 +0000 Subject: [PATCH 03/16] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sbsigntools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index 5d1e5d6..af4ed2e 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.4 -Release: 10%{?dist} +Release: 11%{?dist} Summary: Signing utility for UEFI secure boot License: GPLv3+ URL: https://build.opensuse.org/package/show/home:jejb1:UEFI/sbsigntools @@ -86,6 +86,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Sat Jan 21 2023 Fedora Release Engineering - 0.9.4-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Tue Jan 17 2023 Dominik Mierzejewski - 0.9.4-10 - fix build with GCC 13 From 301ac71fdbaff0e8b4d30d86b33a17b01164c11f Mon Sep 17 00:00:00 2001 From: Dominik 'Rathann' Mierzejewski Date: Fri, 5 May 2023 13:27:17 +0200 Subject: [PATCH 04/16] update to 0.9.5 (#2179697) drop obsolete patches --- .gitignore | 1 + ...84869c9590682ac3253d583bf59b890bb826.patch | 59 ------------------- sbsigntools-gnuefi.patch | 24 ++++---- sbsigntools-mktarball.sh | 4 +- sbsigntools-openssl3.patch | 12 ---- sbsigntools.spec | 12 ++-- sources | 2 +- 7 files changed, 22 insertions(+), 92 deletions(-) delete mode 100644 f12484869c9590682ac3253d583bf59b890bb826.patch delete mode 100644 sbsigntools-openssl3.patch diff --git a/.gitignore b/.gitignore index 1d41c7c..e07cc94 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,4 @@ /sbsigntools-0.9.2.tar.xz /sbsigntools-0.9.3.tar.xz /sbsigntools-0.9.4.tar.xz +/sbsigntools-0.9.5.tar.xz diff --git a/f12484869c9590682ac3253d583bf59b890bb826.patch b/f12484869c9590682ac3253d583bf59b890bb826.patch deleted file mode 100644 index 11bed89..0000000 --- a/f12484869c9590682ac3253d583bf59b890bb826.patch +++ /dev/null @@ -1,59 +0,0 @@ -From f12484869c9590682ac3253d583bf59b890bb826 Mon Sep 17 00:00:00 2001 -From: dann frazier -Date: Wed, 12 Aug 2020 15:27:08 -0600 -Subject: sbkeysync: Don't ignore errors from insert_new_keys() - -If insert_new_keys() fails, say due to a full variable store, we currently -still exit(0). This can make it difficult to know something is wrong. -For example, Debian and Ubuntu implement a secureboot-db systemd service -to update the DB and DBX, which calls: - - ExecStart=/usr/bin/sbkeysync --no-default-keystores --keystore /usr/share/secureboot/updates --verbose - -But although this seemed to succeed on my system, looking at the logs shows -a different story: - -Inserting key update /usr/share/secureboot/updates/dbx/dbxupdate_x64.bin into dbx -Error writing key update: Invalid argument -Error syncing keystore file /usr/share/secureboot/updates/dbx/dbxupdate_x64.bin - -Signed-off-by: dann frazier -Signed-off-by: James Bottomley ---- - src/sbkeysync.c | 8 +++++--- - 1 file changed, 5 insertions(+), 3 deletions(-) - -diff --git a/src/sbkeysync.c b/src/sbkeysync.c -index e51f177..7748990 100644 ---- a/src/sbkeysync.c -+++ b/src/sbkeysync.c -@@ -889,10 +889,12 @@ int main(int argc, char **argv) - { - bool use_default_keystore_dirs; - struct sync_context *ctx; -+ int rc; - - use_default_keystore_dirs = true; - ctx = talloc_zero(NULL, struct sync_context); - list_head_init(&ctx->new_keys); -+ rc = EXIT_SUCCESS; - - for (;;) { - int idx, c; -@@ -985,10 +987,10 @@ int main(int argc, char **argv) - if (ctx->verbose) - print_new_keys(ctx); - -- if (!ctx->dry_run) -- insert_new_keys(ctx); -+ if (!ctx->dry_run && insert_new_keys(ctx)) -+ rc = EXIT_FAILURE; - - talloc_free(ctx); - -- return EXIT_SUCCESS; -+ return rc; - } --- -cgit 1.2.3-1.el7 - diff --git a/sbsigntools-gnuefi.patch b/sbsigntools-gnuefi.patch index 2e28883..4e3c07a 100644 --- a/sbsigntools-gnuefi.patch +++ b/sbsigntools-gnuefi.patch @@ -1,14 +1,14 @@ -diff -up sbsigntools-0.9.3/configure.ac.gnu-efi sbsigntools-0.9.3/configure.ac ---- sbsigntools-0.9.3/configure.ac.gnu-efi 2020-02-03 09:38:56.000000000 +0100 -+++ sbsigntools-0.9.3/configure.ac 2020-02-04 09:48:53.011259075 +0100 -@@ -64,19 +64,30 @@ PKG_CHECK_MODULES(uuid, uuid, +diff -up sbsigntools-0.9.5/configure.ac.gnu-efi sbsigntools-0.9.5/configure.ac +--- sbsigntools-0.9.5/configure.ac.gnu-efi 2023-05-05 12:56:50.000000000 +0200 ++++ sbsigntools-0.9.5/configure.ac 2023-05-05 13:06:47.495361241 +0200 +@@ -67,19 +67,30 @@ PKG_CHECK_MODULES(uuid, uuid, AC_MSG_ERROR([libuuid (from the uuid package) is required])) dnl gnu-efi headers require extra include dirs -EFI_ARCH=$(uname -m | sed 's/i.86/ia32/;s/arm.*/arm/') --AM_CONDITIONAL(TEST_BINARY_FORMAT, [ test "$EFI_ARCH" = "arm" -o "$EFI_ARCH" = "aarch64" ]) +-AM_CONDITIONAL(TEST_BINARY_FORMAT, [ test "$EFI_ARCH" = "arm" -o "$EFI_ARCH" = "aarch64" -o "$EFI_ARCH" = riscv64 ]) +EFI_ARCH=$(uname -m | sed -e 's/i.86/ia32/;s/arm.*/arm/' -e 's/x86_64/x64/' -e 's/aarch64/aa64/') -+AM_CONDITIONAL(TEST_BINARY_FORMAT, [ test "$EFI_ARCH" = "arm" -o "$EFI_ARCH" = "aa64" ]) ++AM_CONDITIONAL(TEST_BINARY_FORMAT, [ test "$EFI_ARCH" = "arm" -o "$EFI_ARCH" = "aa64" -o "$EFI_ARCH" = riscv64 ]) ## # no consistent view of where gnu-efi should dump the efi stuff, so find it @@ -36,7 +36,7 @@ diff -up sbsigntools-0.9.3/configure.ac.gnu-efi sbsigntools-0.9.3/configure.ac fi EFI_CPPFLAGS="-I/usr/include/efi -I/usr/include/efi/$EFI_ARCH \ -@@ -88,6 +99,9 @@ CPPFLAGS="$CPPFLAGS_save" +@@ -91,6 +102,9 @@ CPPFLAGS="$CPPFLAGS_save" AC_SUBST(EFI_CPPFLAGS, $EFI_CPPFLAGS) AC_SUBST(EFI_ARCH, $EFI_ARCH) AC_SUBST(CRTPATH, $CRTPATH) @@ -46,10 +46,10 @@ diff -up sbsigntools-0.9.3/configure.ac.gnu-efi sbsigntools-0.9.3/configure.ac AC_CONFIG_FILES([Makefile src/Makefile lib/ccan/Makefile] [docs/Makefile tests/Makefile]) -diff -up sbsigntools-0.9.3/tests/Makefile.am.gnu-efi sbsigntools-0.9.3/tests/Makefile.am ---- sbsigntools-0.9.3/tests/Makefile.am.gnu-efi 2020-02-03 09:38:56.000000000 +0100 -+++ sbsigntools-0.9.3/tests/Makefile.am 2020-02-04 09:47:44.786665340 +0100 -@@ -14,7 +14,7 @@ if TEST_BINARY_FORMAT +diff -up sbsigntools-0.9.5/tests/Makefile.am.gnu-efi sbsigntools-0.9.5/tests/Makefile.am +--- sbsigntools-0.9.5/tests/Makefile.am.gnu-efi 2023-05-05 12:56:50.000000000 +0200 ++++ sbsigntools-0.9.5/tests/Makefile.am 2023-05-05 12:57:50.674915069 +0200 +@@ -18,7 +18,7 @@ if TEST_BINARY_FORMAT EFILDFLAGS = --defsym=EFI_SUBSYSTEM=0x0a FORMAT = -O binary else @@ -58,7 +58,7 @@ diff -up sbsigntools-0.9.3/tests/Makefile.am.gnu-efi sbsigntools-0.9.3/tests/Mak endif check_DATA = $(test_key) $(test_cert) check_SCRIPTS = test-wrapper.sh -@@ -27,7 +27,7 @@ check_SCRIPTS = test-wrapper.sh +@@ -31,7 +31,7 @@ check_SCRIPTS = test-wrapper.sh $(FORMAT) $^ $@ .$(OBJEXT).elf: diff --git a/sbsigntools-mktarball.sh b/sbsigntools-mktarball.sh index 07f8a30..b6e6f0f 100755 --- a/sbsigntools-mktarball.sh +++ b/sbsigntools-mktarball.sh @@ -12,8 +12,8 @@ tmp=$(mktemp -d) unset CDPATH pwd=$(pwd) -version=0.9.4 -commit=d52f7bbb73401aab8a1d59e8d0d686ad9641035e +version=0.9.5 +commit=9cfca9fe7aa7a8e29b92fe33ce8433e212c9a8ba pushd "$tmp" git clone git://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git diff --git a/sbsigntools-openssl3.patch b/sbsigntools-openssl3.patch deleted file mode 100644 index 3e14327..0000000 --- a/sbsigntools-openssl3.patch +++ /dev/null @@ -1,12 +0,0 @@ -diff -up sbsigntools-0.9.4/src/idc.c.openssl3 sbsigntools-0.9.4/src/idc.c ---- sbsigntools-0.9.4/src/idc.c.openssl3 2020-07-04 01:14:29.000000000 +0200 -+++ sbsigntools-0.9.4/src/idc.c 2021-11-19 16:20:10.082475750 +0100 -@@ -189,7 +189,7 @@ int IDC_set(PKCS7 *p7, PKCS7_SIGNER_INFO - - idc->data->type = OBJ_nid2obj(peid_nid); - idc->data->value = ASN1_TYPE_new(); -- type_set_sequence(image, idc->data->value, peid, &IDC_PEID_it); -+ type_set_sequence(image, idc->data->value, peid, ASN1_ITEM_rptr(IDC_PEID)); - - idc->digest->alg->parameter = ASN1_TYPE_new(); - idc->digest->alg->algorithm = OBJ_nid2obj(NID_sha256); diff --git a/sbsigntools.spec b/sbsigntools.spec index eccb3e8..4072803 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -2,8 +2,8 @@ %define _warning_options -Wall -Werror=format-security -Wno-deprecated-declarations Name: sbsigntools -Version: 0.9.4 -Release: 9%{?dist} +Version: 0.9.5 +Release: 1%{?dist} Summary: Signing utility for UEFI secure boot License: GPLv3+ URL: https://build.opensuse.org/package/show/home:jejb1:UEFI/sbsigntools @@ -15,10 +15,6 @@ Source1: %{name}-mktarball.sh Patch0: %{name}-no-git.patch # add Fedora gnu-efi path and link statically against libefi.a/libgnuefi.a Patch1: %{name}-gnuefi.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=1955828 -Patch2: https://git.kernel.org/pub/scm/linux/kernel/git/jejb/sbsigntools.git/patch/?id=f12484869c9590682ac3253d583bf59b890bb826#/f12484869c9590682ac3253d583bf59b890bb826.patch -# https://groups.io/g/sbsigntools/message/54 -Patch3: %{name}-openssl3.patch # same as gnu-efi ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} BuildRequires: make @@ -86,6 +82,10 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Fri May 05 2023 Dominik Mierzejewski - 0.9.5-1 +- update to 0.9.5 (#2179697) +- drop obsolete patches + * Sat Jul 23 2022 Fedora Release Engineering - 0.9.4-9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/sources b/sources index 3141750..fe6a9a5 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (sbsigntools-0.9.4.tar.xz) = ad1a2ed2a937414c6aee593a6d37638a56076fdbda112943af16c46dcaca578d3dac6498dc02f7e62499328cd82b48ab635f4fbac1ae49c606c9a717d9301133 +SHA512 (sbsigntools-0.9.5.tar.xz) = dbe52b709724eaaa0d5859ca0088190ee417e721a626681ea84cae3f04a7484e5caf64eb469094d3e373724c1f530cc75fa8ac63eaa91f803db2fda2f46c594f From c0182490aaa12244f8a5319e9fb688e19fc941a1 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 22 Jul 2023 01:06:29 +0000 Subject: [PATCH 05/16] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- sbsigntools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index 0054308..ec9fd14 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 1%{?dist} +Release: 2%{?dist} Summary: Signing utility for UEFI secure boot License: GPLv3+ URL: https://build.opensuse.org/package/show/home:jejb1:UEFI/sbsigntools @@ -82,6 +82,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Sat Jul 22 2023 Fedora Release Engineering - 0.9.5-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Fri May 05 2023 Dominik Mierzejewski - 0.9.5-1 - update to 0.9.5 (#2179697) - drop obsolete patches From 68adc2d236687317443957baed6e8f38fe97a57b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jan 2024 02:11:05 +0000 Subject: [PATCH 06/16] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- sbsigntools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index ec9fd14..ff1b5bc 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 2%{?dist} +Release: 3%{?dist} Summary: Signing utility for UEFI secure boot License: GPLv3+ URL: https://build.opensuse.org/package/show/home:jejb1:UEFI/sbsigntools @@ -82,6 +82,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Sat Jan 27 2024 Fedora Release Engineering - 0.9.5-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Sat Jul 22 2023 Fedora Release Engineering - 0.9.5-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 9f0d3f0b553e954993d582ffbcb3d5d28b3ec472 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 20 Jul 2024 04:53:00 +0000 Subject: [PATCH 07/16] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- sbsigntools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index ff1b5bc..5d7117a 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 3%{?dist} +Release: 4%{?dist} Summary: Signing utility for UEFI secure boot License: GPLv3+ URL: https://build.opensuse.org/package/show/home:jejb1:UEFI/sbsigntools @@ -82,6 +82,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Sat Jul 20 2024 Fedora Release Engineering - 0.9.5-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Sat Jan 27 2024 Fedora Release Engineering - 0.9.5-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 14bd8b8b0b474219c834ef4330f846bb6b1cb596 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Such=C3=BD?= Date: Thu, 25 Jul 2024 13:12:27 +0200 Subject: [PATCH 08/16] convert GPLv3+ license to SPDX This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4 --- sbsigntools.spec | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index 5d7117a..21932f7 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,9 +3,10 @@ Name: sbsigntools Version: 0.9.5 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Signing utility for UEFI secure boot -License: GPLv3+ +# Automatically converted from old format: GPLv3+ - review is highly recommended. +License: GPL-3.0-or-later URL: https://build.opensuse.org/package/show/home:jejb1:UEFI/sbsigntools # upstream tarballs don't include bundled ccan # run sbsigntools-mktarball.sh @@ -82,6 +83,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Thu Jul 25 2024 Miroslav Suchý - 0.9.5-5 +- convert license to SPDX + * Sat Jul 20 2024 Fedora Release Engineering - 0.9.5-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 4e206414fe707bf7b2a6d6fc89cb5380c5ac16b0 Mon Sep 17 00:00:00 2001 From: Michel Lind Date: Wed, 21 Aug 2024 17:46:18 -0500 Subject: [PATCH 09/16] Fix building with gnu-efi 3.0.18 Fix building on Fedora 41+ due to OpenSSL engine deprecation Fix building on aarch64, need to use non-TEST_BINARY_FORMAT codepath like x86_64 FIxes: RHBZ#2301267 Signed-off-by: Michel Lind --- sbsigntools-gnuefi.patch | 20 ++++++++------------ sbsigntools.spec | 14 ++++++++++++-- 2 files changed, 20 insertions(+), 14 deletions(-) diff --git a/sbsigntools-gnuefi.patch b/sbsigntools-gnuefi.patch index 4e3c07a..349fe46 100644 --- a/sbsigntools-gnuefi.patch +++ b/sbsigntools-gnuefi.patch @@ -1,14 +1,11 @@ -diff -up sbsigntools-0.9.5/configure.ac.gnu-efi sbsigntools-0.9.5/configure.ac ---- sbsigntools-0.9.5/configure.ac.gnu-efi 2023-05-05 12:56:50.000000000 +0200 -+++ sbsigntools-0.9.5/configure.ac 2023-05-05 13:06:47.495361241 +0200 -@@ -67,19 +67,30 @@ PKG_CHECK_MODULES(uuid, uuid, - AC_MSG_ERROR([libuuid (from the uuid package) is required])) +--- a/configure.ac ++++ b/configure.ac +@@ -68,18 +68,29 @@ PKG_CHECK_MODULES(uuid, uuid, dnl gnu-efi headers require extra include dirs --EFI_ARCH=$(uname -m | sed 's/i.86/ia32/;s/arm.*/arm/') + EFI_ARCH=$(uname -m | sed 's/i.86/ia32/;s/arm.*/arm/') -AM_CONDITIONAL(TEST_BINARY_FORMAT, [ test "$EFI_ARCH" = "arm" -o "$EFI_ARCH" = "aarch64" -o "$EFI_ARCH" = riscv64 ]) -+EFI_ARCH=$(uname -m | sed -e 's/i.86/ia32/;s/arm.*/arm/' -e 's/x86_64/x64/' -e 's/aarch64/aa64/') -+AM_CONDITIONAL(TEST_BINARY_FORMAT, [ test "$EFI_ARCH" = "arm" -o "$EFI_ARCH" = "aa64" -o "$EFI_ARCH" = riscv64 ]) ++AM_CONDITIONAL(TEST_BINARY_FORMAT, [ test "$EFI_ARCH" = "arm" -o "$EFI_ARCH" = riscv64 ]) ## # no consistent view of where gnu-efi should dump the efi stuff, so find it @@ -26,7 +23,7 @@ diff -up sbsigntools-0.9.5/configure.ac.gnu-efi sbsigntools-0.9.5/configure.ac + CRTPATH=$path + CRT=crt0-efi-${EFI_ARCH}.o + LDS=elf_${EFI_ARCH}_efi.lds -+ EFI_PATH=$libdir ++ EFI_PATH=$path fi done if test -z "$CRTPATH"; then @@ -46,9 +43,8 @@ diff -up sbsigntools-0.9.5/configure.ac.gnu-efi sbsigntools-0.9.5/configure.ac AC_CONFIG_FILES([Makefile src/Makefile lib/ccan/Makefile] [docs/Makefile tests/Makefile]) -diff -up sbsigntools-0.9.5/tests/Makefile.am.gnu-efi sbsigntools-0.9.5/tests/Makefile.am ---- sbsigntools-0.9.5/tests/Makefile.am.gnu-efi 2023-05-05 12:56:50.000000000 +0200 -+++ sbsigntools-0.9.5/tests/Makefile.am 2023-05-05 12:57:50.674915069 +0200 +--- a/tests/Makefile.am ++++ b/tests/Makefile.am @@ -18,7 +18,7 @@ if TEST_BINARY_FORMAT EFILDFLAGS = --defsym=EFI_SUBSYSTEM=0x0a FORMAT = -O binary diff --git a/sbsigntools.spec b/sbsigntools.spec index 21932f7..cc0413e 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 5%{?dist} +Release: 6%{?dist} Summary: Signing utility for UEFI secure boot # Automatically converted from old format: GPLv3+ - review is highly recommended. License: GPL-3.0-or-later @@ -22,13 +22,17 @@ BuildRequires: make BuildRequires: automake BuildRequires: binutils-devel BuildRequires: gcc -BuildRequires: gnu-efi-devel >= 1:3.0.8-3 +BuildRequires: gnu-efi-devel >= 1:3.0.18-1 BuildRequires: help2man BuildRequires: libuuid-devel %if %{with check} BuildRequires: openssl %endif BuildRequires: openssl-devel +%if 0%{?fedora} >= 41 +# https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine +BuildRequires: openssl-devel-engine +%endif Provides: bundled(ccan-array_size) Provides: bundled(ccan-build_assert) Provides: bundled(ccan-check_type) @@ -83,6 +87,12 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Wed Aug 21 2024 Michel Lind - 0.9.5-6 +- Fix building with gnu-efi 3.0.18 +- Fix building on Fedora 41+ due to OpenSSL engine deprecation +- Fix building on aarch64, need to use non-TEST_BINARY_FORMAT codepath like x86_64 +- FIxes: RHBZ#2301267 + * Thu Jul 25 2024 Miroslav Suchý - 0.9.5-5 - convert license to SPDX From d4b8cf2b76cb9eb43d1ec4fb0c4b565defcc212d Mon Sep 17 00:00:00 2001 From: Dominik 'Rathann' Mierzejewski Date: Tue, 19 Nov 2024 00:22:18 +0100 Subject: [PATCH 10/16] fix wchar_t usage in sbvarsign (fixes rhbz#2310759) --- sbsigntools-no-wchar_t.patch | 34 ++++++++++++++++++++++++++++++++++ sbsigntools.spec | 7 ++++++- 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 sbsigntools-no-wchar_t.patch diff --git a/sbsigntools-no-wchar_t.patch b/sbsigntools-no-wchar_t.patch new file mode 100644 index 0000000..1ac6763 --- /dev/null +++ b/sbsigntools-no-wchar_t.patch @@ -0,0 +1,34 @@ +diff -up sbsigntools-0.9.5/src/sbvarsign.c.orig sbsigntools-0.9.5/src/sbvarsign.c +--- sbsigntools-0.9.5/src/sbvarsign.c.orig 2023-05-05 12:56:50.000000000 +0200 ++++ sbsigntools-0.9.5/src/sbvarsign.c 2024-11-18 23:53:08.764976485 +0100 +@@ -67,7 +67,7 @@ struct varsign_context { + uint8_t *data; + size_t data_len; + +- CHAR16 *var_name; ++ uint16_t *var_name; + int var_name_bytes; + EFI_GUID var_guid; + uint32_t var_attrs; +@@ -163,18 +163,18 @@ static uint32_t parse_attrs(const char * + + static int set_varname(struct varsign_context *ctx, const char *str) + { +- CHAR16 *wstr; ++ uint16_t *wstr; + int i, len; + + len = strlen(str); + +- wstr = talloc_array(ctx, CHAR16, len); ++ wstr = talloc_array(ctx, uint16_t, len); + + for (i = 0; i < len; i++) + wstr[i] = str[i]; + + ctx->var_name = wstr; +- ctx->var_name_bytes = len * sizeof(CHAR16); ++ ctx->var_name_bytes = len * sizeof(uint16_t); + + return 0; + } diff --git a/sbsigntools.spec b/sbsigntools.spec index cc0413e..d9c2855 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 6%{?dist} +Release: 7%{?dist} Summary: Signing utility for UEFI secure boot # Automatically converted from old format: GPLv3+ - review is highly recommended. License: GPL-3.0-or-later @@ -16,6 +16,8 @@ Source1: %{name}-mktarball.sh Patch0: %{name}-no-git.patch # add Fedora gnu-efi path and link statically against libefi.a/libgnuefi.a Patch1: %{name}-gnuefi.patch +# fix wchar_t (a.k.a. CHAR16) abuse +Patch2: %{name}-no-wchar_t.patch # same as gnu-efi ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} BuildRequires: make @@ -87,6 +89,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Mon Nov 18 2024 Dominik Mierzejewski - 0.9.5-7 +- fix wchar_t usage in sbvarsign (fixes rhbz#2310759) + * Wed Aug 21 2024 Michel Lind - 0.9.5-6 - Fix building with gnu-efi 3.0.18 - Fix building on Fedora 41+ due to OpenSSL engine deprecation From eb7f62e9d20adda92043aae749b73487517f03db Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 19 Jan 2025 10:03:47 +0000 Subject: [PATCH 11/16] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- sbsigntools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index d9c2855..0158785 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 7%{?dist} +Release: 8%{?dist} Summary: Signing utility for UEFI secure boot # Automatically converted from old format: GPLv3+ - review is highly recommended. License: GPL-3.0-or-later @@ -89,6 +89,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Sun Jan 19 2025 Fedora Release Engineering - 0.9.5-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Mon Nov 18 2024 Dominik Mierzejewski - 0.9.5-7 - fix wchar_t usage in sbvarsign (fixes rhbz#2310759) From 10bd4abb0c6c966c44f2d09e77198a3f1f6d3350 Mon Sep 17 00:00:00 2001 From: Carl George Date: Tue, 8 Apr 2025 22:29:12 -0500 Subject: [PATCH 12/16] Add missing SPDX identifiers to license field --- sbsigntools.spec | 30 +++++++++++++++++++++++++++--- 1 file changed, 27 insertions(+), 3 deletions(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index 0158785..7c2568b 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,10 +3,31 @@ Name: sbsigntools Version: 0.9.5 -Release: 8%{?dist} +Release: 9%{?dist} Summary: Signing utility for UEFI secure boot -# Automatically converted from old format: GPLv3+ - review is highly recommended. -License: GPL-3.0-or-later +# Most source code is GPL-3.0-or-later, except: +# LicenseRef-Fedora-Public-Domain: +# lib/ccan/ccan/array_size +# lib/ccan/ccan/build_assert +# lib/ccan/ccan/check_type +# lib/ccan/ccan/compiler +# lib/ccan/ccan/container_of +# lib/ccan/ccan/hash +# lib/ccan/ccan/str +# lib/ccan/ccan/tcon +# LGPL-2.1-or-later: +# lib/ccan/ccan/endian +# lib/ccan/ccan/htable +# lib/ccan/ccan/list +# lib/ccan/ccan/read_write_all +# lib/ccan/ccan/talloc +# lib/ccan/ccan/typesafe_cb +# LGPL-3.0-only: +# lib/ccan/ccan/failtest +# lib/ccan/ccan/tlist +# MIT: +# lib/ccan/ccan/time +License: GPL-3.0-or-later AND LicenseRef-Fedora-Public-Domain AND LGPL-2.1-or-later AND LGPL-3.0-only AND MIT URL: https://build.opensuse.org/package/show/home:jejb1:UEFI/sbsigntools # upstream tarballs don't include bundled ccan # run sbsigntools-mktarball.sh @@ -89,6 +110,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Wed Apr 09 2025 Carl George - 0.9.5-9 +- Add missing SPDX identifiers to license field + * Sun Jan 19 2025 Fedora Release Engineering - 0.9.5-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 20c3c5e4e682c98760593eb82ef023c0784d8e3d Mon Sep 17 00:00:00 2001 From: Carl George Date: Wed, 9 Apr 2025 23:29:44 -0500 Subject: [PATCH 13/16] Remove openssl engine support on EL10 CentOS/RHEL 10 disables openssl engines, so we need to disable engine support in sbsigntools when building for EPEL 10. https://www.redhat.com/en/blog/openssl-3-providers-rhel-10 --- sbsigntools-no-openssl-engines.patch | 230 +++++++++++++++++++++++++++ sbsigntools.spec | 16 +- 2 files changed, 244 insertions(+), 2 deletions(-) create mode 100644 sbsigntools-no-openssl-engines.patch diff --git a/sbsigntools-no-openssl-engines.patch b/sbsigntools-no-openssl-engines.patch new file mode 100644 index 0000000..a0477d3 --- /dev/null +++ b/sbsigntools-no-openssl-engines.patch @@ -0,0 +1,230 @@ +From 4b6f88a0ad6f1069f3597087058dce028bf67433 Mon Sep 17 00:00:00 2001 +From: Carl George +Date: Wed, 9 Apr 2025 22:51:12 -0500 +Subject: [PATCH] Revert "sbsign, sbvarsign: support engine based private keys" + +This reverts commit efc424c8eea2c398e4371320b4d7266898675ac8. +--- + src/fileio.c | 50 ------------------------------------------------- + src/fileio.h | 1 - + src/sbsign.c | 16 +++------------- + src/sbvarsign.c | 15 +++------------ + 4 files changed, 6 insertions(+), 76 deletions(-) + +diff --git a/src/fileio.c b/src/fileio.c +index 032eb1e..faab3b7 100644 +--- a/src/fileio.c ++++ b/src/fileio.c +@@ -39,7 +39,6 @@ + #include + #include + #include +-#include + + #include + #include +@@ -48,55 +47,6 @@ + + #define FLAG_NOERROR (1<<0) + +-static int ui_read(UI *ui, UI_STRING *uis) +-{ +- char password[128]; +- +- if (UI_get_string_type(uis) != UIT_PROMPT) +- return 0; +- +- EVP_read_pw_string(password, sizeof(password), "Enter engine key pass phrase:", 0); +- UI_set_result(ui, uis, password); +- return 1; +-} +- +-EVP_PKEY *fileio_read_engine_key(const char *engine, const char *filename) +-{ +- UI_METHOD *ui; +- ENGINE *e; +- EVP_PKEY *pkey = NULL; +- +- ENGINE_load_builtin_engines(); +- e = ENGINE_by_id(engine); +- +- if (!e) { +- fprintf(stderr, "Failed to load engine: %s\n", engine); +- ERR_print_errors_fp(stderr); +- return NULL; +- } +- +- ui = UI_create_method("sbsigntools"); +- if (!ui) { +- fprintf(stderr, "Failed to create UI method\n"); +- ERR_print_errors_fp(stderr); +- goto out_free; +- } +- UI_method_set_reader(ui, ui_read); +- +- if (!ENGINE_init(e)) { +- fprintf(stderr, "Failed to initialize engine %s\n", engine); +- ERR_print_errors_fp(stderr); +- goto out_free; +- } +- +- pkey = ENGINE_load_private_key(e, filename, ui, NULL); +- ENGINE_finish(e); +- +- out_free: +- ENGINE_free(e); +- return pkey; +-} +- + EVP_PKEY *fileio_read_pkey(const char *filename) + { + EVP_PKEY *key = NULL; +diff --git a/src/fileio.h b/src/fileio.h +index b3ed22c..52c3c12 100644 +--- a/src/fileio.h ++++ b/src/fileio.h +@@ -38,7 +38,6 @@ + #include + + EVP_PKEY *fileio_read_pkey(const char *filename); +-EVP_PKEY *fileio_read_engine_key(const char *engine, const char *filename); + X509 *fileio_read_cert(const char *filename); + + int fileio_read_file(void *ctx, const char *filename, +diff --git a/src/sbsign.c b/src/sbsign.c +index 898fe66..3bb42c2 100644 +--- a/src/sbsign.c ++++ b/src/sbsign.c +@@ -76,7 +76,6 @@ static struct option options[] = { + { "verbose", no_argument, NULL, 'v' }, + { "help", no_argument, NULL, 'h' }, + { "version", no_argument, NULL, 'V' }, +- { "engine", required_argument, NULL, 'e'}, + { "addcert", required_argument, NULL, 'a'}, + { NULL, 0, NULL, 0 }, + }; +@@ -87,7 +86,6 @@ static void usage(void) + "\n" + "Sign an EFI boot image for use with secure boot.\n\n" + "Options:\n" +- "\t--engine use the specified engine to load the key\n" + "\t--key signing key (PEM-encoded RSA " + "private key)\n" + "\t--cert certificate (x509 certificate)\n" +@@ -152,22 +150,20 @@ static int add_intermediate_certs(PKCS7 *p7, const char *filename) + + int main(int argc, char **argv) + { +- const char *keyfilename, *certfilename, *addcertfilename, *engine; ++ const char *keyfilename, *certfilename, *addcertfilename; + struct sign_context *ctx; + uint8_t *buf, *tmp; + int rc, c, sigsize; +- EVP_PKEY *pkey; + + ctx = talloc_zero(NULL, struct sign_context); + + keyfilename = NULL; + certfilename = NULL; + addcertfilename = NULL; +- engine = NULL; + + for (;;) { + int idx; +- c = getopt_long(argc, argv, "o:c:k:dvVhe:a:", options, &idx); ++ c = getopt_long(argc, argv, "o:c:k:dvVha:", options, &idx); + if (c == -1) + break; + +@@ -193,9 +189,6 @@ int main(int argc, char **argv) + case 'h': + usage(); + return EXIT_SUCCESS; +- case 'e': +- engine = optarg; +- break; + case 'a': + addcertfilename = optarg; + break; +@@ -244,10 +237,7 @@ int main(int argc, char **argv) + * module isn't present). In either case ignore the errors + * (malloc will cause other failures out lower down */ + ERR_clear_error(); +- if (engine) +- pkey = fileio_read_engine_key(engine, keyfilename); +- else +- pkey = fileio_read_pkey(keyfilename); ++ EVP_PKEY *pkey = fileio_read_pkey(keyfilename); + if (!pkey) + return EXIT_FAILURE; + +diff --git a/src/sbvarsign.c b/src/sbvarsign.c +index 58031ec..db43054 100644 +--- a/src/sbvarsign.c ++++ b/src/sbvarsign.c +@@ -397,7 +397,6 @@ static struct option options[] = { + { "verbose", no_argument, NULL, 'v' }, + { "help", no_argument, NULL, 'h' }, + { "version", no_argument, NULL, 'V' }, +- { "engine", required_argument, NULL, 'e'}, + { NULL, 0, NULL, 0 }, + }; + +@@ -409,7 +408,6 @@ void usage(void) + " \n" + "Sign a blob of data for use in SetVariable().\n\n" + "Options:\n" +- "\t--engine use the specified engine to load the key\n" + "\t--key signing key (PEM-encoded RSA " + "private key)\n" + "\t--cert certificate (x509 certificate)\n" +@@ -438,7 +436,7 @@ static void version(void) + + int main(int argc, char **argv) + { +- const char *guid_str, *attr_str, *varname, *engine; ++ const char *guid_str, *attr_str, *varname; + const char *keyfilename, *certfilename; + struct varsign_context *ctx; + bool include_attrs; +@@ -448,14 +446,13 @@ int main(int argc, char **argv) + + keyfilename = NULL; + certfilename = NULL; +- engine = NULL; + guid_str = NULL; + attr_str= NULL; + include_attrs = false; + + for (;;) { + int idx; +- c = getopt_long(argc, argv, "o:g:a:k:c:ivVhe:", options, &idx); ++ c = getopt_long(argc, argv, "o:g:a:k:c:ivVh", options, &idx); + if (c == -1) + break; + +@@ -487,9 +484,6 @@ int main(int argc, char **argv) + case 'h': + usage(); + return EXIT_SUCCESS; +- case 'e': +- engine = optarg; +- break; + } + } + +@@ -551,10 +545,7 @@ int main(int argc, char **argv) + if (fileio_read_file(ctx, ctx->infilename, &ctx->data, &ctx->data_len)) + return EXIT_FAILURE; + +- if (engine) +- ctx->key = fileio_read_engine_key(engine, keyfilename); +- else +- ctx->key = fileio_read_pkey(keyfilename); ++ ctx->key = fileio_read_pkey(keyfilename); + if (!ctx->key) + return EXIT_FAILURE; + +-- +2.49.0 + diff --git a/sbsigntools.spec b/sbsigntools.spec index 7c2568b..92d885e 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 9%{?dist} +Release: 10%{?dist} Summary: Signing utility for UEFI secure boot # Most source code is GPL-3.0-or-later, except: # LicenseRef-Fedora-Public-Domain: @@ -39,6 +39,8 @@ Patch0: %{name}-no-git.patch Patch1: %{name}-gnuefi.patch # fix wchar_t (a.k.a. CHAR16) abuse Patch2: %{name}-no-wchar_t.patch +# revert addition of openssl engine support +Patch3: %{name}-no-openssl-engines.patch # same as gnu-efi ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} BuildRequires: make @@ -78,7 +80,14 @@ Provides: bundled(ccan-typesafe_cb) Tools to add signatures to EFI binaries and Drivers. %prep -%autosetup -p1 +%setup -q +%patch -p 1 -P 0 +%patch -p 1 -P 1 +%patch -p 1 -P 2 +%if %{defined el10} +# EL10 disables openssl engines +%patch -p 1 -P 3 +%endif %build ./autogen.sh @@ -110,6 +119,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Thu Apr 10 2025 Carl George - 0.9.5-10 +- Remove openssl engine support on EL10 + * Wed Apr 09 2025 Carl George - 0.9.5-9 - Add missing SPDX identifiers to license field From 89da5c9f78a20bb13af794d49c661c436b900d90 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 17:57:58 +0000 Subject: [PATCH 14/16] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- sbsigntools.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index 92d885e..616db08 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 10%{?dist} +Release: 11%{?dist} Summary: Signing utility for UEFI secure boot # Most source code is GPL-3.0-or-later, except: # LicenseRef-Fedora-Public-Domain: @@ -119,6 +119,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 0.9.5-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Thu Apr 10 2025 Carl George - 0.9.5-10 - Remove openssl engine support on EL10 From bd31748bedce0f3c8ff3b62edcd1171a26c68a9d Mon Sep 17 00:00:00 2001 From: Dominik 'Rathann' Mierzejewski Date: Fri, 3 Oct 2025 10:23:38 +0200 Subject: [PATCH 15/16] avoid wrong --target option usage that was fixed in recent binutils --- sbsigntools-binutils.patch | 12 ++++++++++++ sbsigntools.spec | 8 +++++++- 2 files changed, 19 insertions(+), 1 deletion(-) create mode 100644 sbsigntools-binutils.patch diff --git a/sbsigntools-binutils.patch b/sbsigntools-binutils.patch new file mode 100644 index 0000000..9658db1 --- /dev/null +++ b/sbsigntools-binutils.patch @@ -0,0 +1,12 @@ +diff -up sbsigntools-0.9.5/tests/Makefile.am.orig sbsigntools-0.9.5/tests/Makefile.am +--- sbsigntools-0.9.5/tests/Makefile.am.orig 2025-10-03 10:20:11.676718647 +0200 ++++ sbsigntools-0.9.5/tests/Makefile.am 2025-10-03 10:20:40.506763759 +0200 +@@ -18,7 +18,7 @@ if TEST_BINARY_FORMAT + EFILDFLAGS = --defsym=EFI_SUBSYSTEM=0x0a + FORMAT = -O binary + else +-FORMAT = --target=efi-app-$(EFI_ARCH:x64=x86_64) ++FORMAT = --output-target=efi-app-$(EFI_ARCH:x64=x86_64) + endif + check_DATA = $(test_key) $(test_cert) + check_SCRIPTS = test-wrapper.sh diff --git a/sbsigntools.spec b/sbsigntools.spec index 616db08..fd0cd46 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 11%{?dist} +Release: 12%{?dist} Summary: Signing utility for UEFI secure boot # Most source code is GPL-3.0-or-later, except: # LicenseRef-Fedora-Public-Domain: @@ -41,6 +41,8 @@ Patch1: %{name}-gnuefi.patch Patch2: %{name}-no-wchar_t.patch # revert addition of openssl engine support Patch3: %{name}-no-openssl-engines.patch +# avoid wrong --target option usage that's been fixed in recent binutils +Patch4: %{name}-binutils.patch # same as gnu-efi ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} BuildRequires: make @@ -88,6 +90,7 @@ Tools to add signatures to EFI binaries and Drivers. # EL10 disables openssl engines %patch -p 1 -P 3 %endif +%patch -p 1 -P 4 %build ./autogen.sh @@ -119,6 +122,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Fri Oct 03 2025 Dominik Mierzejewski - 0.9.5-12 +- avoid wrong --target option usage that was fixed in recent binutils + * Fri Jul 25 2025 Fedora Release Engineering - 0.9.5-11 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From fe6286cbd62b9938fcab4893b2628892e1c45943 Mon Sep 17 00:00:00 2001 From: Marcin Juszkiewicz Date: Fri, 12 Dec 2025 10:10:00 +0100 Subject: [PATCH 16/16] enable RISC-V 64-bit architecture --- sbsigntools.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/sbsigntools.spec b/sbsigntools.spec index fd0cd46..08acb1b 100644 --- a/sbsigntools.spec +++ b/sbsigntools.spec @@ -3,7 +3,7 @@ Name: sbsigntools Version: 0.9.5 -Release: 12%{?dist} +Release: 13%{?dist} Summary: Signing utility for UEFI secure boot # Most source code is GPL-3.0-or-later, except: # LicenseRef-Fedora-Public-Domain: @@ -44,7 +44,7 @@ Patch3: %{name}-no-openssl-engines.patch # avoid wrong --target option usage that's been fixed in recent binutils Patch4: %{name}-binutils.patch # same as gnu-efi -ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} +ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} riscv64 BuildRequires: make BuildRequires: automake BuildRequires: binutils-devel @@ -122,6 +122,9 @@ make check %{_mandir}/man1/sbverify.1.* %changelog +* Fri Dec 12 2025 Marcin Juszkiewicz - 0.9.5-13 +- enable RISC-V 64-bit architecture + * Fri Oct 03 2025 Dominik Mierzejewski - 0.9.5-12 - avoid wrong --target option usage that was fixed in recent binutils