From 43480296f0e8769910d2a27ba8a70b7d0693ce17 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 15 Jun 2022 10:36:23 -0400 Subject: [PATCH 1/8] Update to shim-15.6 Resolves: CVE-2022-28737 Signed-off-by: Peter Jones --- dbx.esl | Bin 304 -> 0 bytes fedora-ca.cer => fedora-ca-20200709.cer | Bin sbat.redhat.csv | 1 + shim-unsigned-aarch64.spec | 68 +++++++++++++++--------- shim.patches | 0 sources | 2 +- 6 files changed, 44 insertions(+), 27 deletions(-) delete mode 100644 dbx.esl rename fedora-ca.cer => fedora-ca-20200709.cer (100%) create mode 100644 sbat.redhat.csv create mode 100644 shim.patches diff --git a/dbx.esl b/dbx.esl deleted file mode 100644 index 2ea555ccebee3c3fd2a8c73a78a90af156dbcd37..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 304 zcmY!rJ95w`V3Na{m5x8nCOc~wFfxFF0Rsa=|C5(%cg%S= %{pesign_vre} -BuildRequires: gnu-efi >= %{gnuefi_vre} -BuildRequires: gnu-efi-devel >= %{gnuefi_vre} +BuildRequires: dos2unix findutils # Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not # compatible with SysV (there's no red zone under UEFI) and there isn't a @@ -61,7 +65,6 @@ use this package or when debugging this package. %package debuginfo Summary: Debug information for shim-unsigned-aarch64 -Requires: %{name}-debugsource = %{version}-%{release} AutoReqProv: 0 BuildArch: noarch @@ -77,45 +80,53 @@ BuildArch: noarch %debug_desc %prep -%autosetup -S git -n shim-%{version} +%autosetup -S git_am -n shim-%{version} git config --unset user.email git config --unset user.name mkdir build-%{efiarch} +cp %{SOURCE3} data/ %build COMMITID=$(cat commit) MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " -MAKEFLAGS+="ENABLE_HTTPBOOT=true ENABLE_SHIM_HASH=true " +MAKEFLAGS+="ENABLE_SHIM_HASH=true " MAKEFLAGS+="%{_smp_mflags}" if [ -f "%{SOURCE1}" ]; then MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" fi +%if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}" fi +%endif cd build-%{efiarch} -make ${MAKEFLAGS} DEFAULT_LOADER='\\\\grub%{efiarch}.efi' all +make ${MAKEFLAGS} \ + DEFAULT_LOADER='\\\\grub%{efiarch}.efi' \ + all cd .. %install COMMITID=$(cat commit) MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " -MAKEFLAGS+="ENABLE_HTTPBOOT=true ENABLE_SHIM_HASH=true " +MAKEFLAGS+="ENABLE_SHIM_HASH=true " if [ -f "%{SOURCE1}" ]; then MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" fi +%if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}" fi +%endif cd build-%{efiarch} make ${MAKEFLAGS} \ DEFAULT_LOADER='\\\\grub%{efiarch}.efi' \ DESTDIR=${RPM_BUILD_ROOT} \ install-as-data install-debuginfo install-debugsource +install -m 0644 BOOT*.CSV "${RPM_BUILD_ROOT}/%{shimdir}/" cd .. %files @@ -125,12 +136,17 @@ cd .. %dir %{shimdir} %{shimdir}/*.efi %{shimdir}/*.hash +%{shimdir}/*.CSV %files debuginfo -f build-%{efiarch}/debugfiles.list %files debugsource -f build-%{efiarch}/debugsource.list %changelog +* Wed Jun 15 2022 Peter Jones - 15.6-1~1 +- Update to shim-15.6 + Resolves: CVE-2022-28737 + * Thu Apr 05 2018 Peter Jones - 15-1 - Update to shim 15 - better checking for bad linker output diff --git a/shim.patches b/shim.patches new file mode 100644 index 0000000..e69de29 diff --git a/sources b/sources index 697992c..bcb0302 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (shim-15.tar.bz2) = f7dfac774d644111431ca56da76b5575b891b0abad970b318edaede11a0d83c869728bc39cb6af3689bdb203c6826545caf8ddd3d14228831027e334963cf957 +SHA512 (shim-15.6.tar.bz2) = ddc5d5234851d05ed7124ad748ad3fee2df8a335493948a045653322c873f3f055d34894aeb2ac7495086984ca62183907d341e46e6bdf108856e39c646455fc From 0e0a71f2e681b5c04bede0f74e0104f23420731c Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 15 Jun 2022 11:07:46 -0400 Subject: [PATCH 2/8] Fix my release number mistake. Signed-off-by: Peter Jones --- shim-unsigned-aarch64.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/shim-unsigned-aarch64.spec b/shim-unsigned-aarch64.spec index 3f5e3d2..2eae279 100644 --- a/shim-unsigned-aarch64.spec +++ b/shim-unsigned-aarch64.spec @@ -23,7 +23,7 @@ Name: shim-unsigned-aarch64 Version: 15.6 -Release: 1~1%{?dist} +Release: 1%{?dist} Summary: First-stage UEFI bootloader ExclusiveArch: aarch64 License: BSD @@ -143,7 +143,7 @@ cd .. %files debugsource -f build-%{efiarch}/debugsource.list %changelog -* Wed Jun 15 2022 Peter Jones - 15.6-1~1 +* Wed Jun 15 2022 Peter Jones - 15.6-1 - Update to shim-15.6 Resolves: CVE-2022-28737 From 599a58debdea8c1bf8580be4ade736d49fae9d34 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 15 Jun 2022 11:57:30 -0400 Subject: [PATCH 3/8] Make the release match -x64 Signed-off-by: Peter Jones --- shim-unsigned-aarch64.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/shim-unsigned-aarch64.spec b/shim-unsigned-aarch64.spec index 2eae279..613f3c5 100644 --- a/shim-unsigned-aarch64.spec +++ b/shim-unsigned-aarch64.spec @@ -23,7 +23,7 @@ Name: shim-unsigned-aarch64 Version: 15.6 -Release: 1%{?dist} +Release: 1 Summary: First-stage UEFI bootloader ExclusiveArch: aarch64 License: BSD From 06f4cfa5b89dfb78d6a6ae2b1366eddfcb40478c Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Thu, 7 Jul 2022 14:01:25 -0400 Subject: [PATCH 4/8] Add pjones's aarch64 relocation fix Resolves: #2101248 Signed-off-by: Robbie Harwood --- ...locate-from-being-dirtied-by-_reloca.patch | 105 ++++++++++++++++++ shim-unsigned-aarch64.spec | 6 +- shim.patches | 1 + 3 files changed, 111 insertions(+), 1 deletion(-) create mode 100644 0001-aarch64-Keep-_relocate-from-being-dirtied-by-_reloca.patch diff --git a/0001-aarch64-Keep-_relocate-from-being-dirtied-by-_reloca.patch b/0001-aarch64-Keep-_relocate-from-being-dirtied-by-_reloca.patch new file mode 100644 index 0000000..c6efb63 --- /dev/null +++ b/0001-aarch64-Keep-_relocate-from-being-dirtied-by-_reloca.patch @@ -0,0 +1,105 @@ +From de8c3582d2eb280bf6b358349e04a959b945f1a5 Mon Sep 17 00:00:00 2001 +From: Peter Jones +Date: Fri, 1 Jul 2022 15:52:51 -0400 +Subject: [PATCH] aarch64: Keep _relocate() from being dirtied by _relocate() + +[Patch is a gnu-efi patch we apply to the bundled copy.] + +This could all be wrong, but the fix seems to work. Here's my theory of +what's going on. We have a bug report that says: + + No EFI system partition + Booting /efi\boot\bootaa64.efi + No EFI system partition + Failed to persist EFI variables + "Synchronous Abort" handler, esr 0x02000000 + elr: fffffffffeb48a28 lr : fffffffffeb3f024 (reloc) + elr: 000000003ca1aa28 lr : 000000003ca11024 + x0 : 000000003ca0d000 x1 : 000000003ca22018 + x2 : 000000003ca22000 x3 : 0000000000000018 + x4 : 0000000000001488 x5 : 0000000000000000 + x6 : 0000000000001000 x7 : 0000000000000000 + x8 : 0000000000000007 x9 : 0000000000003ca0 + x10: 000000003ca3e040 x11: 00000000b0b87665 + x12: 000000007c70ea25 x13: 000000005a827999 + x14: 000000006ed9eba1 x15: 000000008f1bbcdc + x16: 000000003df97394 x17: 00000000b7ce40b7 + x18: 0000000000000011 x19: 000000003caeb000 + x20: 0000000000000000 x21: 000000003dc1ba50 + x22: 000000003caff2f8 x23: 0000000000000001 + x24: 000000003caff000 x25: 000000003caff3c0 + x26: 000000003caff3c8 x27: 000000003caff3d0 + x28: 000000003caff3d8 x29: 000000003db3e600 + + Code: 8b000021 f82068a1 8b030042 cb030084 (f100009f) + UEFI image [0x000000003ca0d000:0x000000003ca24fff] pc=0xda28 '/efi\boot\fbaa64.efi' + Resetting CPU ... + + resetting ... + +When I disassemble it, "8b000021 f82068a1 8b030042 cb030084 (f100009f)" +at 0xda28 (aka 0x3ca1aa28 in our register dump above) is: + + da18: 8b000021 add x1, x1, x0 + da1c: f82068a1 str x1, [x5, x0] + da20: 8b030042 add x2, x2, x3 + da24: cb030084 sub x4, x4, x3 + da28: f100009f cmp x4, #0x0 + +Of course the Arm ARM says "cmp" cannot fault in this way, and %esr is +less than helpful, for reasons I don't understand. I believe what is +happening is this. Farther up in the file is the function +StatusToString(), as seen here: + + 000000000000d960 : + d960: d0000022 adrp x2, 13000 + d964: aa0103e3 mov x3, x1 + d968: 911f0042 add x2, x2, #0x7c0 + d96c: f9400441 ldr x1, [x2, #8] + d970: b5000081 cbnz x1, d980 + d974: b0000022 adrp x2, 12000 + d978: 91124842 add x2, x2, #0x492 + d97c: 17fffc32 b ca44 + d980: f8410444 ldr x4, [x2], #16 + d984: eb03009f cmp x4, x3 + d988: 54ffff21 b.ne d96c // b.any + d98c: 17fffe47 b d2a8 + +I believe when _relocate() gets to the relocations for 0xd960 the page +being processed is evicted from the i$ and moved into the d$, and then +when execution continues, the i$ raises an exception because it doesn't +have the page in question, and it can't stall execution to fill it, +because it's now owned (and dirty) in the other cache. + +There are a couple of ways to solve this, but I've taken the laziest +one: align the code in _relocate() to its own page boundary. This +partially works because our link order means this code is actually the +last function in .text, and so no relocations will ever land on this +page. + +Signed-off-by: Peter Jones +[rharwood@redhat.com: adapt to shim] +Signed-off-by: Robbie Harwood +--- + gnu-efi/gnuefi/reloc_aarch64.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/gnu-efi/gnuefi/reloc_aarch64.c b/gnu-efi/gnuefi/reloc_aarch64.c +index 086727961c2..0022abdaca7 100644 +--- a/gnu-efi/gnuefi/reloc_aarch64.c ++++ b/gnu-efi/gnuefi/reloc_aarch64.c +@@ -48,6 +48,11 @@ EFI_STATUS _relocate (long ldbase, Elf64_Dyn *dyn, + unsigned long *addr; + int i; + ++ /* ++ * We need this code to not be on the same page as any relocations. ++ */ ++ __asm__(".balign 4096\n"); ++ + for (i = 0; dyn[i].d_tag != DT_NULL; ++i) { + switch (dyn[i].d_tag) { + case DT_RELA: +-- +2.35.1 + diff --git a/shim-unsigned-aarch64.spec b/shim-unsigned-aarch64.spec index 613f3c5..4431c6f 100644 --- a/shim-unsigned-aarch64.spec +++ b/shim-unsigned-aarch64.spec @@ -23,7 +23,7 @@ Name: shim-unsigned-aarch64 Version: 15.6 -Release: 1 +Release: 2 Summary: First-stage UEFI bootloader ExclusiveArch: aarch64 License: BSD @@ -143,6 +143,10 @@ cd .. %files debugsource -f build-%{efiarch}/debugsource.list %changelog +* Thu Jul 07 2022 Robbie Harwood - 15.6-2 +- Add pjones's aarch64 relocation fix +- Resolves: #2101248 + * Wed Jun 15 2022 Peter Jones - 15.6-1 - Update to shim-15.6 Resolves: CVE-2022-28737 diff --git a/shim.patches b/shim.patches index e69de29..6eb41ae 100644 --- a/shim.patches +++ b/shim.patches @@ -0,0 +1 @@ +Patch0001: 0001-aarch64-Keep-_relocate-from-being-dirtied-by-_reloca.patch From 5955d9bac4b9c9b8d054645ba55bd9d4790e785c Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 7 Mar 2024 17:02:38 -0500 Subject: [PATCH 5/8] Update to shim-15.8 Resolves: CVE-2023-40546 Resolves: CVE-2023-40547 Resolves: CVE-2023-40548 Resolves: CVE-2023-40549 Resolves: CVE-2023-40550 Resolves: CVE-2023-40551 Resolves: rhbz#2113005 Resolves: rhbz#2189197 Resolves: rhbz#2238884 Resolves: rhbz#2259264 Signed-off-by: Peter Jones --- ...locate-from-being-dirtied-by-_reloca.patch | 105 ------------------ fedora-ca-20200709.cer | Bin 876 -> 1119 bytes sbat.redhat.csv | 4 +- shim-unsigned-aarch64.spec | 38 +++++-- shim.patches | 1 - sources | 2 +- 6 files changed, 31 insertions(+), 119 deletions(-) delete mode 100644 0001-aarch64-Keep-_relocate-from-being-dirtied-by-_reloca.patch diff --git a/0001-aarch64-Keep-_relocate-from-being-dirtied-by-_reloca.patch b/0001-aarch64-Keep-_relocate-from-being-dirtied-by-_reloca.patch deleted file mode 100644 index c6efb63..0000000 --- a/0001-aarch64-Keep-_relocate-from-being-dirtied-by-_reloca.patch +++ /dev/null @@ -1,105 +0,0 @@ -From de8c3582d2eb280bf6b358349e04a959b945f1a5 Mon Sep 17 00:00:00 2001 -From: Peter Jones -Date: Fri, 1 Jul 2022 15:52:51 -0400 -Subject: [PATCH] aarch64: Keep _relocate() from being dirtied by _relocate() - -[Patch is a gnu-efi patch we apply to the bundled copy.] - -This could all be wrong, but the fix seems to work. Here's my theory of -what's going on. We have a bug report that says: - - No EFI system partition - Booting /efi\boot\bootaa64.efi - No EFI system partition - Failed to persist EFI variables - "Synchronous Abort" handler, esr 0x02000000 - elr: fffffffffeb48a28 lr : fffffffffeb3f024 (reloc) - elr: 000000003ca1aa28 lr : 000000003ca11024 - x0 : 000000003ca0d000 x1 : 000000003ca22018 - x2 : 000000003ca22000 x3 : 0000000000000018 - x4 : 0000000000001488 x5 : 0000000000000000 - x6 : 0000000000001000 x7 : 0000000000000000 - x8 : 0000000000000007 x9 : 0000000000003ca0 - x10: 000000003ca3e040 x11: 00000000b0b87665 - x12: 000000007c70ea25 x13: 000000005a827999 - x14: 000000006ed9eba1 x15: 000000008f1bbcdc - x16: 000000003df97394 x17: 00000000b7ce40b7 - x18: 0000000000000011 x19: 000000003caeb000 - x20: 0000000000000000 x21: 000000003dc1ba50 - x22: 000000003caff2f8 x23: 0000000000000001 - x24: 000000003caff000 x25: 000000003caff3c0 - x26: 000000003caff3c8 x27: 000000003caff3d0 - x28: 000000003caff3d8 x29: 000000003db3e600 - - Code: 8b000021 f82068a1 8b030042 cb030084 (f100009f) - UEFI image [0x000000003ca0d000:0x000000003ca24fff] pc=0xda28 '/efi\boot\fbaa64.efi' - Resetting CPU ... - - resetting ... - -When I disassemble it, "8b000021 f82068a1 8b030042 cb030084 (f100009f)" -at 0xda28 (aka 0x3ca1aa28 in our register dump above) is: - - da18: 8b000021 add x1, x1, x0 - da1c: f82068a1 str x1, [x5, x0] - da20: 8b030042 add x2, x2, x3 - da24: cb030084 sub x4, x4, x3 - da28: f100009f cmp x4, #0x0 - -Of course the Arm ARM says "cmp" cannot fault in this way, and %esr is -less than helpful, for reasons I don't understand. I believe what is -happening is this. Farther up in the file is the function -StatusToString(), as seen here: - - 000000000000d960 : - d960: d0000022 adrp x2, 13000 - d964: aa0103e3 mov x3, x1 - d968: 911f0042 add x2, x2, #0x7c0 - d96c: f9400441 ldr x1, [x2, #8] - d970: b5000081 cbnz x1, d980 - d974: b0000022 adrp x2, 12000 - d978: 91124842 add x2, x2, #0x492 - d97c: 17fffc32 b ca44 - d980: f8410444 ldr x4, [x2], #16 - d984: eb03009f cmp x4, x3 - d988: 54ffff21 b.ne d96c // b.any - d98c: 17fffe47 b d2a8 - -I believe when _relocate() gets to the relocations for 0xd960 the page -being processed is evicted from the i$ and moved into the d$, and then -when execution continues, the i$ raises an exception because it doesn't -have the page in question, and it can't stall execution to fill it, -because it's now owned (and dirty) in the other cache. - -There are a couple of ways to solve this, but I've taken the laziest -one: align the code in _relocate() to its own page boundary. This -partially works because our link order means this code is actually the -last function in .text, and so no relocations will ever land on this -page. - -Signed-off-by: Peter Jones -[rharwood@redhat.com: adapt to shim] -Signed-off-by: Robbie Harwood ---- - gnu-efi/gnuefi/reloc_aarch64.c | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/gnu-efi/gnuefi/reloc_aarch64.c b/gnu-efi/gnuefi/reloc_aarch64.c -index 086727961c2..0022abdaca7 100644 ---- a/gnu-efi/gnuefi/reloc_aarch64.c -+++ b/gnu-efi/gnuefi/reloc_aarch64.c -@@ -48,6 +48,11 @@ EFI_STATUS _relocate (long ldbase, Elf64_Dyn *dyn, - unsigned long *addr; - int i; - -+ /* -+ * We need this code to not be on the same page as any relocations. -+ */ -+ __asm__(".balign 4096\n"); -+ - for (i = 0; dyn[i].d_tag != DT_NULL; ++i) { - switch (dyn[i].d_tag) { - case DT_RELA: --- -2.35.1 - diff --git a/fedora-ca-20200709.cer b/fedora-ca-20200709.cer index b81707b175f2205af35ba9903eae779db0e84069..29b3ce38991c3dda1bcd5526575baeb4f4d8994b 100644 GIT binary patch literal 1119 zcmXqLVu?0rVs>7@%*4pVB%oxuo<*3)#bxv7^0)h>zPB0hvTISMHwcNsTZmB8xMTrW*smY~9sR~Z{`6UX@jtWKw zMg|7v29}0`2K*p}%)%ULV1>zv26E!OAW1`GLvv$8L$fGxUSo3uLqkggV?z@I^Qb}R z-X=yR8gOvwA2rr_ij(r-u|#!&RgTCrs2}t zq9HE#zn<8%jlW-Fg4U(dZ8CD<(uZ<-JEB89c_gRbaXWeR*sk6Ji}t&7&Q@x_EZNe2 z=0WautG?KXf58Q@rzS2A>eXMP#24GeSNc0}-CsXx!F0NSr?Va^3j%z6?QyOzW zttvR7})}yjB&pG#AoE?9@Pa^j9gKa``8TVf6aMb13r)fen!UsEG*1S zjBVi5CMyi$vl=inGX6J^1u5WT5o5uwA2qKqgW@ymmEiSho9o}N+F^h9c*)6_=OSN= zV~=c6+WxWW(tlg;&;_>-S;gECQ)SXmG25BQ{yl4N# z#;FC`rH5Y8a$gnYo zvM>vax}~P%7bPkLrzV#cr7Ae(=a(orI~vG|^BNi%8X1@yni-jznna278iBZ`P%ds0 zIABIh&SO-pU-$KUP~*xNJMHhXpzG$WnyMzU|ig|!k}^Kog{XSUff*H%4msydXu?Iq@x8c& zOP0$>x^&UBi+pwu4Gv4ZI30Y1n_+F;+7q6R@26+(6^?)Z-sV;U>y1f&Ze_jlu;;TY LF8{l%^QAoi#t}ln diff --git a/sbat.redhat.csv b/sbat.redhat.csv index 0c40529..cfcf013 100644 --- a/sbat.redhat.csv +++ b/sbat.redhat.csv @@ -1 +1,3 @@ -shim.rh,2,The Fedora Project,shim,15.6,https://src.fedoraproject.org/rpms/shim-unsigned-x64 +shim.rh,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64 +shim.redhat,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64 +shim.fedora,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64 diff --git a/shim-unsigned-aarch64.spec b/shim-unsigned-aarch64.spec index 4431c6f..ea8b737 100644 --- a/shim-unsigned-aarch64.spec +++ b/shim-unsigned-aarch64.spec @@ -21,8 +21,11 @@ %global __debug_install_post %{SOURCE100} %{efiarch} %undefine _debuginfo_subpackages +# currently here's what's in our dbx: nothing +%global dbxfile %{nil} + Name: shim-unsigned-aarch64 -Version: 15.6 +Version: 15.8 Release: 2 Summary: First-stage UEFI bootloader ExclusiveArch: aarch64 @@ -44,7 +47,7 @@ BuildRequires: gcc make BuildRequires: elfutils-libelf-devel BuildRequires: git openssl-devel openssl BuildRequires: pesign >= %{pesign_vre} -BuildRequires: dos2unix findutils +BuildRequires: dos2unix findutils # Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not # compatible with SysV (there's no red zone under UEFI) and there isn't a @@ -87,17 +90,17 @@ mkdir build-%{efiarch} cp %{SOURCE3} data/ %build -COMMITID=$(cat commit) -MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " +COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6 +MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " -MAKEFLAGS+="%{_smp_mflags}" +MAKEFLAGS+=" %{_smp_mflags} " if [ -f "%{SOURCE1}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" + MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} " fi %if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}" + MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2} " fi %endif @@ -108,16 +111,16 @@ make ${MAKEFLAGS} \ cd .. %install -COMMITID=$(cat commit) -MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " +COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6 +MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " if [ -f "%{SOURCE1}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" + MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} " fi %if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then - MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}" + MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2} " fi %endif @@ -143,6 +146,19 @@ cd .. %files debugsource -f build-%{efiarch}/debugsource.list %changelog +* Thu Mar 07 2024 Peter Jones - 15.8-2 +- Update to shim-15.8 + Resolves: CVE-2023-40546 + Resolves: CVE-2023-40547 + Resolves: CVE-2023-40548 + Resolves: CVE-2023-40549 + Resolves: CVE-2023-40550 + Resolves: CVE-2023-40551 + Resolves: rhbz#2113005 + Resolves: rhbz#2189197 + Resolves: rhbz#2238884 + Resolves: rhbz#2259264 + * Thu Jul 07 2022 Robbie Harwood - 15.6-2 - Add pjones's aarch64 relocation fix - Resolves: #2101248 diff --git a/shim.patches b/shim.patches index 6eb41ae..e69de29 100644 --- a/shim.patches +++ b/shim.patches @@ -1 +0,0 @@ -Patch0001: 0001-aarch64-Keep-_relocate-from-being-dirtied-by-_reloca.patch diff --git a/sources b/sources index bcb0302..5428b75 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (shim-15.6.tar.bz2) = ddc5d5234851d05ed7124ad748ad3fee2df8a335493948a045653322c873f3f055d34894aeb2ac7495086984ca62183907d341e46e6bdf108856e39c646455fc +SHA512 (shim-15.8.tar.bz2) = 30b3390ae935121ea6fe728d8f59d37ded7b918ad81bea06e213464298b4bdabbca881b30817965bd397facc596db1ad0b8462a84c87896ce6c1204b19371cd1 From d2967d655c131136adb487afa09ac03001782630 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 19 Mar 2024 15:42:04 -0400 Subject: [PATCH 6/8] Add an rpminspect.yaml Signed-off-by: Peter Jones --- rpminspect.yaml | 41 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 rpminspect.yaml diff --git a/rpminspect.yaml b/rpminspect.yaml new file mode 100644 index 0000000..26433b7 --- /dev/null +++ b/rpminspect.yaml @@ -0,0 +1,41 @@ +# rpminspect configuration + +--- +common: + workdir: /var/tmp/rpminspect + profiledir: /usr/share/rpminspect/profiles/fedora +koji: + hub: https://koji.fedoraproject.org/kojihub + download_ursine: https://kojipkgs.fedoraproject.org + download_mbs: https://kojipkgs.fedoraproject.org +commands: + msgunfmt: msgunfmt + desktop-file-validate: desktop-file-validate + abidiff: abidiff + kmidiff: kmidiff + annocheck: annocheck + udevadm: udevadm +vendor: + vendor_data_dir: /usr/share/rpminspect + licensedb: + - /usr/share/fedora-license-data/licenses/fedora-licenses.json + favor_release: newest +inspections: + abidiff: off + disttag: off + manpage: off + javabytecode: off +metadata: + # Required Vendor string. This is part of the RPM header and is + # the value expected in packages checked by rpminspect. + vendor: Fedora Project + + # Allowed build host subdomain. The RPM header contains information about + # where the package was built. rpminspect verifies the hostnames are in + # the expected subdomain listed below. + # + # This is an array of allowed subdomains. + buildhost_subdomain: + - .fedoraproject.org + - .bos.redhat.com + From 67c1d520f9a8080f6b689714099f813f23154c8f Mon Sep 17 00:00:00 2001 From: Nicolas Frayer Date: Wed, 13 Dec 2023 17:59:22 +0100 Subject: [PATCH 7/8] Migrate to SPDX license Please refer to https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2 Signed-off-by: Nicolas Frayer --- shim-unsigned-aarch64.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/shim-unsigned-aarch64.spec b/shim-unsigned-aarch64.spec index ea8b737..8b403ca 100644 --- a/shim-unsigned-aarch64.spec +++ b/shim-unsigned-aarch64.spec @@ -29,7 +29,7 @@ Version: 15.8 Release: 2 Summary: First-stage UEFI bootloader ExclusiveArch: aarch64 -License: BSD +License: BSD-2-Clause AND OpenSSL URL: https://github.com/rhboot/shim Source0: https://github.com/rhboot/shim/releases/download/%{version}%{?dashpre}/shim-%{version}%{?dotpre}.tar.bz2 Source1: fedora-ca-20200709.cer @@ -146,6 +146,10 @@ cd .. %files debugsource -f build-%{efiarch}/debugsource.list %changelog +* Fri Mar 22 2024 Nicolas Frayer +- Migrate to SPDX license +- Please refer to https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2 + * Thu Mar 07 2024 Peter Jones - 15.8-2 - Update to shim-15.8 Resolves: CVE-2023-40546 From 4db14e5ed7d3bdb7fda97f62c93e612435f2cce9 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 3 Sep 2025 13:45:57 -0400 Subject: [PATCH 8/8] Update to shim-16.1 Signed-off-by: Peter Jones --- sbat.redhat.csv | 3 --- sbat.redhat.csv.in | 3 +++ shim-unsigned-aarch64.spec | 19 +++++++++++++------ sources | 2 +- 4 files changed, 17 insertions(+), 10 deletions(-) delete mode 100644 sbat.redhat.csv create mode 100644 sbat.redhat.csv.in diff --git a/sbat.redhat.csv b/sbat.redhat.csv deleted file mode 100644 index cfcf013..0000000 --- a/sbat.redhat.csv +++ /dev/null @@ -1,3 +0,0 @@ -shim.rh,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64 -shim.redhat,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64 -shim.fedora,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64 diff --git a/sbat.redhat.csv.in b/sbat.redhat.csv.in new file mode 100644 index 0000000..eb2203f --- /dev/null +++ b/sbat.redhat.csv.in @@ -0,0 +1,3 @@ +shim.rh,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64 +shim.redhat,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64 +shim.fedora,3,The Fedora Project,shim,@@VERSION@@-@@RELEASE@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64 diff --git a/shim-unsigned-aarch64.spec b/shim-unsigned-aarch64.spec index 8b403ca..729d387 100644 --- a/shim-unsigned-aarch64.spec +++ b/shim-unsigned-aarch64.spec @@ -1,5 +1,6 @@ %global pesign_vre 0.106-1 %global openssl_vre 1.0.2j +%global shim_commit_id afc49558b34548644c1cd0ad1b6526a9470182ed # For prereleases, % global prerelease rc2, and downpatch Makefile %if %{defined prerelease} @@ -25,8 +26,8 @@ %global dbxfile %{nil} Name: shim-unsigned-aarch64 -Version: 15.8 -Release: 2 +Version: 16.1 +Release: 1 Summary: First-stage UEFI bootloader ExclusiveArch: aarch64 License: BSD-2-Clause AND OpenSSL @@ -36,7 +37,7 @@ Source1: fedora-ca-20200709.cer %if 0%{?dbxfile} Source2: %{dbxfile} %endif -Source3: sbat.redhat.csv +Source3: sbat.redhat.csv.in Source4: shim.patches Source100: shim-find-debuginfo.sh @@ -48,6 +49,7 @@ BuildRequires: elfutils-libelf-devel BuildRequires: git openssl-devel openssl BuildRequires: pesign >= %{pesign_vre} BuildRequires: dos2unix findutils +BuildRequires: sed # Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not # compatible with SysV (there's no red zone under UEFI) and there isn't a @@ -87,10 +89,12 @@ BuildArch: noarch git config --unset user.email git config --unset user.name mkdir build-%{efiarch} -cp %{SOURCE3} data/ +sed -e 's/@@VERSION@@/%{version}/g' \ + -e 's/@@RELEASE@@/%{release}/g' \ + < %{SOURCE3} > data/sbat.redhat.csv %build -COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6 +COMMIT_ID=%{shim_commit_id} MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " @@ -111,7 +115,7 @@ make ${MAKEFLAGS} \ cd .. %install -COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6 +COMMIT_ID=%{shim_commit_id} MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " MAKEFLAGS+="ENABLE_SHIM_HASH=true " @@ -146,6 +150,9 @@ cd .. %files debugsource -f build-%{efiarch}/debugsource.list %changelog +* Wed Sep 03 2025 Peter Jones - 16.1-1 +- Update to shim-16.1 + * Fri Mar 22 2024 Nicolas Frayer - Migrate to SPDX license - Please refer to https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2 diff --git a/sources b/sources index 5428b75..e96df6e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (shim-15.8.tar.bz2) = 30b3390ae935121ea6fe728d8f59d37ded7b918ad81bea06e213464298b4bdabbca881b30817965bd397facc596db1ad0b8462a84c87896ce6c1204b19371cd1 +SHA512 (shim-16.1.tar.bz2) = ca5f80e82f3b80b622028f03ef23105c98ee1b6a25f52a59c823080a3202dd4b9962266489296e99f955eb92e36ce13e0b1d57f688350006bba45f2718f159fb