From 06ba49d95f7fe62908721b3ecbcbf8e8ef96db7c Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 23 Mar 2021 16:18:39 -0400 Subject: [PATCH 1/3] Update to shim 15.4 - Support for revocations via the ".sbat" section and SBAT EFI variable - A new unit test framework and a bunch of unit tests - No external gnu-efi dependency - Better CI Resolves: CVE-2020-14372 Resolves: CVE-2020-25632 Resolves: CVE-2020-25647 Resolves: CVE-2020-27749 Resolves: CVE-2020-27779 Resolves: CVE-2021-20225 Resolves: CVE-2021-20233 Signed-off-by: Peter Jones --- .gitignore | 1 + fedora-ca.cer => fedora-ca-20200709.cer | Bin sbat.redhat.csv | 1 + shim-find-debuginfo.sh | 33 +++++---- shim-unsigned-x64.spec | 93 +++++++++++++++++------- sources | 2 +- 6 files changed, 87 insertions(+), 43 deletions(-) rename fedora-ca.cer => fedora-ca-20200709.cer (100%) create mode 100644 sbat.redhat.csv diff --git a/.gitignore b/.gitignore index b908d57..b0f42f7 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,5 @@ *~ +*.sh *.tar.* *.rpm .build*.log diff --git a/fedora-ca.cer b/fedora-ca-20200709.cer similarity index 100% rename from fedora-ca.cer rename to fedora-ca-20200709.cer diff --git a/sbat.redhat.csv b/sbat.redhat.csv new file mode 100644 index 0000000..04497b3 --- /dev/null +++ b/sbat.redhat.csv @@ -0,0 +1 @@ +shim.redhat,1,The Fedora Project,shim,15.3,https://src.fedoraproject.org/rpms/shim-unsigned-x64 diff --git a/shim-find-debuginfo.sh b/shim-find-debuginfo.sh index 7e882ff..d656fc9 100755 --- a/shim-find-debuginfo.sh +++ b/shim-find-debuginfo.sh @@ -20,9 +20,9 @@ fi findsource() { ( - cd ${RPM_BUILD_ROOT} - find usr/src/debug/ -type d | sed "s,^,%dir /," - find usr/src/debug/ -type f | sed "s,^,/," + cd "${RPM_BUILD_ROOT}" + find usr/src/debug/ -type d | sed -e "s,^,%dir /," | sort -u | tac + find usr/src/debug/ -type f | sed -e "s,^,/," | sort -u | tac ) } @@ -32,9 +32,12 @@ finddebug() declare -a dirs=() declare -a files=() declare -a excludes=() + declare -a tmp=() - pushd ${RPM_BUILD_ROOT} >/dev/null 2>&1 - for x in $(find usr/lib/debug/ -type f -iname *.efi.debug); do + pushd "${RPM_BUILD_ROOT}" >/dev/null 2>&1 + + mapfile -t tmp < <(find usr/lib/debug/ -type f -iname "*.efi.debug") + for x in "${tmp[@]}" ; do if ! [ -e "${x}" ]; then break fi @@ -57,8 +60,10 @@ finddebug() excludes[${#excludes[@]}]=${x%%.debug} fi done - for x in ${files[@]} ; do - declare name=$(dirname /${x}) + for x in "${files[@]}" ; do + declare name + + name=$(dirname "/${x}") while [ "${name}" != "/" ]; do case "${name}" in "/usr/lib/debug"|"/usr/lib"|"/usr") @@ -67,24 +72,24 @@ finddebug() dirs[${#dirs[@]}]=${name} ;; esac - name=$(dirname ${name}) + name=$(dirname "${name}") done done popd >/dev/null 2>&1 - for x in ${dirs[@]} ; do + for x in "${dirs[@]}" ; do echo "%dir ${x}" done | sort | uniq - for x in ${files[@]} ; do + for x in "${files[@]}" ; do echo "/${x}" done | sort | uniq - for x in ${excludes[@]} ; do + for x in "${excludes[@]}" ; do echo "%exclude /${x}" done } -findsource > build-${mainarch}/debugsource.list -finddebug ${mainarch} > build-${mainarch}/debugfiles.list +findsource > "build-${mainarch}/debugsource.list" +finddebug "${mainarch}" > "build-${mainarch}/debugfiles.list" if [ -v altarch ]; then - finddebug ${altarch} > build-${altarch}/debugfiles.list + finddebug "${altarch}" > "build-${altarch}/debugfiles.list" fi diff --git a/shim-unsigned-x64.spec b/shim-unsigned-x64.spec index e13131b..96ab552 100644 --- a/shim-unsigned-x64.spec +++ b/shim-unsigned-x64.spec @@ -1,13 +1,6 @@ %global pesign_vre 0.106-1 -%global gnuefi_vre 1:3.0.8-1 %global openssl_vre 1.0.2j -%global debug_package %{nil} -%global __debug_package 1 -%global _binaries_in_noarch_packages_terminate_build 0 -%global __debug_install_post %{SOURCE100} x64 ia32 -%undefine _debuginfo_subpackages - %global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/')) %global shimrootdir %{_datadir}/shim/ %global shimversiondir %{shimrootdir}/%{version}-%{release} @@ -16,33 +9,36 @@ %global efialtarch ia32 %global shimaltdir %{shimversiondir}/%{efialtarch} +%global debug_package %{nil} +%global __debug_package 1 +%global _binaries_in_noarch_packages_terminate_build 0 +%global __debug_install_post %{SOURCE100} %{efiarch} %{efialtarch} +%undefine _debuginfo_subpackages + +# currently here's what's in our dbx: nothing +%global dbxfile %{nil} + Name: shim-unsigned-%{efiarch} -Version: 15 +Version: 15.4 Release: 1%{?dist} Summary: First-stage UEFI bootloader ExclusiveArch: x86_64 License: BSD URL: https://github.com/rhboot/shim Source0: https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2 -Source1: fedora-ca.cer -# currently here's what's in our dbx: -# grub2-efi-2.00-11.fc18.x86_64: -# grubx64.efi 6ac839881e73504047c06a1aac0c4763408ecb3642783c8acf77a2d393ea5cd7 -# gcdx64.efi 065cd63bab696ad2f4732af9634d66f2c0d48f8a3134b8808750d378550be151 -# grub2-efi-2.00-11.fc19.x86_64: -# grubx64.efi 49ece9a10a9403b32c8e0c892fd9afe24a974323c96f2cc3dd63608754bf9b45 -# gcdx64.efi 99fcaa957786c155a92b40be9c981c4e4685b8c62b408cb0f6cb2df9c30b9978 -# woops. -Source2: dbx.esl +Source1: fedora-ca-20200709.cer +%if 0%{?dbxfile} +Source2: %{dbxfile} +%endif +Source3: sbat.redhat.csv Source100: shim-find-debuginfo.sh -BuildRequires: gcc make +BuildRequires: gcc make BuildRequires: elfutils-libelf-devel BuildRequires: git openssl-devel openssl BuildRequires: pesign >= %{pesign_vre} -BuildRequires: gnu-efi >= %{gnuefi_vre} -BuildRequires: gnu-efi-devel >= %{gnuefi_vre} +BuildRequires: dos2unix findutils # Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not # compatible with SysV (there's no red zone under UEFI) and there isn't a @@ -70,7 +66,6 @@ Provides: bundled(openssl) = %{openssl_vre} %package debuginfo Summary: Debug information for shim-unsigned-%{efiarch} -Requires: %{name}-debugsource = %{version}-%{release} AutoReqProv: 0 BuildArch: noarch @@ -79,7 +74,6 @@ BuildArch: noarch %package -n shim-unsigned-%{efialtarch}-debuginfo Summary: Debug information for shim-unsigned-%{efialtarch} -Requires: %{name}-debugsource = %{version}-%{release} AutoReqProv: 0 BuildArch: noarch @@ -100,52 +94,65 @@ git config --unset user.email git config --unset user.name mkdir build-%{efiarch} mkdir build-%{efialtarch} +cp %{SOURCE3} data/ %build COMMITID=$(cat commit) MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " -MAKEFLAGS+="ENABLE_HTTPBOOT=true ENABLE_SHIM_HASH=true " +MAKEFLAGS+="ENABLE_SHIM_HASH=true " MAKEFLAGS+="%{_smp_mflags}" if [ -f "%{SOURCE1}" ]; then MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" fi +%if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}" fi +%endif cd build-%{efiarch} -make ${MAKEFLAGS} DEFAULT_LOADER='\\\\grub%{efiarch}.efi' all +make ${MAKEFLAGS} \ + DEFAULT_LOADER='\\\\grub%{efiarch}.efi' \ + all cd .. cd build-%{efialtarch} -setarch linux32 -B make ${MAKEFLAGS} ARCH=%{efialtarch} DEFAULT_LOADER='\\\\grub%{efialtarch}.efi' all +setarch linux32 -B make ${MAKEFLAGS} \ + ARCH=%{efialtarch} \ + DEFAULT_LOADER='\\\\grub%{efialtarch}.efi' \ + all cd .. %install COMMITID=$(cat commit) MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMITID=${COMMITID} " MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} " -MAKEFLAGS+="ENABLE_HTTPBOOT=true ENABLE_SHIM_HASH=true " +MAKEFLAGS+="ENABLE_SHIM_HASH=true " if [ -f "%{SOURCE1}" ]; then MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1}" fi +%if 0%{?dbxfile} if [ -f "%{SOURCE2}" ]; then MAKEFLAGS="$MAKEFLAGS VENDOR_DBX_FILE=%{SOURCE2}" fi +%endif cd build-%{efiarch} make ${MAKEFLAGS} \ DEFAULT_LOADER='\\\\grub%{efiarch}.efi' \ DESTDIR=${RPM_BUILD_ROOT} \ install-as-data install-debuginfo install-debugsource +install -m 0644 BOOT*.CSV "${RPM_BUILD_ROOT}/%{shimdir}/" cd .. cd build-%{efialtarch} -setarch linux32 make ${MAKEFLAGS} ARCH=%{efialtarch} \ +setarch linux32 make ${MAKEFLAGS} \ + ARCH=%{efialtarch} \ DEFAULT_LOADER='\\\\grub%{efialtarch}.efi' \ DESTDIR=${RPM_BUILD_ROOT} \ install-as-data install-debuginfo install-debugsource +install -m 0644 BOOT*.CSV "${RPM_BUILD_ROOT}/%{shimaltdir}/" cd .. %files @@ -155,6 +162,7 @@ cd .. %dir %{shimdir} %{shimdir}/*.efi %{shimdir}/*.hash +%{shimdir}/*.CSV %files -n shim-unsigned-%{efialtarch} %license COPYRIGHT @@ -163,6 +171,7 @@ cd .. %dir %{shimaltdir} %{shimaltdir}/*.efi %{shimaltdir}/*.hash +%{shimaltdir}/*.CSV %files debuginfo -f build-%{efiarch}/debugfiles.list @@ -171,6 +180,34 @@ cd .. %files debugsource -f build-%{efiarch}/debugsource.list %changelog +* Tue Mar 30 2021 Peter Jones - 15.4-1 +- Update to shim 15.4 + - Support for revocations via the ".sbat" section and SBAT EFI variable + - A new unit test framework and a bunch of unit tests + - No external gnu-efi dependency + - Better CI + Resolves: CVE-2020-14372 + Resolves: CVE-2020-25632 + Resolves: CVE-2020-25647 + Resolves: CVE-2020-27749 + Resolves: CVE-2020-27779 + Resolves: CVE-2021-20225 + Resolves: CVE-2021-20233 + +* Wed Mar 24 2021 Peter Jones - 15.3-0~1 +- Update to shim 15.3 + - Support for revocations via the ".sbat" section and SBAT EFI variable + - A new unit test framework and a bunch of unit tests + - No external gnu-efi dependency + - Better CI + Resolves: CVE-2020-14372 + Resolves: CVE-2020-25632 + Resolves: CVE-2020-25647 + Resolves: CVE-2020-27749 + Resolves: CVE-2020-27779 + Resolves: CVE-2021-20225 + Resolves: CVE-2021-20233 + * Thu Apr 05 2018 Peter Jones - 15-1 - Update to shim 15 - better checking for bad linker output diff --git a/sources b/sources index 697992c..470fcf2 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (shim-15.tar.bz2) = f7dfac774d644111431ca56da76b5575b891b0abad970b318edaede11a0d83c869728bc39cb6af3689bdb203c6826545caf8ddd3d14228831027e334963cf957 +SHA512 (shim-15.4.tar.bz2) = b9712fe6964f60de251f1bff83914c4aac0f6430474c44741c059f31b72c2d5987c313cbb5e8bc07bfd04e61e6b511ea2d19a9975cde8c6127bc05f2de834526 From 1a60efcb0e6c3db5364f6c0a88afb49701bbc2a4 Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 1 Feb 2022 11:41:53 -0500 Subject: [PATCH 2/3] Add support for prereleases; no code changes Signed-off-by: Robbie Harwood --- shim-unsigned-x64.spec | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/shim-unsigned-x64.spec b/shim-unsigned-x64.spec index 96ab552..72f33de 100644 --- a/shim-unsigned-x64.spec +++ b/shim-unsigned-x64.spec @@ -1,6 +1,14 @@ %global pesign_vre 0.106-1 %global openssl_vre 1.0.2j +# For prereleases, % global prerelease rc2, and downpatch Makefile +%if %{defined prerelease} +%global dashpre -%{prerelease} +%global dotpre .%{prerelease} +%global tildepre ~%{prerelease} +%global zdpd 0%{dotpre}. +%endif + %global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/')) %global shimrootdir %{_datadir}/shim/ %global shimversiondir %{shimrootdir}/%{version}-%{release} @@ -20,12 +28,12 @@ Name: shim-unsigned-%{efiarch} Version: 15.4 -Release: 1%{?dist} +Release: %{?zdpd}1%{?dist} Summary: First-stage UEFI bootloader ExclusiveArch: x86_64 License: BSD URL: https://github.com/rhboot/shim -Source0: https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2 +Source0: https://github.com/rhboot/shim/releases/download/%{version}%{?dashpre}/shim-%{version}%{?dotpre}.tar.bz2 Source1: fedora-ca-20200709.cer %if 0%{?dbxfile} Source2: %{dbxfile} @@ -89,7 +97,7 @@ BuildArch: noarch %debug_desc %prep -%autosetup -S git -n shim-%{version} +%autosetup -S git_am -n shim-%{version}%{?tildepre} git config --unset user.email git config --unset user.name mkdir build-%{efiarch} From 85ba9ef9701947d278f24d0f43327f1e57d09007 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 10 Mar 2022 16:17:51 -0500 Subject: [PATCH 3/3] Update to shim 15.5 lots of minor fixes Signed-off-by: Peter Jones --- dbx.esl | Bin 304 -> 0 bytes sbat.redhat.csv | 2 +- shim-unsigned-x64.spec | 6 +++++- sources | 2 +- 4 files changed, 7 insertions(+), 3 deletions(-) delete mode 100644 dbx.esl diff --git a/dbx.esl b/dbx.esl deleted file mode 100644 index 2ea555ccebee3c3fd2a8c73a78a90af156dbcd37..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 304 zcmY!rJ95w`V3Na{m5x8nCOc~wFfxFF0Rsa=|C5(%cg%S - 15.5-1 +- Update to shim 15.5 + - lots of minor fixes + * Tue Mar 30 2021 Peter Jones - 15.4-1 - Update to shim 15.4 - Support for revocations via the ".sbat" section and SBAT EFI variable diff --git a/sources b/sources index 470fcf2..fe04942 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (shim-15.4.tar.bz2) = b9712fe6964f60de251f1bff83914c4aac0f6430474c44741c059f31b72c2d5987c313cbb5e8bc07bfd04e61e6b511ea2d19a9975cde8c6127bc05f2de834526 +SHA512 (shim-15.5.tar.bz2) = 91fbda1ef0b4ea36538b57179488169f37eb8522d8dbbbf2eeb40708bc013073b4454b4205a957df13e1e15b9151c6013a8292691f9e3ab28ba7d0935fcc4fab