From 8388c29928c02dd11e3af7e9e5272b3f19729d4e Mon Sep 17 00:00:00 2001 From: Robbie Harwood Date: Tue, 1 Feb 2022 11:41:53 -0500 Subject: [PATCH 1/4] Add support for prereleases; no code changes Signed-off-by: Robbie Harwood --- shim-unsigned-x64.spec | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/shim-unsigned-x64.spec b/shim-unsigned-x64.spec index 96ab552..72f33de 100644 --- a/shim-unsigned-x64.spec +++ b/shim-unsigned-x64.spec @@ -1,6 +1,14 @@ %global pesign_vre 0.106-1 %global openssl_vre 1.0.2j +# For prereleases, % global prerelease rc2, and downpatch Makefile +%if %{defined prerelease} +%global dashpre -%{prerelease} +%global dotpre .%{prerelease} +%global tildepre ~%{prerelease} +%global zdpd 0%{dotpre}. +%endif + %global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/')) %global shimrootdir %{_datadir}/shim/ %global shimversiondir %{shimrootdir}/%{version}-%{release} @@ -20,12 +28,12 @@ Name: shim-unsigned-%{efiarch} Version: 15.4 -Release: 1%{?dist} +Release: %{?zdpd}1%{?dist} Summary: First-stage UEFI bootloader ExclusiveArch: x86_64 License: BSD URL: https://github.com/rhboot/shim -Source0: https://github.com/rhboot/shim/releases/download/%{version}/shim-%{version}.tar.bz2 +Source0: https://github.com/rhboot/shim/releases/download/%{version}%{?dashpre}/shim-%{version}%{?dotpre}.tar.bz2 Source1: fedora-ca-20200709.cer %if 0%{?dbxfile} Source2: %{dbxfile} @@ -89,7 +97,7 @@ BuildArch: noarch %debug_desc %prep -%autosetup -S git -n shim-%{version} +%autosetup -S git_am -n shim-%{version}%{?tildepre} git config --unset user.email git config --unset user.name mkdir build-%{efiarch} From a19261f74b62184eea1b71f0dd89905e942b2a01 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 10 Mar 2022 16:17:51 -0500 Subject: [PATCH 2/4] Update to shim 15.5 lots of minor fixes Signed-off-by: Peter Jones --- dbx.esl | Bin 304 -> 0 bytes sbat.redhat.csv | 2 +- shim-unsigned-x64.spec | 6 +++++- sources | 2 +- 4 files changed, 7 insertions(+), 3 deletions(-) delete mode 100644 dbx.esl diff --git a/dbx.esl b/dbx.esl deleted file mode 100644 index 2ea555ccebee3c3fd2a8c73a78a90af156dbcd37..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 304 zcmY!rJ95w`V3Na{m5x8nCOc~wFfxFF0Rsa=|C5(%cg%S - 15.5-1 +- Update to shim 15.5 + - lots of minor fixes + * Tue Mar 30 2021 Peter Jones - 15.4-1 - Update to shim 15.4 - Support for revocations via the ".sbat" section and SBAT EFI variable diff --git a/sources b/sources index 470fcf2..fe04942 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (shim-15.4.tar.bz2) = b9712fe6964f60de251f1bff83914c4aac0f6430474c44741c059f31b72c2d5987c313cbb5e8bc07bfd04e61e6b511ea2d19a9975cde8c6127bc05f2de834526 +SHA512 (shim-15.5.tar.bz2) = 91fbda1ef0b4ea36538b57179488169f37eb8522d8dbbbf2eeb40708bc013073b4454b4205a957df13e1e15b9151c6013a8292691f9e3ab28ba7d0935fcc4fab From 9c156cdfc97d1350d69114b91146544e2f44daf9 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 24 May 2022 16:32:34 -0400 Subject: [PATCH 3/4] Update to shim-15.6 Resolves: CVE-2022-28737 Signed-off-by: Peter Jones --- shim-unsigned-x64.spec | 13 ++++++++++--- shim.patches | 0 sources | 2 +- 3 files changed, 11 insertions(+), 4 deletions(-) create mode 100644 shim.patches diff --git a/shim-unsigned-x64.spec b/shim-unsigned-x64.spec index 5a109ce..181c082 100644 --- a/shim-unsigned-x64.spec +++ b/shim-unsigned-x64.spec @@ -27,8 +27,8 @@ %global dbxfile %{nil} Name: shim-unsigned-%{efiarch} -Version: 15.5 -Release: %{?zdpd}1%{?dist} +Version: 15.6 +Release: 1 Summary: First-stage UEFI bootloader ExclusiveArch: x86_64 License: BSD @@ -39,9 +39,12 @@ Source1: fedora-ca-20200709.cer Source2: %{dbxfile} %endif Source3: sbat.redhat.csv +Source4: shim.patches Source100: shim-find-debuginfo.sh +%include %{SOURCE4} + BuildRequires: gcc make BuildRequires: elfutils-libelf-devel BuildRequires: git openssl-devel openssl @@ -97,7 +100,7 @@ BuildArch: noarch %debug_desc %prep -%autosetup -S git_am -n shim-%{version}%{?tildepre} +%autosetup -S git_am -n shim-%{version} git config --unset user.email git config --unset user.name mkdir build-%{efiarch} @@ -188,6 +191,10 @@ cd .. %files debugsource -f build-%{efiarch}/debugsource.list %changelog +* Tue Jun 07 2022 Peter Jones - 15.6-1 +- Update to shim-15.6 + Resolves: CVE-2022-28737 + * Thu Mar 10 2022 Peter Jones - 15.5-1 - Update to shim 15.5 - lots of minor fixes diff --git a/shim.patches b/shim.patches new file mode 100644 index 0000000..e69de29 diff --git a/sources b/sources index fe04942..bcb0302 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (shim-15.5.tar.bz2) = 91fbda1ef0b4ea36538b57179488169f37eb8522d8dbbbf2eeb40708bc013073b4454b4205a957df13e1e15b9151c6013a8292691f9e3ab28ba7d0935fcc4fab +SHA512 (shim-15.6.tar.bz2) = ddc5d5234851d05ed7124ad748ad3fee2df8a335493948a045653322c873f3f055d34894aeb2ac7495086984ca62183907d341e46e6bdf108856e39c646455fc From e407ee28f74314eae5ff30e670a8707504bf5163 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 24 May 2022 16:32:34 -0400 Subject: [PATCH 4/4] Update to shim-15.6 Resolves: CVE-2022-28737 Signed-off-by: Peter Jones --- sbat.redhat.csv | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sbat.redhat.csv b/sbat.redhat.csv index b034e71..0c40529 100644 --- a/sbat.redhat.csv +++ b/sbat.redhat.csv @@ -1 +1 @@ -shim.redhat,1,The Fedora Project,shim,15.5,https://src.fedoraproject.org/rpms/shim-unsigned-x64 +shim.rh,2,The Fedora Project,shim,15.6,https://src.fedoraproject.org/rpms/shim-unsigned-x64