a0656a4
%global debug_package %{nil}
a0656a4
a0656a4
%global efidir %(eval echo $(grep ^ID= /etc/os-release | sed -e 's/^ID=//' -e 's/rhel/redhat/'))
a0656a4
a0656a4
# this is literally to make vim's \c not put a brace at the end.
a0656a4
%global _dist %{expand:%{?_module_build:%%{?dist}}}
a0656a4
%global dist %{expand:%%{_dist}}
a0656a4
0abd456
Name:		shim
a0656a4
Version:	13
acc5812
Release:	5%{dist}
a0656a4
Summary:	First-stage UEFI bootloader
a0656a4
License:	BSD
a0656a4
URL:		http://github.com/rhboot/shim/
a0656a4
a0656a4
# Shim is only required on platforms implementing the UEFI secure boot
a0656a4
# protocol. The only one of those we currently wish to support is 64-bit x86.
a0656a4
# Adding further platforms will require adding appropriate relocation code.
a0656a4
ExclusiveArch:	x86_64 aarch64
a0656a4
a0656a4
# keep these two lists of sources synched up arch-wise.  That is 0 and 10
a0656a4
# match, 1 and 11 match, ...
a0656a4
Source0:	BOOTX64.CSV
a0656a4
Source1:	BOOTAA64.CSV
a0656a4
Source2:	BOOTIA32.CSV
a0656a4
a0656a4
Source10:	shimaa64.efi
a0656a4
Source11:	shimia32.efi
a0656a4
Source12:	shimx64.efi
acc5812
Source13:	shimx64-signed.efi
a0656a4
a0656a4
%global shimverx64 13-3.fc27
a0656a4
%global shimveria32 13-3.fc27
a0656a4
%global shimveraa64 13-3.fc27
a0656a4
a0656a4
%ifarch x86_64
a0656a4
BuildRequires: shim-unsigned-x64 = %{shimverx64}
a0656a4
BuildRequires: shim-unsigned-ia32 = %{shimveria32}
a0656a4
%global shimdirx64 %{_datadir}/shim/%{shimverx64}/x64
a0656a4
%global shimdiria32 %{_datadir}/shim/%{shimveria32}/ia32
a0656a4
%endif
a0656a4
%ifarch aarch64
a0656a4
BuildRequires: shim-unsigned-aarch64 = %{shimveraa64}
a0656a4
%global shimdiraa64 %{_datadir}/shim/%{shimveraa64}/aa64
a0656a4
%endif
a0656a4
BuildRequires:	pesign >= 0.112-20.fc27
a0656a4
a0656a4
%description
a0656a4
Initial UEFI bootloader that handles chaining to a trusted full bootloader
a0656a4
under secure boot environments. This package contains the version signed by
a0656a4
the UEFI signing service.
a0656a4
a0656a4
%define define_pkg(a:p:)						\
a0656a4
%{expand:%%package -n shim-%{-a*}}					\
a0656a4
Summary: First-stage UEFI bootloader					\
a0656a4
Requires: mokutil >= 1:0.2.0-1						\
a0656a4
Provides: shim-signed-%{-a*} = %{version}-%{release}			\
a0656a4
Requires: dbxtool >= 0.6-3						\
a0656a4
%{expand:%%if 0%%{-p*}							\
a0656a4
Provides: shim = %{version}-%{release}					\
a0656a4
Provides: shim-signed = %{version}-%{release}				\
a0656a4
Obsoletes: shim-signed < %{version}-%{release}				\
a0656a4
Obsoletes: shim < %{version}-%{release}					\
a0656a4
%%endif}								\
a0656a4
# Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI	\
a0656a4
# is not compatible with SysV (there's no red zone under UEFI) and	\
a0656a4
# there isn't a POSIX-style C library.					\
a0656a4
# BuildRequires: OpenSSL						\
a0656a4
Provides: bundled(openssl) = 1.0.2j					\
a0656a4
									\
a0656a4
%{expand:%%description -n shim-%{-a*}}					\
a0656a4
Initial UEFI bootloader that handles chaining to a trusted full		\
a0656a4
bootloader under secure boot environments. This package contains the	\
a0656a4
version signed by the UEFI signing service.				\
a0656a4
%{nil}
a0656a4
a0656a4
%ifarch x86_64
a0656a4
%define_pkg -a x64 -p 1
a0656a4
%define_pkg -a ia32
a0656a4
%endif
a0656a4
%ifarch aarch64
a0656a4
%define_pkg -a aa64 -p 1
a0656a4
%endif
a0656a4
a0656a4
%prep
a0656a4
cd %{_builddir}
0abd456
rm -rf shim-%{version}
0abd456
mkdir shim-%{version}
a0656a4
a0656a4
%build
a0656a4
%define vendor_token_str %{expand:%%{nil}%%{?vendor_token_name:-t "%{vendor_token_name}"}}
a0656a4
%define vendor_cert_str %{expand:%%{!?vendor_cert_nickname:-c "Red Hat Test Certificate"}%%{?vendor_cert_nickname:-c "%%{vendor_cert_nickname}"}}
a0656a4
a0656a4
# -a <efiarch>
a0656a4
# -i <input>
a0656a4
%define hash(a:i:d:)							\
a0656a4
	pesign -i %{-i*} -h -P > shim.hash				\
a0656a4
	read file0 hash0 < shim.hash					\
a0656a4
	read file1 hash1 < %{-d*}/shim%{-a*}.hash			\
a0656a4
	if ! [ "$hash0" = "$hash1" ]; then				\
a0656a4
		echo Invalid signature\! > /dev/stderr			\
a0656a4
		echo $hash0 vs $hash1					\
a0656a4
		exit 1							\
a0656a4
	fi								\
a0656a4
	%{nil}
a0656a4
a0656a4
# -i <input>
a0656a4
# -o <output>
a0656a4
%define sign(i:o:)							\
a0656a4
	%{expand:%%pesign -s -i %{-i*} -o %{-o*}}			\
a0656a4
	%{nil}
a0656a4
a0656a4
# -b <binary prefix>
a0656a4
# -a <efiarch>
a0656a4
# -i <input>
a0656a4
%define distrosign(b:a:d:)						\
a0656a4
	cp -av %{-d*}/%{-b*}%{-a*}.efi %{-b*}%{-a*}-unsigned.efi	\
a0656a4
	%{expand:%%sign -i %{-b*}%{-a*}-unsigned.efi -o %{-b*}%{-a*}-signed.efi}\
a0656a4
	%{nil}
a0656a4
a0656a4
# -a <efiarch>
a0656a4
# -A <EFIARCH>
a0656a4
# -b <yes|no> # signed by this builder?
a0656a4
# -c <yes|no> # signed by UEFI CA?
a0656a4
# -i <shimARCH.efi>
a0656a4
%define define_build(a:A:b:c:i:d:)					\
a0656a4
if [ "%{-c*}" = "yes" ]; then						\
a0656a4
	%{expand:%%hash -i %{-i*} -a %{-a*} -d %{-d*}}			\
a0656a4
fi									\
a0656a4
cp %{-i*} shim%{-a*}.efi						\
a0656a4
if [ "%{-b*}" = "yes" ]; then						\
a0656a4
	%{expand:%%distrosign -b shim -a %{-a*} -d %{-d*}}		\
a0656a4
	mv shim%{-a*}-signed.efi shim%{-a*}-%{efidir}.efi		\
a0656a4
fi									\
99b1d68
if [ "%{-c*}" = "no" ]; then						\
a0656a4
	cp shim%{-a*}-%{efidir}.efi shim%{-a*}.efi			\
a0656a4
fi									\
a0656a4
%{expand:%%distrosign -b mm -a %{-a*} -d %{-d*}}			\
a0656a4
mv mm%{-a*}-signed.efi mm%{-a*}.efi					\
a0656a4
%{expand:%%distrosign -b fb -a %{-a*} -d %{-d*}}			\
a0656a4
mv fb%{-a*}-signed.efi fb%{-a*}.efi					\
a0656a4
rm -vf									\\\
a0656a4
	mm%{-a*}-unsigned.efi						\\\
a0656a4
	fb%{-a*}-unsigned.efi						\\\
a0656a4
	shim%{-a*}-unsigned.efi						\
a0656a4
%{nil}
a0656a4
0abd456
cd shim-%{version}
a0656a4
%ifarch aarch64
a0656a4
%define_build -a aa64 -A AA64 -i %{SOURCE10} -b yes -c no -d %{shimdiraa64}
a0656a4
%endif
a0656a4
%ifarch x86_64
a0656a4
%define_build -a ia32 -A IA32 -i %{SOURCE11} -b yes -c yes -d %{shimdiria32}
a0656a4
%define_build -a x64 -A X64 -i %{SOURCE12} -b yes -c yes -d %{shimdirx64}
a0656a4
%endif
a0656a4
a0656a4
%install
a0656a4
# -a <efiarch>
a0656a4
# -A <EFIARCH>
a0656a4
# -b <BOOTCSV>
a0656a4
%define do_install(a:A:b:)						\
a0656a4
install -m 0700 shim%{-a*}.efi						\\\
a0656a4
	$RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shim%{-a*}.efi		\
a0656a4
install -m 0700 shim%{-a*}-%{efidir}.efi				\\\
a0656a4
	$RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shim%{-a*}-%{efidir}.efi	\
a0656a4
install -m 0700 mm%{-a*}.efi						\\\
a0656a4
	$RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/mm%{-a*}.efi		\
a0656a4
install -m 0700 %{-b*}							\\\
a0656a4
	$RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/BOOT%{-A*}.CSV		\
a0656a4
install -m 0700 shim%{-a*}.efi						\\\
a0656a4
	$RPM_BUILD_ROOT/boot/efi/EFI/BOOT/BOOT%{-A*}.EFI		\
a0656a4
install -m 0700 fb%{-a*}.efi						\\\
a0656a4
	$RPM_BUILD_ROOT/boot/efi/EFI/BOOT/fb%{-a*}.efi			\
a0656a4
%nil
a0656a4
a0656a4
rm -rf $RPM_BUILD_ROOT
0abd456
cd shim-%{version}
a0656a4
install -D -d -m 0755 $RPM_BUILD_ROOT/boot/
a0656a4
install -D -d -m 0700 $RPM_BUILD_ROOT/boot/efi/
a0656a4
install -D -d -m 0700 $RPM_BUILD_ROOT/boot/efi/EFI/
a0656a4
install -D -d -m 0700 $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/
a0656a4
install -D -d -m 0700 $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/
a0656a4
a0656a4
%ifarch x86_64
a0656a4
%do_install -a x64 -A X64 -b %{SOURCE0}
a0656a4
%do_install -a ia32 -A IA32 -b %{SOURCE2}
a0656a4
install -m 0700 %{SOURCE2} $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/BOOT.CSV
a0656a4
install -m 0700 $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/mmx64.efi $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/MokManager.efi
a0656a4
install -m 0700 $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/fbx64.efi $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/fallback.efi
acc5812
#%%install -m 0700 %%{SOURCE12} $RPM_BUILD_ROOT/boot/efi/EFI/%%{efidir}/shim.efi
acc5812
install -m 0700 %{SOURCE13} $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shim.efi
acc5812
install -m 0700 %{SOURCE13} $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shimx64.efi
acc5812
install -m 0700 %{SOURCE13} $RPM_BUILD_ROOT/boot/efi/EFI/BOOT/BOOTX64.EFI
a0656a4
%endif
a0656a4
%ifarch aarch64
a0656a4
%do_install -a aa64 -A AA64 -b %{SOURCE1}
a0656a4
install -m 0700 %{SOURCE10} $RPM_BUILD_ROOT/boot/efi/EFI/%{efidir}/shim.efi
a0656a4
%endif
a0656a4
a0656a4
# -a <efiarch>
a0656a4
# -A <EFIARCH>
a0656a4
%define define_files(a:A:)						\
a0656a4
%{expand:%%files -n shim-%{-a*}}					\
a0656a4
%dir /boot/efi								\
a0656a4
%dir /boot/efi/EFI							\
a0656a4
%dir /boot/efi/EFI/BOOT							\
a0656a4
%dir /boot/efi/EFI/%{efidir}						\
a0656a4
/boot/efi/EFI/%{efidir}/*%{-a*}*.efi					\
a0656a4
/boot/efi/EFI/%{efidir}/BOOT%{-A*}.CSV					\
a0656a4
/boot/efi/EFI/BOOT/*%{-a*}.efi						\
a0656a4
/boot/efi/EFI/BOOT/*%{-A*}.EFI						\
a0656a4
%{nil}
a0656a4
a0656a4
%ifarch x86_64
a0656a4
%define_files -a x64 -A X64
a0656a4
/boot/efi/EFI/%{efidir}/BOOT.CSV
a0656a4
/boot/efi/EFI/%{efidir}/MokManager.efi
a0656a4
/boot/efi/EFI/%{efidir}/shim.efi
a0656a4
/boot/efi/EFI/BOOT/fallback.efi
a0656a4
a0656a4
%define_files -a ia32 -A IA32
a0656a4
%endif
a0656a4
%ifarch aarch64
a0656a4
%define_files -a aa64 -A AA64
a0656a4
/boot/efi/EFI/%{efidir}/shim.efi
a0656a4
%endif
a0656a4
a0656a4
%changelog
acc5812
* Tue Mar 06 2018 Peter Jones <pjones@redhat.com> - 13-5
acc5812
- Back off to the thing we had in 13-0.8 until I get new signatures.
acc5812
99b1d68
* Wed Feb 28 2018 Peter Jones <pjones@redhat.com> - 13-4
99b1d68
- Fix an inverted test that crept in in the signing macro.  (Woops.)
99b1d68
0abd456
* Wed Feb 28 2018 Peter Jones <pjones@redhat.com> - 13-2
0abd456
- Pivot the shim-signed package to be here.
0abd456
a0656a4
* Wed Nov 01 2017 Peter Jones <pjones@redhat.com> - 13-1
a0656a4
- Now with the actual signed 64-bit build of shim 13 for x64 as well.
a0656a4
- Make everything under /boot/efi be mode 0700, since that's what FAT will
a0656a4
  show anyway, so that rpm -V is correct.
a0656a4
  Resolves: rhbz#1508516
a0656a4
a0656a4
* Tue Oct 24 2017 Peter Jones <pjones@redhat.com> - 13-0.8
a0656a4
- Now with signed 32-bit x86 build.
a0656a4
  Related: rhbz#1474861
a0656a4
a0656a4
* Wed Oct 04 2017 Peter Jones <pjones@redhat.com> - 13-0.7
a0656a4
- Make /boot/efi/EFI/fedora/shim.efi still exist on aarch64 as well.
a0656a4
  Resolves: rhbz#1497854
a0656a4
a0656a4
* Tue Sep 19 2017 Peter Jones <pjones@redhat.com> - 13-0.6
a0656a4
- Fix binary format issue on Aarch64
a0656a4
  Resolves: rhbz#1489604
a0656a4
a0656a4
* Tue Sep 05 2017 Peter Jones <pjones@redhat.com> - 13-0.5
a0656a4
- Make /boot/efi/EFI/fedora/shim.efi still exist on x86_64, since some
a0656a4
  machines have boot entries that point to it.
a0656a4
a0656a4
* Tue Aug 29 2017 Peter Jones <pjones@redhat.com> - 13-0.4
a0656a4
- Make our provides not get silently ignore by rpmbuild...
a0656a4
a0656a4
* Fri Aug 25 2017 Peter Jones <pjones@redhat.com> - 13-0.3
a0656a4
- x64: use the new fbx64.efi and mm64.efi as fallback.efi and MokManager.efi
a0656a4
- Provide: "shim" in x64 and aa64 builds
a0656a4
a0656a4
* Thu Aug 24 2017 Peter Jones <pjones@redhat.com> - 13-0.2
a0656a4
- Obsolete old shim builds.
a0656a4
a0656a4
* Tue Aug 22 2017 Peter Jones <pjones@redhat.com> - 13-0.1
a0656a4
- Initial (partially unsigned) build for multi-arch support on x64/ia32.
a0656a4
a0656a4
* Thu Mar 23 2017 Petr Ĺ abata <contyk@redhat.com> - 0.8-9
a0656a4
- Re-enable dist tag for module builds
a0656a4
a0656a4
* Tue Feb 17 2015 Peter Jones <pjones@redhat.com> - 0.8-8
a0656a4
- Don't dual-sign shim-%%{efidir}.efi either.
a0656a4
  Resolves: rhbz#1184765
a0656a4
a0656a4
* Tue Feb 17 2015 Peter Jones <pjones@redhat.com> - 0.8-8
a0656a4
- Require dbxtool
a0656a4
a0656a4
* Wed Dec 17 2014 Peter Jones <pjones@redhat.com> - 0.8-7
a0656a4
- Wrong -signed changes got built for aarch64 last time, for dumb reasons.
a0656a4
  Related: rhbz#1170289
a0656a4
a0656a4
* Fri Dec 05 2014 Peter Jones <pjones@redhat.com> - 0.8-6
a0656a4
- Rebuild once more so we can use a different -unsigned version on different
a0656a4
  arches (because we can't tag a newer build into aarch64 without an x86
a0656a4
  update to match.)
a0656a4
  Related: rhbz#1170289
a0656a4
a0656a4
* Wed Dec 03 2014 Peter Jones <pjones@redhat.com> - 0.8-5
a0656a4
- Rebuild for aarch64 path fixes
a0656a4
  Related: rhbz#1170289
a0656a4
a0656a4
* Thu Oct 30 2014 Peter Jones <pjones@redhat.com> - 0.8-2
a0656a4
- Remove the dist tag so people don't complain about what it says.
a0656a4
a0656a4
* Fri Oct 24 2014 Peter Jones <pjones@redhat.com> - 0.8-1
a0656a4
- Update to shim 0.8
a0656a4
  rhbz#1148230
a0656a4
  rhbz#1148231
a0656a4
  rhbz#1148232
a0656a4
- Handle building on aarch64 as well
a0656a4
a0656a4
* Fri Jul 18 2014 Peter Jones <pjones@redhat.com> - 0.7-2
a0656a4
- Don't do multi-signing; too many machines screw up verification.
a0656a4
  Resolves: rhbz#1049749
a0656a4
a0656a4
* Wed Nov 13 2013 Peter Jones <pjones@redhat.com> - 0.7-1
a0656a4
- Update to shim 0.7
a0656a4
  Resolves: rhbz#1023767
a0656a4
a0656a4
* Thu Oct 24 2013 Peter Jones <pjones@redhat.com> - 0.5-1
a0656a4
- Update to shim 0.5
a0656a4
a0656a4
* Thu Jun 20 2013 Peter Jones <pjones@redhat.com> - 0.4-1
a0656a4
- Provide a fallback for uninitialized Boot#### and BootOrder
a0656a4
  Resolves: rhbz#963359
a0656a4
- Move all signing from shim-unsigned to here
a0656a4
- properly compare our generated hash from shim-unsigned with the hash of
a0656a4
  the signed binary (as opposed to doing it manually)
a0656a4
a0656a4
* Fri May 31 2013 Peter Jones <pjones@redhat.com> - 0.2-4.4
a0656a4
- Re-sign to get alignments that match the new specification.
a0656a4
  Resolves: rhbz#963361
a0656a4
a0656a4
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.2-4.3
a0656a4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
a0656a4
a0656a4
* Wed Jan 02 2013 Peter Jones <pjones@redhat.com> - 0.2-3.3
a0656a4
- Add obsoletes and provides for earlier shim-signed packages, to cover
a0656a4
  the package update cases where previous versions were installed.
a0656a4
  Related: rhbz#888026
a0656a4
a0656a4
* Mon Dec 17 2012 Peter Jones <pjones@redhat.com> - 0.2-3.2
a0656a4
- Make the shim-unsigned dep be on the subpackage.
a0656a4
a0656a4
* Sun Dec 16 2012 Peter Jones <pjones@redhat.com> - 0.2-3.1
a0656a4
- Rebuild to provide "shim" package directly instead of just as a Provides:
a0656a4
a0656a4
* Sat Dec 15 2012 Peter Jones <pjones@redhat.com> - 0.2-3
a0656a4
- Also provide shim-fedora.efi, signed only by the fedora signer.
a0656a4
- Fix the fedora signature on the result to actually be correct.
a0656a4
- Update for shim-unsigned 0.2-3
a0656a4
a0656a4
* Mon Dec 03 2012 Peter Jones <pjones@redhat.com> - 0.2-2
a0656a4
- Initial build