diff --git a/packages/grub/grub.spec b/packages/grub/grub.spec index 7a74cb11b..6943c2102 100644 --- a/packages/grub/grub.spec +++ b/packages/grub/grub.spec @@ -74,6 +74,8 @@ BuildRequires: automake BuildRequires: bison BuildRequires: flex BuildRequires: gettext-devel +Provides: %{_cross_os}bootloader(efi) +Conflicts: %{_cross_os}image-feature(uki-image) %description %{summary}. diff --git a/packages/kernel-6.1/1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch b/packages/kernel-6.1/1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch deleted file mode 100644 index 0e3a974c2..000000000 --- a/packages/kernel-6.1/1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch +++ /dev/null @@ -1,33 +0,0 @@ -From fa0eefb655d457b24bdaffab3e7beb968faae223 Mon Sep 17 00:00:00 2001 -From: Ben Cressey -Date: Tue, 4 Nov 2025 16:42:55 +0000 -Subject: [PATCH] efi/libstub: don't measure kernel command line into PCR 9 - -The kernel command line can be extended via bootconfig, which may add -additional parameters but depends on initrd parsing that happens at a -later point in the boot. - -Disable the boot-time measurement so that the verified userspace can -perform a complete measurement later. - -Signed-off-by: Ben Cressey ---- - drivers/firmware/efi/libstub/efi-stub-helper.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c -index 587ba946ba9d..e932673f5209 100644 ---- a/drivers/firmware/efi/libstub/efi-stub-helper.c -+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c -@@ -431,9 +431,11 @@ char *efi_convert_cmdline(efi_loaded_image_t *image, int *cmd_line_len) - efi_status_t status; - u32 options_chars; - -+#if 0 - if (options_size > 0) - efi_measure_tagged_event((unsigned long)options, options_size, - EFISTUB_EVT_LOAD_OPTIONS); -+#endif - - efi_apply_loadoptions_quirk((const void **)&options, &options_size); - options_chars = options_size / sizeof(efi_char16_t); diff --git a/packages/kernel-6.1/kernel-6.1.spec b/packages/kernel-6.1/kernel-6.1.spec index 4797be8a0..3526b44fe 100644 --- a/packages/kernel-6.1/kernel-6.1.spec +++ b/packages/kernel-6.1/kernel-6.1.spec @@ -60,8 +60,6 @@ Patch1004: 1004-af_unix-increase-default-max_dgram_qlen-to-512.patch Patch1005: 1005-Revert-Revert-drm-fb_helper-improve-CONFIG_FB-depend.patch # Backport patch to ensure NUL-terminated task->comm buffer Patch1006: 1006-strscpy-write-destination-buffer-only-once.patch -# Disable incomplete measurement into PCR 9 on aarch64. -Patch1007: 1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch BuildRequires: bc BuildRequires: elfutils-devel diff --git a/packages/kernel-6.12/1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch b/packages/kernel-6.12/1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch deleted file mode 100644 index 987988285..000000000 --- a/packages/kernel-6.12/1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 7582a3b837ddffaddf2a4121285464b8655fe4f0 Mon Sep 17 00:00:00 2001 -From: Ben Cressey -Date: Tue, 4 Nov 2025 16:42:55 +0000 -Subject: [PATCH] efi/libstub: don't measure kernel command line into PCR 9 - -The kernel command line can be extended via bootconfig, which may add -additional parameters but depends on initrd parsing that happens at a -later point in the boot. - -Disable the boot-time measurement so that the verified userspace can -perform a complete measurement later. - -Signed-off-by: Ben Cressey ---- - drivers/firmware/efi/libstub/efi-stub-helper.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c -index 1ad414da9920..f8363a5d31f7 100644 ---- a/drivers/firmware/efi/libstub/efi-stub-helper.c -+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c -@@ -338,9 +338,11 @@ char *efi_convert_cmdline(efi_loaded_image_t *image, int *cmd_line_len) - efi_status_t status; - u32 options_chars; - -+#if 0 - if (options_size > 0) - efi_measure_tagged_event((unsigned long)options, options_size, - EFISTUB_EVT_LOAD_OPTIONS); -+#endif - - efi_apply_loadoptions_quirk((const void **)&options, &options_size); - options_chars = options_size / sizeof(efi_char16_t); diff --git a/packages/kernel-6.12/kernel-6.12.spec b/packages/kernel-6.12/kernel-6.12.spec index f98c9699c..1bc150631 100644 --- a/packages/kernel-6.12/kernel-6.12.spec +++ b/packages/kernel-6.12/kernel-6.12.spec @@ -70,8 +70,6 @@ Patch1005: 1005-Lustre-cast-unsigned-long-to-pointer.patch Patch1006: 1006-Select-prerequisites-for-gpu-drivers.patch # Backport patch to ensure NUL-terminated task->comm buffer Patch1007: 1007-strscpy-write-destination-buffer-only-once.patch -# Disable incomplete measurement into PCR 9 on aarch64. -Patch1008: 1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch Patch1009: 1009-Revert-selinux-fix-overlayfs-mmap-and-mprotect-acces.patch BuildRequires: bc diff --git a/packages/kernel-6.18/1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch b/packages/kernel-6.18/1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch deleted file mode 100644 index 18001c2c2..000000000 --- a/packages/kernel-6.18/1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 93833752160803593414c9184fa2aedd8f0187a5 Mon Sep 17 00:00:00 2001 -From: Ben Cressey -Date: Tue, 4 Nov 2025 16:42:55 +0000 -Subject: [PATCH] efi/libstub: don't measure kernel command line into PCR 9 - -The kernel command line can be extended via bootconfig, which may add -additional parameters but depends on initrd parsing that happens at a -later point in the boot. - -Disable the boot-time measurement so that the verified userspace can -perform a complete measurement later. - -Signed-off-by: Ben Cressey ---- - drivers/firmware/efi/libstub/efi-stub-helper.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c -index 7aa2f9ad2..eae369c1d 100644 ---- a/drivers/firmware/efi/libstub/efi-stub-helper.c -+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c -@@ -337,9 +337,11 @@ char *efi_convert_cmdline(efi_loaded_image_t *image) - efi_status_t status; - u32 options_chars; - -+#if 0 - if (options_size > 0) - efi_measure_tagged_event((unsigned long)options, options_size, - EFISTUB_EVT_LOAD_OPTIONS); -+#endif - - efi_apply_loadoptions_quirk((const void **)&options, &options_size); - options_chars = options_size / sizeof(efi_char16_t); --- -2.50.1 - diff --git a/packages/kernel-6.18/kernel-6.18.spec b/packages/kernel-6.18/kernel-6.18.spec index 634d526d5..1ef2b228a 100644 --- a/packages/kernel-6.18/kernel-6.18.spec +++ b/packages/kernel-6.18/kernel-6.18.spec @@ -79,8 +79,6 @@ Patch1003: 1003-initramfs-unlink-INITRAMFS_FORCE-from-CMDLINE_-EXTEN.patch Patch1004: 1004-af_unix-increase-default-max_dgram_qlen-to-512.patch # Select prerequisites for GPU drivers. Patch1005: 1005-drm-simpledrm-Select-prerequisites-for-gpu-drivers.patch -# Disable incomplete measurement into PCR 9 on aarch64. -Patch1006: 1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch Patch1007: 1007-Revert-selinux-fix-overlayfs-mmap-and-mprotect-acces.patch # Fix incorrect FIPS crypto module path for x86_64 builds. Patch1008: 1008-kbuild-use-SRCARCH-in-crypto-module-folders.patch diff --git a/packages/shim/shim.spec b/packages/shim/shim.spec index 1dd193b34..d6ff73e00 100644 --- a/packages/shim/shim.spec +++ b/packages/shim/shim.spec @@ -2,11 +2,14 @@ %global __strip %{_bindir}/true %global efidir /boot/efi/EFI/BOOT -%global boot_efi_image boot%{_cross_efi_arch}.efi %global grub_efi_image grub%{_cross_efi_arch}.efi +%global systemd_boot_efi_image systemd-boot%{_cross_efi_arch}.efi +%global shim_systemd_boot_efi_image shim-%{systemd_boot_efi_image} %global shim_efi_image shim%{_cross_efi_arch}.efi %global mokm_efi_image mm%{_cross_efi_arch}.efi +%global boot_efi_image boot%{_cross_efi_arch}.efi + %global shimver 16.0 %global commit 18d98bfb34be583a5fe2987542e4b15e0db9cb61 @@ -20,9 +23,41 @@ Source0: https://github.com/rhboot/shim/releases/download/%{shimver}/shim-%{shim Source1: https://github.com/rhboot/shim/releases/download/%{shimver}/shim-%{shimver}.tar.bz2.asc Source2: gpgkey-8107B101A432AAC9FE8E547CA348D61BC2713E9F.asc +Requires: %{name}(shim-efi) + %description %{summary}. +%package grub +Summary: Shim built to chain-load GRUB +# Avoid explicit image-feature(no-uki-image) requires for backwards compatibility +# The conflict is enough for now to prevent installing GRUB when UKIs are used +Requires: %{name} +# The epoch here is a tie-breaker signaling this subpackage is the default +# shim-efi provider; selection is actually enforced by the Conflicts below. +Provides: %{name}(shim-efi) = 1: +Conflicts: %{_cross_os}image-feature(uki-image) +# Mutually exclusive with other shim providers +Conflicts: %{name}(shim-efi) + +%description grub +%{summary}. + +%package systemd-boot +Summary: Shim built to chain-load systemd-boot +Requires: %{name} +Requires: %{_cross_os}image-feature(uki-image) +# The epoch here is a tie-breaker signaling this subpackage is not the +# default shim-efi provider; selection is actually enforced by the +# Requires/Conflicts below. +Provides: %{name}(shim-efi) = 0: +Conflicts: %{_cross_os}image-feature(no-uki-image) +# Mutually exclusive with other shim providers +Conflicts: %{name}(shim-efi) + +%description systemd-boot +%{summary}. + %prep %{gpgverify} --data=%{S:0} --signature=%{S:1} --keyring=%{S:2} %autosetup -n shim-%{shimver} -p1 @@ -38,7 +73,6 @@ make\\\ CROSS_COMPILE="%{_cross_target}-"\\\ COMMIT_ID="%{commit}"\\\ RELEASE="%{release}"\\\ - DEFAULT_LOADER="%{grub_efi_image}"\\\ DISABLE_REMOVABLE_LOAD_OPTIONS=y\\\ DESTDIR="%{buildroot}"\\\ EFIDIR="BOOT"\\\ @@ -47,20 +81,40 @@ make\\\ %{nil} %build -%shim_make +# Build shim twice using separate source-tree copies. Building in-tree ensures +# DEFAULT_LOADER propagates correctly to the preprocessor defines. +cp -a %{_builddir}/shim-%{shimver} %{_builddir}/build-grub +cp -a %{_builddir}/shim-%{shimver} %{_builddir}/build-systemd-boot + +cd %{_builddir}/build-grub +%shim_make DEFAULT_LOADER="%{grub_efi_image}" + +cd %{_builddir}/build-systemd-boot +%shim_make DEFAULT_LOADER="%{systemd_boot_efi_image}" %install -%shim_make install-as-data install -d %{buildroot}%{efidir} -find %{buildroot}%{_datadir} -name '%{shim_efi_image}' -exec \ - mv {} "%{buildroot}%{efidir}/%{boot_efi_image}" \; -find %{buildroot}%{_datadir} -name '%{mokm_efi_image}' -exec \ - mv {} "%{buildroot}%{efidir}/%{mokm_efi_image}" \; -rm -rf %{buildroot}%{_datadir} + +# Install grub-chaining shim at the default boot path, for backwards +# compatibility with image builds that expect to find it there. +find %{_builddir}/build-grub -name '%{shim_efi_image}' -exec \ + cp {} "%{buildroot}%{efidir}/%{boot_efi_image}" \; + +find %{_builddir}/build-systemd-boot -name '%{shim_efi_image}' -exec \ + cp {} "%{buildroot}%{efidir}/%{shim_systemd_boot_efi_image}" \; + +# MokManager is not affected by DEFAULT_LOADER; either build tree is fine. +find %{_builddir}/build-grub -name '%{mokm_efi_image}' -exec \ + cp {} "%{buildroot}%{efidir}/%{mokm_efi_image}" \; %files %license COPYRIGHT %{_cross_attribution_file} %dir %{efidir} -%{efidir}/%{boot_efi_image} %{efidir}/%{mokm_efi_image} + +%files grub +%{efidir}/%{boot_efi_image} + +%files systemd-boot +%{efidir}/%{shim_systemd_boot_efi_image}