From 074c6076c586adf086b7facf770509756cf520bc Mon Sep 17 00:00:00 2001 From: Arnaldo Garcia Rincon Date: Mon, 10 Aug 2026 22:28:16 +0000 Subject: [PATCH 1/5] grub: provide bootloader(efi) capability Provide the bootloader(efi) RPM capability so newer versions of twoliter and the core kit, which support UKI, can depend on it to select GRUB as the EFI bootloader. Conflict with the uki-image feature, since UKI images require systemd-boot instead of GRUB. Signed-off-by: Arnaldo Garcia Rincon --- packages/grub/grub.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/packages/grub/grub.spec b/packages/grub/grub.spec index 7a74cb11..6943c210 100644 --- a/packages/grub/grub.spec +++ b/packages/grub/grub.spec @@ -74,6 +74,8 @@ BuildRequires: automake BuildRequires: bison BuildRequires: flex BuildRequires: gettext-devel +Provides: %{_cross_os}bootloader(efi) +Conflicts: %{_cross_os}image-feature(uki-image) %description %{summary}. From 88a0581528a5250b02a95d8ad25a01d1bb703672 Mon Sep 17 00:00:00 2001 From: Arnaldo Garcia Rincon Date: Mon, 10 Aug 2026 22:35:30 +0000 Subject: [PATCH 2/5] shim: add systemd-boot subpackage Split shim into two subpackages: one that chain-loads GRUB (installed at the current location, for backwards compatibility) and a new one that chain-loads systemd-boot instead. Older versions of twoliter don't understand the 'uki-image' feature, so the GRUB subpackage's requirements are left unrestricted to remain installable there. To prevent it from being pulled in on UKI images with newer twoliter versions, it instead conflicts with the uki-image feature; the systemd-boot subpackage conflicts with no-uki-image accordingly. Signed-off-by: Arnaldo Garcia Rincon --- packages/shim/shim.spec | 74 +++++++++++++++++++++++++++++++++++------ 1 file changed, 64 insertions(+), 10 deletions(-) diff --git a/packages/shim/shim.spec b/packages/shim/shim.spec index 1dd193b3..d6ff73e0 100644 --- a/packages/shim/shim.spec +++ b/packages/shim/shim.spec @@ -2,11 +2,14 @@ %global __strip %{_bindir}/true %global efidir /boot/efi/EFI/BOOT -%global boot_efi_image boot%{_cross_efi_arch}.efi %global grub_efi_image grub%{_cross_efi_arch}.efi +%global systemd_boot_efi_image systemd-boot%{_cross_efi_arch}.efi +%global shim_systemd_boot_efi_image shim-%{systemd_boot_efi_image} %global shim_efi_image shim%{_cross_efi_arch}.efi %global mokm_efi_image mm%{_cross_efi_arch}.efi +%global boot_efi_image boot%{_cross_efi_arch}.efi + %global shimver 16.0 %global commit 18d98bfb34be583a5fe2987542e4b15e0db9cb61 @@ -20,9 +23,41 @@ Source0: https://github.com/rhboot/shim/releases/download/%{shimver}/shim-%{shim Source1: https://github.com/rhboot/shim/releases/download/%{shimver}/shim-%{shimver}.tar.bz2.asc Source2: gpgkey-8107B101A432AAC9FE8E547CA348D61BC2713E9F.asc +Requires: %{name}(shim-efi) + %description %{summary}. +%package grub +Summary: Shim built to chain-load GRUB +# Avoid explicit image-feature(no-uki-image) requires for backwards compatibility +# The conflict is enough for now to prevent installing GRUB when UKIs are used +Requires: %{name} +# The epoch here is a tie-breaker signaling this subpackage is the default +# shim-efi provider; selection is actually enforced by the Conflicts below. +Provides: %{name}(shim-efi) = 1: +Conflicts: %{_cross_os}image-feature(uki-image) +# Mutually exclusive with other shim providers +Conflicts: %{name}(shim-efi) + +%description grub +%{summary}. + +%package systemd-boot +Summary: Shim built to chain-load systemd-boot +Requires: %{name} +Requires: %{_cross_os}image-feature(uki-image) +# The epoch here is a tie-breaker signaling this subpackage is not the +# default shim-efi provider; selection is actually enforced by the +# Requires/Conflicts below. +Provides: %{name}(shim-efi) = 0: +Conflicts: %{_cross_os}image-feature(no-uki-image) +# Mutually exclusive with other shim providers +Conflicts: %{name}(shim-efi) + +%description systemd-boot +%{summary}. + %prep %{gpgverify} --data=%{S:0} --signature=%{S:1} --keyring=%{S:2} %autosetup -n shim-%{shimver} -p1 @@ -38,7 +73,6 @@ make\\\ CROSS_COMPILE="%{_cross_target}-"\\\ COMMIT_ID="%{commit}"\\\ RELEASE="%{release}"\\\ - DEFAULT_LOADER="%{grub_efi_image}"\\\ DISABLE_REMOVABLE_LOAD_OPTIONS=y\\\ DESTDIR="%{buildroot}"\\\ EFIDIR="BOOT"\\\ @@ -47,20 +81,40 @@ make\\\ %{nil} %build -%shim_make +# Build shim twice using separate source-tree copies. Building in-tree ensures +# DEFAULT_LOADER propagates correctly to the preprocessor defines. +cp -a %{_builddir}/shim-%{shimver} %{_builddir}/build-grub +cp -a %{_builddir}/shim-%{shimver} %{_builddir}/build-systemd-boot + +cd %{_builddir}/build-grub +%shim_make DEFAULT_LOADER="%{grub_efi_image}" + +cd %{_builddir}/build-systemd-boot +%shim_make DEFAULT_LOADER="%{systemd_boot_efi_image}" %install -%shim_make install-as-data install -d %{buildroot}%{efidir} -find %{buildroot}%{_datadir} -name '%{shim_efi_image}' -exec \ - mv {} "%{buildroot}%{efidir}/%{boot_efi_image}" \; -find %{buildroot}%{_datadir} -name '%{mokm_efi_image}' -exec \ - mv {} "%{buildroot}%{efidir}/%{mokm_efi_image}" \; -rm -rf %{buildroot}%{_datadir} + +# Install grub-chaining shim at the default boot path, for backwards +# compatibility with image builds that expect to find it there. +find %{_builddir}/build-grub -name '%{shim_efi_image}' -exec \ + cp {} "%{buildroot}%{efidir}/%{boot_efi_image}" \; + +find %{_builddir}/build-systemd-boot -name '%{shim_efi_image}' -exec \ + cp {} "%{buildroot}%{efidir}/%{shim_systemd_boot_efi_image}" \; + +# MokManager is not affected by DEFAULT_LOADER; either build tree is fine. +find %{_builddir}/build-grub -name '%{mokm_efi_image}' -exec \ + cp {} "%{buildroot}%{efidir}/%{mokm_efi_image}" \; %files %license COPYRIGHT %{_cross_attribution_file} %dir %{efidir} -%{efidir}/%{boot_efi_image} %{efidir}/%{mokm_efi_image} + +%files grub +%{efidir}/%{boot_efi_image} + +%files systemd-boot +%{efidir}/%{shim_systemd_boot_efi_image} From 9098e5935560fbeaec0ce3765cc5e3c620a69bac Mon Sep 17 00:00:00 2001 From: Arnaldo Garcia Rincon Date: Tue, 11 Aug 2026 00:23:36 +0000 Subject: [PATCH 3/5] kernel-6.1: drop libstub patch The patch prevented systemd-boot from measuring PCR9 Signed-off-by: Arnaldo Garcia Rincon --- ...t-measure-kernel-command-line-into-P.patch | 33 ------------------- packages/kernel-6.1/kernel-6.1.spec | 2 -- 2 files changed, 35 deletions(-) delete mode 100644 packages/kernel-6.1/1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch diff --git a/packages/kernel-6.1/1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch b/packages/kernel-6.1/1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch deleted file mode 100644 index 0e3a974c..00000000 --- a/packages/kernel-6.1/1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch +++ /dev/null @@ -1,33 +0,0 @@ -From fa0eefb655d457b24bdaffab3e7beb968faae223 Mon Sep 17 00:00:00 2001 -From: Ben Cressey -Date: Tue, 4 Nov 2025 16:42:55 +0000 -Subject: [PATCH] efi/libstub: don't measure kernel command line into PCR 9 - -The kernel command line can be extended via bootconfig, which may add -additional parameters but depends on initrd parsing that happens at a -later point in the boot. - -Disable the boot-time measurement so that the verified userspace can -perform a complete measurement later. - -Signed-off-by: Ben Cressey ---- - drivers/firmware/efi/libstub/efi-stub-helper.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c -index 587ba946ba9d..e932673f5209 100644 ---- a/drivers/firmware/efi/libstub/efi-stub-helper.c -+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c -@@ -431,9 +431,11 @@ char *efi_convert_cmdline(efi_loaded_image_t *image, int *cmd_line_len) - efi_status_t status; - u32 options_chars; - -+#if 0 - if (options_size > 0) - efi_measure_tagged_event((unsigned long)options, options_size, - EFISTUB_EVT_LOAD_OPTIONS); -+#endif - - efi_apply_loadoptions_quirk((const void **)&options, &options_size); - options_chars = options_size / sizeof(efi_char16_t); diff --git a/packages/kernel-6.1/kernel-6.1.spec b/packages/kernel-6.1/kernel-6.1.spec index 4797be8a..3526b44f 100644 --- a/packages/kernel-6.1/kernel-6.1.spec +++ b/packages/kernel-6.1/kernel-6.1.spec @@ -60,8 +60,6 @@ Patch1004: 1004-af_unix-increase-default-max_dgram_qlen-to-512.patch Patch1005: 1005-Revert-Revert-drm-fb_helper-improve-CONFIG_FB-depend.patch # Backport patch to ensure NUL-terminated task->comm buffer Patch1006: 1006-strscpy-write-destination-buffer-only-once.patch -# Disable incomplete measurement into PCR 9 on aarch64. -Patch1007: 1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch BuildRequires: bc BuildRequires: elfutils-devel From dca8028d2c0c7c37411232afc12e5c0cafa7d324 Mon Sep 17 00:00:00 2001 From: Arnaldo Garcia Rincon Date: Tue, 11 Aug 2026 00:23:47 +0000 Subject: [PATCH 4/5] kernel-6.12: drop libstub patch The patch prevented systemd-boot from measuring PCR9 Signed-off-by: Arnaldo Garcia Rincon --- ...t-measure-kernel-command-line-into-P.patch | 33 ------------------- packages/kernel-6.12/kernel-6.12.spec | 2 -- 2 files changed, 35 deletions(-) delete mode 100644 packages/kernel-6.12/1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch diff --git a/packages/kernel-6.12/1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch b/packages/kernel-6.12/1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch deleted file mode 100644 index 98798828..00000000 --- a/packages/kernel-6.12/1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 7582a3b837ddffaddf2a4121285464b8655fe4f0 Mon Sep 17 00:00:00 2001 -From: Ben Cressey -Date: Tue, 4 Nov 2025 16:42:55 +0000 -Subject: [PATCH] efi/libstub: don't measure kernel command line into PCR 9 - -The kernel command line can be extended via bootconfig, which may add -additional parameters but depends on initrd parsing that happens at a -later point in the boot. - -Disable the boot-time measurement so that the verified userspace can -perform a complete measurement later. - -Signed-off-by: Ben Cressey ---- - drivers/firmware/efi/libstub/efi-stub-helper.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c -index 1ad414da9920..f8363a5d31f7 100644 ---- a/drivers/firmware/efi/libstub/efi-stub-helper.c -+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c -@@ -338,9 +338,11 @@ char *efi_convert_cmdline(efi_loaded_image_t *image, int *cmd_line_len) - efi_status_t status; - u32 options_chars; - -+#if 0 - if (options_size > 0) - efi_measure_tagged_event((unsigned long)options, options_size, - EFISTUB_EVT_LOAD_OPTIONS); -+#endif - - efi_apply_loadoptions_quirk((const void **)&options, &options_size); - options_chars = options_size / sizeof(efi_char16_t); diff --git a/packages/kernel-6.12/kernel-6.12.spec b/packages/kernel-6.12/kernel-6.12.spec index f98c9699..1bc15063 100644 --- a/packages/kernel-6.12/kernel-6.12.spec +++ b/packages/kernel-6.12/kernel-6.12.spec @@ -70,8 +70,6 @@ Patch1005: 1005-Lustre-cast-unsigned-long-to-pointer.patch Patch1006: 1006-Select-prerequisites-for-gpu-drivers.patch # Backport patch to ensure NUL-terminated task->comm buffer Patch1007: 1007-strscpy-write-destination-buffer-only-once.patch -# Disable incomplete measurement into PCR 9 on aarch64. -Patch1008: 1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch Patch1009: 1009-Revert-selinux-fix-overlayfs-mmap-and-mprotect-acces.patch BuildRequires: bc From 860c8d606cd71f5ebcae3a9afd678476b132890e Mon Sep 17 00:00:00 2001 From: Arnaldo Garcia Rincon Date: Tue, 11 Aug 2026 00:23:57 +0000 Subject: [PATCH 5/5] kernel-6.18: drop libstub patch The patch prevented systemd-boot from measuring PCR9 Signed-off-by: Arnaldo Garcia Rincon --- ...t-measure-kernel-command-line-into-P.patch | 36 ------------------- packages/kernel-6.18/kernel-6.18.spec | 2 -- 2 files changed, 38 deletions(-) delete mode 100644 packages/kernel-6.18/1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch diff --git a/packages/kernel-6.18/1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch b/packages/kernel-6.18/1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch deleted file mode 100644 index 18001c2c..00000000 --- a/packages/kernel-6.18/1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 93833752160803593414c9184fa2aedd8f0187a5 Mon Sep 17 00:00:00 2001 -From: Ben Cressey -Date: Tue, 4 Nov 2025 16:42:55 +0000 -Subject: [PATCH] efi/libstub: don't measure kernel command line into PCR 9 - -The kernel command line can be extended via bootconfig, which may add -additional parameters but depends on initrd parsing that happens at a -later point in the boot. - -Disable the boot-time measurement so that the verified userspace can -perform a complete measurement later. - -Signed-off-by: Ben Cressey ---- - drivers/firmware/efi/libstub/efi-stub-helper.c | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/drivers/firmware/efi/libstub/efi-stub-helper.c b/drivers/firmware/efi/libstub/efi-stub-helper.c -index 7aa2f9ad2..eae369c1d 100644 ---- a/drivers/firmware/efi/libstub/efi-stub-helper.c -+++ b/drivers/firmware/efi/libstub/efi-stub-helper.c -@@ -337,9 +337,11 @@ char *efi_convert_cmdline(efi_loaded_image_t *image) - efi_status_t status; - u32 options_chars; - -+#if 0 - if (options_size > 0) - efi_measure_tagged_event((unsigned long)options, options_size, - EFISTUB_EVT_LOAD_OPTIONS); -+#endif - - efi_apply_loadoptions_quirk((const void **)&options, &options_size); - options_chars = options_size / sizeof(efi_char16_t); --- -2.50.1 - diff --git a/packages/kernel-6.18/kernel-6.18.spec b/packages/kernel-6.18/kernel-6.18.spec index 634d526d..1ef2b228 100644 --- a/packages/kernel-6.18/kernel-6.18.spec +++ b/packages/kernel-6.18/kernel-6.18.spec @@ -79,8 +79,6 @@ Patch1003: 1003-initramfs-unlink-INITRAMFS_FORCE-from-CMDLINE_-EXTEN.patch Patch1004: 1004-af_unix-increase-default-max_dgram_qlen-to-512.patch # Select prerequisites for GPU drivers. Patch1005: 1005-drm-simpledrm-Select-prerequisites-for-gpu-drivers.patch -# Disable incomplete measurement into PCR 9 on aarch64. -Patch1006: 1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch Patch1007: 1007-Revert-selinux-fix-overlayfs-mmap-and-mprotect-acces.patch # Fix incorrect FIPS crypto module path for x86_64 builds. Patch1008: 1008-kbuild-use-SRCARCH-in-crypto-module-folders.patch