Skip to content

Prepare to support UKIs #523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arnaldo2792 merged 5 commits into from
Aug 14, 2026
Merged

Prepare to support UKIs #523

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
074c607
grub: provide bootloader(efi) capability
arnaldo2792 Aug 10, 2026
88a0581
shim: add systemd-boot subpackage
arnaldo2792 Aug 10, 2026
9098e59
kernel-6.1: drop libstub patch
arnaldo2792 Aug 11, 2026
dca8028
kernel-6.12: drop libstub patch
arnaldo2792 Aug 11, 2026
860c8d6
kernel-6.18: drop libstub patch
arnaldo2792 Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions packages/grub/grub.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,8 @@ BuildRequires: automake
BuildRequires: bison
BuildRequires: flex
BuildRequires: gettext-devel
Provides: %{_cross_os}bootloader(efi)
Conflicts: %{_cross_os}image-feature(uki-image)

%description
%{summary}.
Expand Down
33 changes: 0 additions & 33 deletions packages/kernel-6.1/1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch
View file
Open in desktop

This file was deleted.

2 changes: 0 additions & 2 deletions packages/kernel-6.1/kernel-6.1.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,8 +60,6 @@ Patch1004: 1004-af_unix-increase-default-max_dgram_qlen-to-512.patch
Patch1005: 1005-Revert-Revert-drm-fb_helper-improve-CONFIG_FB-depend.patch
# Backport patch to ensure NUL-terminated task->comm buffer
Patch1006: 1006-strscpy-write-destination-buffer-only-once.patch
# Disable incomplete measurement into PCR 9 on aarch64.
Patch1007: 1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch

BuildRequires: bc
BuildRequires: elfutils-devel
Expand Down
33 changes: 0 additions & 33 deletions packages/kernel-6.12/1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch
View file
Open in desktop

This file was deleted.

2 changes: 0 additions & 2 deletions packages/kernel-6.12/kernel-6.12.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,8 +70,6 @@ Patch1005: 1005-Lustre-cast-unsigned-long-to-pointer.patch
Patch1006: 1006-Select-prerequisites-for-gpu-drivers.patch
# Backport patch to ensure NUL-terminated task->comm buffer
Patch1007: 1007-strscpy-write-destination-buffer-only-once.patch
# Disable incomplete measurement into PCR 9 on aarch64.
Patch1008: 1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch
Patch1009: 1009-Revert-selinux-fix-overlayfs-mmap-and-mprotect-acces.patch

BuildRequires: bc
Expand Down
36 changes: 0 additions & 36 deletions packages/kernel-6.18/1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch
View file
Open in desktop

This file was deleted.

2 changes: 0 additions & 2 deletions packages/kernel-6.18/kernel-6.18.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,8 +79,6 @@ Patch1003: 1003-initramfs-unlink-INITRAMFS_FORCE-from-CMDLINE_-EXTEN.patch
Patch1004: 1004-af_unix-increase-default-max_dgram_qlen-to-512.patch
# Select prerequisites for GPU drivers.
Patch1005: 1005-drm-simpledrm-Select-prerequisites-for-gpu-drivers.patch
# Disable incomplete measurement into PCR 9 on aarch64.
Patch1006: 1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch
Patch1007: 1007-Revert-selinux-fix-overlayfs-mmap-and-mprotect-acces.patch
# Fix incorrect FIPS crypto module path for x86_64 builds.
Patch1008: 1008-kbuild-use-SRCARCH-in-crypto-module-folders.patch
Expand Down
74 changes: 64 additions & 10 deletions packages/shim/shim.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,14 @@
%global __strip %{_bindir}/true

%global efidir /boot/efi/EFI/BOOT
%global boot_efi_image boot%{_cross_efi_arch}.efi
%global grub_efi_image grub%{_cross_efi_arch}.efi
%global systemd_boot_efi_image systemd-boot%{_cross_efi_arch}.efi
%global shim_systemd_boot_efi_image shim-%{systemd_boot_efi_image}
%global shim_efi_image shim%{_cross_efi_arch}.efi
%global mokm_efi_image mm%{_cross_efi_arch}.efi

%global boot_efi_image boot%{_cross_efi_arch}.efi

%global shimver 16.0
%global commit 18d98bfb34be583a5fe2987542e4b15e0db9cb61

Expand All @@ -20,9 +23,41 @@ Source0: https://github.com/rhboot/shim/releases/download/%{shimver}/shim-%{shim
Source1: https://github.com/rhboot/shim/releases/download/%{shimver}/shim-%{shimver}.tar.bz2.asc
Source2: gpgkey-8107B101A432AAC9FE8E547CA348D61BC2713E9F.asc

Requires: %{name}(shim-efi)

%description
%{summary}.

%package grub
Summary: Shim built to chain-load GRUB
# Avoid explicit image-feature(no-uki-image) requires for backwards compatibility
# The conflict is enough for now to prevent installing GRUB when UKIs are used
Comment thread
ginglis13 marked this conversation as resolved.
Requires: %{name}
# The epoch here is a tie-breaker signaling this subpackage is the default
# shim-efi provider; selection is actually enforced by the Conflicts below.
Provides: %{name}(shim-efi) = 1:
Conflicts: %{_cross_os}image-feature(uki-image)
# Mutually exclusive with other shim providers
Conflicts: %{name}(shim-efi)

%description grub
%{summary}.

%package systemd-boot
Summary: Shim built to chain-load systemd-boot
Requires: %{name}
Requires: %{_cross_os}image-feature(uki-image)
# The epoch here is a tie-breaker signaling this subpackage is not the
# default shim-efi provider; selection is actually enforced by the
# Requires/Conflicts below.
Provides: %{name}(shim-efi) = 0:
Comment thread
jmt-lab marked this conversation as resolved.
Conflicts: %{_cross_os}image-feature(no-uki-image)
# Mutually exclusive with other shim providers
Conflicts: %{name}(shim-efi)

%description systemd-boot
%{summary}.
Comment thread
jmt-lab marked this conversation as resolved.

%prep
%{gpgverify} --data=%{S:0} --signature=%{S:1} --keyring=%{S:2}
%autosetup -n shim-%{shimver} -p1
Expand All @@ -38,7 +73,6 @@ make\\\
CROSS_COMPILE="%{_cross_target}-"\\\
COMMIT_ID="%{commit}"\\\
RELEASE="%{release}"\\\
DEFAULT_LOADER="%{grub_efi_image}"\\\
DISABLE_REMOVABLE_LOAD_OPTIONS=y\\\
DESTDIR="%{buildroot}"\\\
EFIDIR="BOOT"\\\
Expand All @@ -47,20 +81,40 @@ make\\\
%{nil}

%build
%shim_make
# Build shim twice using separate source-tree copies. Building in-tree ensures
# DEFAULT_LOADER propagates correctly to the preprocessor defines.
cp -a %{_builddir}/shim-%{shimver} %{_builddir}/build-grub
cp -a %{_builddir}/shim-%{shimver} %{_builddir}/build-systemd-boot

cd %{_builddir}/build-grub
%shim_make DEFAULT_LOADER="%{grub_efi_image}"

cd %{_builddir}/build-systemd-boot
%shim_make DEFAULT_LOADER="%{systemd_boot_efi_image}"

%install
%shim_make install-as-data
install -d %{buildroot}%{efidir}
find %{buildroot}%{_datadir} -name '%{shim_efi_image}' -exec \
mv {} "%{buildroot}%{efidir}/%{boot_efi_image}" \;
find %{buildroot}%{_datadir} -name '%{mokm_efi_image}' -exec \
mv {} "%{buildroot}%{efidir}/%{mokm_efi_image}" \;
rm -rf %{buildroot}%{_datadir}

# Install grub-chaining shim at the default boot path, for backwards
# compatibility with image builds that expect to find it there.
find %{_builddir}/build-grub -name '%{shim_efi_image}' -exec \
cp {} "%{buildroot}%{efidir}/%{boot_efi_image}" \;
Comment thread
ginglis13 marked this conversation as resolved.

find %{_builddir}/build-systemd-boot -name '%{shim_efi_image}' -exec \
cp {} "%{buildroot}%{efidir}/%{shim_systemd_boot_efi_image}" \;

# MokManager is not affected by DEFAULT_LOADER; either build tree is fine.
find %{_builddir}/build-grub -name '%{mokm_efi_image}' -exec \
cp {} "%{buildroot}%{efidir}/%{mokm_efi_image}" \;
Comment on lines +107 to +108

@jmt-lab jmt-lab Aug 12, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P2] MokManager is copied only from build-grub but shipped in the base package

%install copies mm*.efi exclusively out of the build-grub tree, and the resulting file is packaged in the base %files list (line 104), which is installed alongside both subpackages.

Concerns:

  1. Asymmetric build coupling. MokManager doesn't depend on DEFAULT_LOADER, so both build trees produce it. Sourcing it only from build-grub couples the base package to that specific build. If a follow-up PR conditionally disables the grub build for UKI-only variants (e.g., wraps lines 77, 80-81 in %if !%{uki_only}), the base %files list still references %{efidir}/%{mokm_efi_image} and the build breaks non-obviously.
  2. find … -exec cp doesn't signal 'no match'. find returns 0 whether or not it matched. If the grub build silently stops producing mm*.efi in the future, the failure surfaces later at %files ("File not found") rather than at the copy step.

Suggested fix: either copy mm*.efi from build-systemd-boot (identical bits, decoupled from the grub build) or add a brief comment stating that MokManager is loader-independent and either build tree is acceptable, e.g.:

# MokManager is not affected by DEFAULT_LOADER; either build tree is fine.
find %{_builddir}/build-grub -name '%{mokm_efi_image}' -exec \
  cp {} "%{buildroot}%{efidir}/%{mokm_efi_image}" \;

Confidence: ~60%.


%files
%license COPYRIGHT
%{_cross_attribution_file}
%dir %{efidir}
%{efidir}/%{boot_efi_image}
%{efidir}/%{mokm_efi_image}

%files grub
%{efidir}/%{boot_efi_image}

%files systemd-boot
%{efidir}/%{shim_systemd_boot_efi_image}
Loading