Update shim to v15.8#10995
Merged
chalamalasetty merged 22 commits into3.0-devfrom Nov 22, 2024
Merged
Conversation
Also include temporary *unsigned* shim efi files to make toolkit happy...this won't be usable with secure boot until the upstream shim review(s) are complete
The shim and grub2 need to coordinate their location at %{efidir}
instead of BOOT, so require the proper versions together using
Conflicts:
Signed-off-by: Chris Co <chrco@microsoft.com>
Signed-off-by: Chris Co <chrco@microsoft.com>
Dropping change for package name to include -%{efiarch} in order to
maintain compatibility with current shim package naming
Will look to update naming in the next major OS release
Signed-off-by: Chris Co <chrco@microsoft.com>
These shimaa64.efi and shimx64.efi binaries are signed with the MS UEFI CA for general secure boot use Signed-off-by: Chris Co <chrco@microsoft.com>
Signed-off-by: Chris Co <chrco@microsoft.com>
Signed-off-by: Chris Co <chrco@microsoft.com>
Signed-off-by: Chris Co <chrco@microsoft.com>
In order to preserve consistency with our Azure Linux 3.0 preview and prior versions of Azure Linux, keep the locations of the binaries in EFI\BOOT and do not supply a fallback.efi. This means we should expect the ESP partition to look like: . ├── EFI │ ├── BOOT │ │ ├── bootx64.efi (which is shimx64.efi) │ │ ├── grubx64.efi │ │ ├── mmx64.efi We will re-evaluate this behavior again for the next major OS release. Signed-off-by: Chris Co <chrco@microsoft.com>
Signed-off-by: Chris Co <chrco@microsoft.com>
Signed-off-by: Chris Co <chrco@microsoft.com>
Signed-off-by: Chris Co <chrco@microsoft.com>
Signed-off-by: Chris Co <chrco@microsoft.com>
Signed-off-by: Chris Co <chrco@microsoft.com>
christopherco
force-pushed
the
chrco/shim-15-8-only
branch
from
546dfb7 to
21d6fee
Compare
manuelh-dev
reviewed
Nov 12, 2024
| %global zdpd 0%{dotpre}. | ||
| %endif | ||
|
|
||
| %global efidir azurelinux |
Contributor
There was a problem hiding this comment.
Just a q: Here, for the aarch64 case, we intentionally want azurelinux?
Contributor
There was a problem hiding this comment.
Both shim-unsigned-x64.spec and shim-unsigned-aarch64.spec use %global efidir azurelinux. Unclear if this is still intentional as it matches how other distros offer shim but does not match our shim.spec now.
Our actual signed shim rpm (from shim.spec) still uses the old file paths /boot/efi/EFI/BOOT/boot{arch}.efi as of commit 93c34aa
manuelh-dev
reviewed
Nov 12, 2024
manuelh-dev
reviewed
Nov 12, 2024
| Source2: %{dbxfile} | ||
| %endif | ||
| Source3: sbat.azurelinux.csv | ||
| Source4: shim.patches |
Contributor
There was a problem hiding this comment.
Renders empty to me. Probably want to list the patch files listed above. I know the PR is not ready for review. Just pre-emptively iterating over it.
Contributor
There was a problem hiding this comment.
None of the patches required any more due to version bumps, thus empty?
Contributor
There was a problem hiding this comment.
looks to be an artifact from using the fedora spec :) 73c0c00
12 tasks
jslobodzian
approved these changes
Nov 22, 2024
durgajagadeesh
pushed a commit
to durgajagadeesh/azurelinux_djpalli
that referenced
this pull request
Dec 31, 2024
Signed-off-by: Chris Co <chrco@microsoft.com> Co-authored-by: Dan Streetman <ddstreet@ieee.org> Co-authored-by: Dan Streetman <ddstreet@microsoft.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge Checklist
All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)
*-staticsubpackages, etc.) have had theirReleasetag incremented../cgmanifest.json,./toolkit/scripts/toolchain/cgmanifest.json,.github/workflows/cgmanifest.json)./LICENSES-AND-NOTICES/SPECS/data/licenses.json,./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md,./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)*.signatures.jsonfilessudo make go-tidy-allandsudo make go-test-coveragepassSummary
Update the Azure Linux 3.0 shim to the latest version v15.8.
This change also adds MOK Manager (mm) support for allowing users to enroll their own keys into the system.
We do build fallback.efi as well, but for Azure Linux 3.0, we will not be utilizing it in order to keep consistency with our 3.0 preview and previous offerings. We will re-evaluate bringing in fallback.efi in the next major OS release.
Additionally, this new shim embeds our updated Azure Linux Trusted Base CA certificate.
This update also includes the signed shim and mm binaries into the "shim" package for wider use.
We also deprecate the previous "shim-unsigned" package as it is no longer needed, and we update the references in the ARM64 image definitions to the "shim" package.
Finally, the change bumps the grub package to ensure it gets signed with the newer key and the RPM dependencies are set such that this shim and grub should update together.
Signed-off-by: Chris Co chrco@microsoft.com
Does this affect the toolchain?
NO
Associated issues
Test Methodology