From 15d71e0b34b2e43bee98a93fec8c538686e36670 Mon Sep 17 00:00:00 2001 From: Lynsey Rydberg Date: Mon, 27 Jul 2026 12:48:47 -0700 Subject: [PATCH] feat(fwupd-efi): add AZL SBAT line, keep upstream provenance Add a fwupd-efi.azurelinux SBAT entry to fwupdx64/fwupdaa64.efi so the binary is identifiable in a Secure Boot revocation, as required for shim-review submission (AB#20493). fwupd-efi generates its SBAT section at build time via efi/generate_sbat.py, which emits exactly one distro line from the meson -Defi_sbat_distro_* options. Retarget that single slot to azurelinux so the sanctioned generator emits the critical vendor line, then re-inject the upstream Fedora provenance line via objcopy in %install (before %pesign, so the signature covers the final .sbat). --- base/comps/components.toml | 1 - base/comps/fwupd-efi/fwupd-efi.comp.toml | 63 ++++++++++++++++++++++++ locks/fwupd-efi.lock | 2 +- specs/f/fwupd-efi/fwupd-efi.spec | 25 ++++++++-- 4 files changed, 85 insertions(+), 6 deletions(-) create mode 100644 base/comps/fwupd-efi/fwupd-efi.comp.toml diff --git a/base/comps/components.toml b/base/comps/components.toml index db67074f80b..c9264154241 100644 --- a/base/comps/components.toml +++ b/base/comps/components.toml @@ -480,7 +480,6 @@ includes = ["**/*.comp.toml", "component-bootstrap-uucore-pin.toml", "component- [components.fuse-overlayfs] [components.fusesource-pom] [components.fwupd] -[components.fwupd-efi] [components.fxdiv] [components.fxload] [components.galera] diff --git a/base/comps/fwupd-efi/fwupd-efi.comp.toml b/base/comps/fwupd-efi/fwupd-efi.comp.toml new file mode 100644 index 00000000000..b939c22484c --- /dev/null +++ b/base/comps/fwupd-efi/fwupd-efi.comp.toml @@ -0,0 +1,63 @@ +[components.fwupd-efi] + +# SBAT (AB#20493): add an Azure Linux vendor line to the fwupd EFI binary. +# +# fwupd-efi has no sbat.csv.in; its .sbat section is generated at build time by +# efi/generate_sbat.py, which emits exactly one downstream "distro" line from the +# -Defi_sbat_distro_* meson options (upstream ships that slot as "fedora"). There +# is no meson knob for a second distro line. +# +# Azure Linux is the distributor, so we retarget that slot to azurelinux -- the +# sanctioned build path then emits the fwupd-efi.azurelinux line natively. We then +# re-insert the upstream Fedora provenance line onto the finished binary with +# objcopy, ahead of the azurelinux line, mirroring grub2 (grub.rh before +# grub.azurelinux). SBAT ordering is not functionally significant. + +# Preserve the upstream Fedora provenance SBAT line as a macro (single source of +# truth for the objcopy step below). +[[components.fwupd-efi.overlays]] +description = "SBAT: define the interim upstream-EVR macro and the Fedora provenance line" +type = "spec-search-replace" +regex = '%global debug_package %\{nil\}' +replacement = '''%global debug_package %{nil} + +# Interim upstream-EVR macro, pinned to the Fedora fwupd-efi NEVR we import from +# (fwupd-efi-1.8-1.fc43). The provenance line below must carry the *upstream* +# EVR, not the Azure Linux one; swap this for the azldev upstream-EVR macro once +# bug 21798 lands (mirrors grub2's upstream_version_release). +%global upstream_version_release 1.8-1.fc43 + +# Upstream Fedora provenance SBAT line, preserved for revocation lineage (AB#20493). +%global sbat_fedora_line fwupd-efi.fedora,1,The Fedora Project,fwupd-efi,%{upstream_version_release},https://src.fedoraproject.org/rpms/fwupd-efi''' + +# Retarget the single meson distro SBAT slot from Fedora to Azure Linux. +[[components.fwupd-efi.overlays]] +description = "SBAT: retarget meson distro id to azurelinux" +type = "spec-search-replace" +regex = '-Defi_sbat_distro_id="fedora"' +replacement = '-Defi_sbat_distro_id="azurelinux"' + +[[components.fwupd-efi.overlays]] +description = "SBAT: retarget meson distro summary to Microsoft" +type = "spec-search-replace" +regex = '-Defi_sbat_distro_summary="The Fedora Project"' +replacement = '-Defi_sbat_distro_summary="Microsoft"' + +[[components.fwupd-efi.overlays]] +description = "SBAT: retarget meson distro url to the Azure Linux repo" +type = "spec-search-replace" +regex = '-Defi_sbat_distro_url="https://src\.fedoraproject\.org/rpms/%\{name\}"' +replacement = '-Defi_sbat_distro_url="https://github.com/microsoft/azurelinux/issues"' + +# Re-insert the Fedora provenance line ahead of the azurelinux line, before signing +# so the pesign signature covers the final .sbat section. +[[components.fwupd-efi.overlays]] +description = "SBAT: re-inject the Fedora provenance line via objcopy before pesign" +type = "spec-search-replace" +regex = '%pesign -s -i %\{fwup_efi_fn\} -o %\{fwup_efi_fn\}\.tmp' +replacement = '''# Re-inject the upstream Fedora provenance SBAT line, ahead of the azurelinux line +# emitted by the meson distro slot (AB#20493). +objcopy --dump-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn} +sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-sbat.csv +objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn} +%pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp''' diff --git a/locks/fwupd-efi.lock b/locks/fwupd-efi.lock index 3258ee1e0d3..833908fe6c8 100644 --- a/locks/fwupd-efi.lock +++ b/locks/fwupd-efi.lock @@ -2,5 +2,5 @@ version = 1 import-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7' upstream-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7' -input-fingerprint = 'sha256:7005a8f4b249e1dd46d19fd23dd86b4a42b4e315c5f68c0d750b00ab417f7612' +input-fingerprint = 'sha256:85f46532d25fe03c80cbefb79afa43c01e2644df55f3a9432ccbe1aa9c038ba1' resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e' diff --git a/specs/f/fwupd-efi/fwupd-efi.spec b/specs/f/fwupd-efi/fwupd-efi.spec index bf41062e867..10f0f908307 100644 --- a/specs/f/fwupd-efi/fwupd-efi.spec +++ b/specs/f/fwupd-efi/fwupd-efi.spec @@ -2,7 +2,7 @@ ## (rpmautospec version 0.8.3) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: - release_number = 2; + release_number = 3; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} @@ -13,6 +13,15 @@ %global debug_package %{nil} +# Interim upstream-EVR macro, pinned to the Fedora fwupd-efi NEVR we import from +# (fwupd-efi-1.8-1.fc43). The provenance line below must carry the *upstream* +# EVR, not the Azure Linux one; swap this for the azldev upstream-EVR macro once +# bug 21798 lands (mirrors grub2's upstream_version_release). +%global upstream_version_release 1.8-1.fc43 + +# Upstream Fedora provenance SBAT line, preserved for revocation lineage (AB#20493). +%global sbat_fedora_line fwupd-efi.fedora,1,The Fedora Project,fwupd-efi,%{upstream_version_release},https://src.fedoraproject.org/rpms/fwupd-efi + Summary: Firmware update EFI binaries Name: fwupd-efi Version: 1.8 @@ -41,11 +50,11 @@ the EFI binary that is used for updating using UpdateCapsule. %meson \ -Dgenpeimg=disabled \ - -Defi_sbat_distro_id="fedora" \ - -Defi_sbat_distro_summary="The Fedora Project" \ + -Defi_sbat_distro_id="azurelinux" \ + -Defi_sbat_distro_summary="Microsoft" \ -Defi_sbat_distro_pkgname="%{name}" \ -Defi_sbat_distro_version="%{version}-%{release}" \ - -Defi_sbat_distro_url="https://src.fedoraproject.org/rpms/%{name}" + -Defi_sbat_distro_url="https://github.com/microsoft/azurelinux/issues" %meson_build @@ -60,6 +69,11 @@ the EFI binary that is used for updating using UpdateCapsule. %global efiarch aa64 %endif %global fwup_efi_fn $RPM_BUILD_ROOT%{_libexecdir}/fwupd/efi/fwupd%{efiarch}.efi +# Re-inject the upstream Fedora provenance SBAT line, ahead of the azurelinux line +# emitted by the meson distro slot (AB#20493). +objcopy --dump-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn} +sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-sbat.csv +objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn} %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp %define __pesign_client_cert fwupd-signer %pesign -s -i %{fwup_efi_fn}.tmp -o %{fwup_efi_fn}.signed @@ -75,6 +89,9 @@ rm -vf %{fwup_efi_fn}.tmp %changelog ## START: Generated by rpmautospec +* Mon Jul 27 2026 Lynsey Rydberg - 1.8-3 +- feat(fwupd-efi): add AZL SBAT line, keep upstream provenance + * Thu Apr 30 2026 Daniel McIlvaney - 1.8-2 - feat: introduce deterministic commit resolution via Azure Linux lock file