feat(fwupd-efi): add AZL SBAT line, keep upstream provenance

base/comps/components.toml

@@ -480,7 +480,6 @@ includes = ["**/*.comp.toml", "component-bootstrap-uucore-pin.toml", "component-
 [components.fuse-overlayfs]
 [components.fusesource-pom]
 [components.fwupd]
-[components.fwupd-efi]
 [components.fxdiv]
 [components.fxload]
 [components.galera]

base/comps/fwupd-efi/fwupd-efi.comp.toml

@@ -0,0 +1,63 @@
+[components.fwupd-efi]
+
+# SBAT (AB#20493): add an Azure Linux vendor line to the fwupd EFI binary.
+#
+# fwupd-efi has no sbat.csv.in; its .sbat section is generated at build time by
+# efi/generate_sbat.py, which emits exactly one downstream "distro" line from the
+# -Defi_sbat_distro_* meson options (upstream ships that slot as "fedora"). There
+# is no meson knob for a second distro line.
+#
+# Azure Linux is the distributor, so we retarget that slot to azurelinux -- the
+# sanctioned build path then emits the fwupd-efi.azurelinux line natively. We then
+# re-insert the upstream Fedora provenance line onto the finished binary with
+# objcopy, ahead of the azurelinux line, mirroring grub2 (grub.rh before
+# grub.azurelinux). SBAT ordering is not functionally significant.
+
+# Preserve the upstream Fedora provenance SBAT line as a macro (single source of
+# truth for the objcopy step below).
+[[components.fwupd-efi.overlays]]
+description = "SBAT: define the interim upstream-EVR macro and the Fedora provenance line"
+type = "spec-search-replace"
+regex = '%global debug_package %\{nil\}'
+replacement = '''%global debug_package %{nil}
+
+# Interim upstream-EVR macro, pinned to the Fedora fwupd-efi NEVR we import from
+# (fwupd-efi-1.8-1.fc43). The provenance line below must carry the *upstream*
+# EVR, not the Azure Linux one; swap this for the azldev upstream-EVR macro once
+# bug 21798 lands (mirrors grub2's upstream_version_release).
+%global upstream_version_release 1.8-1.fc43
+
+# Upstream Fedora provenance SBAT line, preserved for revocation lineage (AB#20493).
+%global sbat_fedora_line fwupd-efi.fedora,1,The Fedora Project,fwupd-efi,%{upstream_version_release},https://src.fedoraproject.org/rpms/fwupd-efi'''
+
+# Retarget the single meson distro SBAT slot from Fedora to Azure Linux.
+[[components.fwupd-efi.overlays]]
+description = "SBAT: retarget meson distro id to azurelinux"
+type = "spec-search-replace"
+regex = '-Defi_sbat_distro_id="fedora"'
+replacement = '-Defi_sbat_distro_id="azurelinux"'
+
+[[components.fwupd-efi.overlays]]
+description = "SBAT: retarget meson distro summary to Microsoft"
+type = "spec-search-replace"
+regex = '-Defi_sbat_distro_summary="The Fedora Project"'
+replacement = '-Defi_sbat_distro_summary="Microsoft"'
+
+[[components.fwupd-efi.overlays]]
+description = "SBAT: retarget meson distro url to the Azure Linux repo"
+type = "spec-search-replace"
+regex = '-Defi_sbat_distro_url="https://src\.fedoraproject\.org/rpms/%\{name\}"'
+replacement = '-Defi_sbat_distro_url="https://github.com/microsoft/azurelinux/issues"'
+
+# Re-insert the Fedora provenance line ahead of the azurelinux line, before signing
+# so the pesign signature covers the final .sbat section.
+[[components.fwupd-efi.overlays]]
+description = "SBAT: re-inject the Fedora provenance line via objcopy before pesign"
+type = "spec-search-replace"
+regex = '%pesign -s -i %\{fwup_efi_fn\} -o %\{fwup_efi_fn\}\.tmp'
+replacement = '''# Re-inject the upstream Fedora provenance SBAT line, ahead of the azurelinux line
+# emitted by the meson distro slot (AB#20493).
+objcopy --dump-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
+sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-sbat.csv
+objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
+%pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp'''

locks/fwupd-efi.lock

@@ -2,5 +2,5 @@
 version = 1
 import-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7'
 upstream-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7'
-input-fingerprint = 'sha256:7005a8f4b249e1dd46d19fd23dd86b4a42b4e315c5f68c0d750b00ab417f7612'
+input-fingerprint = 'sha256:85f46532d25fe03c80cbefb79afa43c01e2644df55f3a9432ccbe1aa9c038ba1'
 resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'

specs/f/fwupd-efi/fwupd-efi.spec

@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.8.3)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 2;
+    release_number = 3;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -13,6 +13,15 @@
 
 %global debug_package %{nil}
 
+# Interim upstream-EVR macro, pinned to the Fedora fwupd-efi NEVR we import from
+# (fwupd-efi-1.8-1.fc43). The provenance line below must carry the *upstream*
+# EVR, not the Azure Linux one; swap this for the azldev upstream-EVR macro once
+# bug 21798 lands (mirrors grub2's upstream_version_release).
+%global upstream_version_release 1.8-1.fc43
+
+# Upstream Fedora provenance SBAT line, preserved for revocation lineage (AB#20493).
+%global sbat_fedora_line fwupd-efi.fedora,1,The Fedora Project,fwupd-efi,%{upstream_version_release},https://src.fedoraproject.org/rpms/fwupd-efi
+
 Summary:   Firmware update EFI binaries
 Name:      fwupd-efi
 Version:   1.8
@@ -41,11 +50,11 @@ the EFI binary that is used for updating using UpdateCapsule.
 
 %meson \
     -Dgenpeimg=disabled \
-    -Defi_sbat_distro_id="fedora" \
-    -Defi_sbat_distro_summary="The Fedora Project" \
+    -Defi_sbat_distro_id="azurelinux" \
+    -Defi_sbat_distro_summary="Microsoft" \
     -Defi_sbat_distro_pkgname="%{name}" \
     -Defi_sbat_distro_version="%{version}-%{release}" \
-    -Defi_sbat_distro_url="https://src.fedoraproject.org/rpms/%{name}"
+    -Defi_sbat_distro_url="https://github.com/microsoft/azurelinux/issues"
 
 %meson_build
 
@@ -60,6 +69,11 @@ the EFI binary that is used for updating using UpdateCapsule.
 %global efiarch aa64
 %endif
 %global fwup_efi_fn $RPM_BUILD_ROOT%{_libexecdir}/fwupd/efi/fwupd%{efiarch}.efi
+# Re-inject the upstream Fedora provenance SBAT line, ahead of the azurelinux line
+# emitted by the meson distro slot (AB#20493).
+objcopy --dump-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
+sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-sbat.csv
+objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
 %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp
 %define __pesign_client_cert fwupd-signer
 %pesign -s -i %{fwup_efi_fn}.tmp -o %{fwup_efi_fn}.signed
@@ -75,6 +89,9 @@ rm -vf %{fwup_efi_fn}.tmp
 
 %changelog
 ## START: Generated by rpmautospec
+* Mon Jul 27 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 1.8-3
+- feat(fwupd-efi): add AZL SBAT line, keep upstream provenance
+
 * Thu Apr 30 2026 Daniel McIlvaney <damcilva@microsoft.com> - 1.8-2
 - feat: introduce deterministic commit resolution via Azure Linux lock file