From ec47fa63cf5b70949e6bc1cb7496e94c6d088f59c838952075f3d64d58d7c9ef Mon Sep 17 00:00:00 2001
From: Michael Chang <mchang@suse.com>
Date: Fri, 4 Mar 2022 02:14:49 +0000
Subject: [PATCH] Accepting request 958738 from home:michals

- Remove obsolete openSUSE 12.2 conditionals in spec file
- Clean up powerpc certificate handling.

OBS-URL: https://build.opensuse.org/request/show/958738
OBS-URL: https://build.opensuse.org/package/show/Base:System/grub2?expand=0&rev=405
---
 grub2.changes |  6 ++++++
 grub2.spec    | 15 +++++----------
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/grub2.changes b/grub2.changes
index 90567b7..bcb2f2c 100644
--- a/grub2.changes
+++ b/grub2.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Tue Mar  1 08:55:57 UTC 2022 - Michal Suchanek <msuchanek@suse.com>
+
+- Remove obsolete openSUSE 12.2 conditionals in spec file
+- Clean up powerpc certificate handling.
+
 -------------------------------------------------------------------
 Thu Feb 10 16:20:24 UTC 2022 - Bjørn Lie <bjorn.lie@gmail.com>
 
diff --git a/grub2.spec b/grub2.spec
index a47bda4..4f0e222 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -53,11 +53,9 @@ BuildRequires:  python
 %endif
 BuildRequires:  xz-devel
 %ifarch x86_64 aarch64 ppc ppc64 ppc64le
-%if 0%{?suse_version} >= 1230 || 0%{?suse_version} == 1110
 BuildRequires:  openssl >= 0.9.8
 BuildRequires:  pesign-obs-integration
 %endif
-%endif
 %if 0%{?suse_version} >= 1210
 # Package systemd services files grub2-once.service
 BuildRequires:  systemd-rpm-macros
@@ -675,7 +673,6 @@ echo "grub.${distro_id},${distro_sbat},${distro_name},%{name},%{version},mail:se
 %endif
 
 %ifarch x86_64 aarch64
-%if 0%{?suse_version} >= 1230 || 0%{?suse_version} == 1110
 if test -e %{_sourcedir}/_projectcert.crt ; then
     prjsubject=$(openssl x509 -in %{_sourcedir}/_projectcert.crt -noout -subject_hash)
     prjissuer=$(openssl x509 -in %{_sourcedir}/_projectcert.crt -noout -issuer_hash)
@@ -698,7 +695,6 @@ fi
 
 openssl x509 -in $cert -outform DER -out grub.der
 %endif
-%endif
 
 cd ..
 %endif
@@ -729,8 +725,11 @@ TLFLAGS="-static"
 make %{?_smp_mflags}
 
 if [ "%{platform}" = "ieee1275" ]; then
-        cert="%{_sourcedir}/_projectcert.crt"
-        openssl x509 -in "$cert" -outform DER -out grub.der
+        # So far neither OpenFirmware nor grub support CA chain, only certificate pinning
+        # Use project certificate always in the shipped informational file and
+        # for kernel verification
+        projectcert="%{_sourcedir}/_projectcert.crt"
+        openssl x509 -in "$projectcert" -outform DER -out grub.der
         cat > %{platform}-config <<'EOF'
 set root=memdisk
 set prefix=($root)/
@@ -835,14 +834,12 @@ EoM
 %endif
 
 %ifarch x86_64 aarch64
-%if 0%{?suse_version} >= 1230 || 0%{?suse_version} == 1110
 export BRP_PESIGN_FILES="%{_datadir}/%{name}/%{grubefiarch}/grub.efi"
 %ifarch x86_64
 BRP_PESIGN_FILES="${BRP_PESIGN_FILES} %{_datadir}/%{name}/%{grubefiarch}/grub-tpm.efi"
 %endif
 install -m 444 grub.der %{buildroot}/%{sysefidir}/
 %endif
-%endif
 
 cd ..
 %endif
@@ -1285,10 +1282,8 @@ fi
 %endif
 
 %ifarch x86_64 aarch64
-%if 0%{?suse_version} >= 1230 || 0%{?suse_version} == 1110
 %{sysefidir}/grub.der
 %endif
-%endif
 
 %files %{grubefiarch}-debug
 %defattr(-,root,root,-)