Accepting request 888708 from devel:openSUSE:Factory

OBS-URL: https://build.opensuse.org/request/show/888708
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/shim-leap?expand=0&rev=15

README

@@ -0,0 +1,5 @@
+Since shim needs a "stable" environment to reproduce the binary to match
+the signature from UEFI CA, it's difficult to maintain shim in Tumbleweed
+due to the nature of a rolling release distro. Instead of compiling shim
+for Tumbleweed, we directly import the binary the latest stable Leap
+release to maintain a stable and reproducible shim binary.

shim-15+git47-lp152.4.5.1.x86_64.rpm

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:9b52e8b0c9b6918abae23193d19b4f67b7a73ebfb7312f929b9f15c7612f60fa
-size 609424

shim-15.4-lp152.4.8.1.x86_64.rpm

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a5311f07570ee19eddc879f692176c78861b37e7e4d302fb9237b374c15aa22d
+size 455728

shim-leap.changes

@@ -1,3 +1,13 @@
+-------------------------------------------------------------------
+Tue Apr 27 07:45:26 UTC 2021 - Gary Ching-Pang Lin <glin@suse.com>
+
+- Update to shim to 15.4-lp152.4.8.1 from openSUSE Leap 15.2 for
+  SBAT support (bsc#1182057)
+  + Version: 15.4, "Wed Apr 21 05:46:19 UTC 2021"
+  + Include the fixes for bsc#1177789, CVE-2019-14584, bsc#1177315,
+    bsc#1175509, bsc#1173411, bsc#1177404, bsc#1174512, bsc#1184454
+- Add README to note why we need shim-leap for Tumbleweed
+
 -------------------------------------------------------------------
 Thu Aug 27 07:27:54 UTC 2020 - Gary Ching-Pang Lin <glin@suse.com>
 

shim-leap.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package shim-leap
 #
-# Copyright (c) 2020 SUSE LLC
+# Copyright (c) 2021 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -25,12 +25,13 @@
 %endif
 
 Name:           shim-leap
-Version:        15+git47
+Version:        15.4
 Release:        0
 Summary:        UEFI shim loader
 License:        BSD-2-Clause
 Group:          System/Boot
-Source:         shim-15+git47-lp152.4.5.1.x86_64.rpm
+Source:         shim-15.4-lp152.4.8.1.x86_64.rpm
+Source1:        README
 BuildRoot:      %{_tmppath}/%{name}-%{version}-build
 ExclusiveArch:  x86_64
 
@@ -54,12 +55,13 @@ rpm2cpio %{SOURCE0} | cpio --extract --unconditional --preserve-modification-tim
 %install
 # purely repackaged
 cp -a * %{buildroot}
-# NOTE: shim-15+git47 already contains the sym-link to /usr/lib64/efi.
+cp %{S:1} .
 
 %post -n shim
 /sbin/update-bootloader --reinit || true
 
 %files -n shim
+%doc README
 %dir %{?sysefibasedir}
 %dir %{sysefidir}
 %{sysefidir}/shim.efi