2013-09-09 05:29:33 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Sep 6 13:57:36 UTC 2013 - lnussel@suse.de
|
|
|
|
|
|
|
|
|
|
- set timestamp of PE file to time of the binary the signature was
|
|
|
|
|
made for.
|
|
|
|
|
- make sure cert.o get's rebuilt for each target
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Sep 6 11:48:14 CEST 2013 - fcrozat@suse.com
|
|
|
|
|
|
|
|
|
|
- Update microsoft.asc: shim signed by UEFI signing service, based
|
|
|
|
|
on code from "Wed Aug 28 15:54:38 UTC 2013"
|
|
|
|
|
|
2013-08-29 10:43:23 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Aug 28 15:54:38 UTC 2013 - lnussel@suse.de
|
|
|
|
|
|
|
|
|
|
- always build a shim that embeds the distro's certificate (e.g.
|
|
|
|
|
shim-opensuse.efi). If the package is built in the devel project
|
|
|
|
|
additionally shim-devel.efi is created. That allows us to either
|
|
|
|
|
load grub2/kernel signed by the distro or signed by the devel
|
|
|
|
|
project, depending on use case. Also shim-$distro.efi from the
|
|
|
|
|
devel project can be used to request additional signatures.
|
|
|
|
|
|
2013-08-28 11:32:58 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Aug 28 07:16:51 UTC 2013 - lnussel@suse.de
|
|
|
|
|
|
|
|
|
|
- also include old openSUSE 4096 bit certificate to be able to still
|
|
|
|
|
boot kernels signed with that key.
|
|
|
|
|
- add show_signatures script
|
|
|
|
|
|
2013-08-27 09:45:39 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Aug 27 06:41:03 UTC 2013 - lnussel@suse.de
|
|
|
|
|
|
|
|
|
|
- replace the 4096 bit openSUSE UEFI CA certificate with new a
|
|
|
|
|
standard compliant 2048 bit one.
|
|
|
|
|
|
2013-08-22 03:54:02 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Aug 20 11:48:25 UTC 2013 - lnussel@suse.de
|
|
|
|
|
|
|
|
|
|
- fix shell syntax error
|
|
|
|
|
|
2013-08-09 11:33:45 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Aug 7 15:51:36 UTC 2013 - lnussel@suse.de
|
|
|
|
|
|
|
|
|
|
- don't include binary in the sources. Instead package the raw
|
|
|
|
|
signature and attach it during build (bnc#813448).
|
|
|
|
|
|
2013-08-01 04:49:52 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Jul 30 07:36:28 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Update shim-mokmanager-ui-revamp.patch to include fixes for
|
|
|
|
|
MokManager
|
|
|
|
|
+ reboot the system after clearing MOK password
|
|
|
|
|
+ fetch more info from X509 name
|
|
|
|
|
+ check the suffix of the key file
|
|
|
|
|
|
2013-07-23 06:44:22 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Jul 23 03:55:05 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Update to 0.4
|
|
|
|
|
- Rebase patches
|
|
|
|
|
+ shim-suse-build.patch
|
|
|
|
|
+ shim-mokmanager-support-crypt-hash-method.patch
|
|
|
|
|
+ shim-bnc804631-fix-broken-bootpath.patch
|
|
|
|
|
+ shim-bnc798043-no-doulbe-separators.patch
|
|
|
|
|
+ shim-bnc807760-change-pxe-2nd-loader-name.patch
|
|
|
|
|
+ shim-bnc808106-correct-certcount.patch
|
|
|
|
|
+ shim-mokmanager-ui-revamp.patch
|
|
|
|
|
- Add patches
|
|
|
|
|
+ shim-merge-lf-loader-code.patch: merge the Linux Foundation
|
|
|
|
|
loader UI code
|
|
|
|
|
+ shim-fix-pointer-casting.patch: fix a casting issue and the
|
|
|
|
|
size of an empty vendor cert
|
|
|
|
|
+ shim-fix-simple-file-selector.patch: fix the buffer allocation
|
|
|
|
|
in the simple file selector
|
|
|
|
|
- Remove upstreamed patches
|
|
|
|
|
+ shim-support-mok-delete.patch
|
|
|
|
|
+ shim-reboot-after-changes.patch
|
|
|
|
|
+ shim-clear-queued-key.patch
|
|
|
|
|
+ shim-local-key-sign-mokmanager.patch
|
|
|
|
|
+ shim-get-2nd-stage-loader.patch
|
|
|
|
|
+ shim-fix-loadoptions.patch
|
|
|
|
|
- Remove unused patch: shim-mokmanager-new-pw-hash.patch and
|
|
|
|
|
shim-keep-unsigned-mokmanager.patch
|
|
|
|
|
- Install the vendor certificate to /etc/uefi/certs
|
|
|
|
|
|
2013-05-08 08:52:29 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed May 8 06:40:12 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Add shim-mokmanager-ui-revamp.patch to update the MokManager UI
|
|
|
|
|
|
2013-04-03 08:25:09 +02:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Apr 3 03:54:22 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Call update-bootloader in %post to update *.efi in \efi\opensuse
|
|
|
|
|
(bnc#813079)
|
|
|
|
|
|
2013-03-08 09:06:19 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Mar 8 06:53:47 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Add shim-bnc807760-change-pxe-2nd-loader-name.patch to change the
|
|
|
|
|
PXE 2nd stage loader name (bnc#807760)
|
|
|
|
|
- Add shim-bnc808106-correct-certcount.patch to correct the
|
|
|
|
|
certificate count of the signature list (bnc#808106)
|
|
|
|
|
|
2013-03-05 11:12:49 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Mar 1 10:07:55 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Add shim-bnc798043-no-doulbe-separators.patch to remove double
|
|
|
|
|
seperators from the bootpath (bnc#798043#c4)
|
|
|
|
|
|
2013-03-01 04:32:55 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Feb 28 08:57:48 UTC 2013 - lnussel@suse.de
|
|
|
|
|
|
|
|
|
|
- sign shim also with openSUSE certificate
|
|
|
|
|
|
2013-02-27 15:53:25 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Feb 27 15:52:53 CET 2013 - mls@suse.de
|
|
|
|
|
|
|
|
|
|
- identify project, export certificate as DER file
|
2013-02-27 17:19:41 +01:00
|
|
|
- don't create an unused extra keypair
|
2013-02-27 15:53:25 +01:00
|
|
|
|
2013-02-22 11:31:48 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Feb 21 10:08:12 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Add shim-bnc804631-fix-broken-bootpath.patch to fix the broken
|
|
|
|
|
bootpath generated in generate_path(). (bnc#804631)
|
|
|
|
|
|
2013-02-11 13:35:13 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Mon Feb 11 12:15:25 UTC 2013 - fcrozat@suse.com
|
|
|
|
|
|
|
|
|
|
- Update with shim signed by UEFI signing service, based on code
|
|
|
|
|
from "Thu Feb 7 06:56:19 UTC 2013".
|
|
|
|
|
|
2013-02-07 17:09:29 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Feb 7 13:54:06 UTC 2013 - lnussel@suse.de
|
|
|
|
|
|
|
|
|
|
- prepare for having a signed shim from the UEFI signing service
|
|
|
|
|
|
2013-02-07 14:54:45 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Thu Feb 7 06:56:19 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Sign shim-opensuse.efi and MokManager.efi with the openSUSE cert
|
|
|
|
|
- Add shim-keep-unsigned-mokmanager.patch to keep the unsigned
|
|
|
|
|
MokManager and sign it later.
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Feb 6 06:35:45 UTC 2013 - mchang@suse.com
|
|
|
|
|
|
|
|
|
|
- Add shim-install utility
|
|
|
|
|
- Add Recommends to grub2-efi
|
|
|
|
|
|
2013-01-30 11:19:49 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jan 30 09:00:31 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Add shim-mokmanager-support-crypt-hash-method.patch to support
|
|
|
|
|
password hash from /etc/shadow (FATE#314506)
|
|
|
|
|
|
2013-01-29 14:42:18 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Jan 29 03:20:48 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Embed openSUSE-UEFI-CA-Certificate.crt in shim
|
|
|
|
|
- Rename shim-unsigned.efi to shim-opensuse.efi.
|
|
|
|
|
|
2013-01-20 14:53:46 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Jan 18 10:06:13 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Update shim-mokmanager-new-pw-hash.patch to extend the password
|
|
|
|
|
hash format
|
|
|
|
|
- Rename shim.efi as shim-unsigned.efi
|
|
|
|
|
|
2013-01-17 10:43:06 +01:00
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Jan 16 08:01:55 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Merge patches for FATE#314506
|
|
|
|
|
+ Add shim-support-mok-delete.patch to add support for deleting
|
|
|
|
|
specific keys
|
|
|
|
|
+ Add shim-mokmanager-new-pw-hash.patch to support the new
|
|
|
|
|
password hash.
|
|
|
|
|
- Drop shim-correct-mok-size.patch which is included in
|
|
|
|
|
shim-support-mok-delete.patch
|
|
|
|
|
- Merge shim-remove-debug-code.patch and
|
|
|
|
|
shim-local-sign-mokmanager.patch into
|
|
|
|
|
shim-local-key-sign-mokmanager.patch
|
|
|
|
|
- Install COPYRIGHT
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Jan 15 03:17:53 UTC 2013 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Add shim-fix-loadoptions.patch to adopt the UEFI shell style
|
|
|
|
|
LoadOptions (bnc#798043)
|
|
|
|
|
- Drop shim-check-pk-kek.patch since upstream rejected the patch
|
|
|
|
|
due to violation of SPEC.
|
|
|
|
|
- Install EFI binaries to /usr/lib64/efi
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Dec 26 07:05:02 UTC 2012 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Update shim-reboot-after-changes.patch to avoid rebooting the
|
|
|
|
|
system after enrolling keys/hashes from the file system
|
|
|
|
|
- Add shim-correct-mok-size.patch to correct the size of MOK
|
|
|
|
|
- Add shim-clear-queued-key.patch to clear the queued key and show
|
|
|
|
|
the menu properly
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Dec 12 15:16:18 UTC 2012 - fcrozat@suse.com
|
|
|
|
|
|
|
|
|
|
- Remove shim-rpmlintrc, it wasn't fixing the error, hide error
|
|
|
|
|
stdout to prevent post build check to get triggered by cast
|
|
|
|
|
warnings in openSSL code
|
|
|
|
|
- Add shim-remove-debug-code.patch: remove debug code
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Wed Dec 12 04:01:52 UTC 2012 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Add shim-rpmlintrc to filter 64bit portability errors
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Tue Dec 11 07:36:32 UTC 2012 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Add shim-local-sign-mokmanager.patch to create a local certicate
|
|
|
|
|
to sign MokManager
|
|
|
|
|
- Add shim-get-2nd-stage-loader.patch to get the second stage
|
|
|
|
|
loader path from the load options
|
|
|
|
|
- Add shim-check-pk-kek.patch to verify EFI images with PK and KEK
|
|
|
|
|
- Add shim-reboot-after-changes.patch to reboot the system after
|
|
|
|
|
enrolling or erasing keys
|
|
|
|
|
- Install the EFI images to /usr/lib64/shim instead of the EFI
|
|
|
|
|
partition
|
|
|
|
|
- Update the mail address of the author
|
|
|
|
|
|
|
|
|
|
-------------------------------------------------------------------
|
|
|
|
|
Fri Nov 2 08:19:37 UTC 2012 - glin@suse.com
|
|
|
|
|
|
|
|
|
|
- Add new package shim 0.2 (FATE#314484)
|
|
|
|
|
+ It's in fact git 2fd180a92 since there is no tag for 0.2
|
|
|
|
|
|
