2013-01-17 10:43:06 +01:00
#
# spec file for package shim
#
# Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany.
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.
# Please submit bugfixes or comments via http://bugs.opensuse.org/
#
2013-02-07 14:54:45 +01:00
# needssslcertforbuild
2013-01-17 10:43:06 +01:00
Name : shim
Version : 0.2
Release : 0
Summary : UEFI shim loader
License : BSD-2-Clause
Group : System/Boot
Url : https://github.com/mjg59/shim
Source : %{name} -%{version} .tar.bz2
2013-02-07 17:09:29 +01:00
# this binary has been signed by UEFI signing service
# FIXME: evaluate whether using signature only and attaching that
# to the built binary also works
Source1 : shim-signed.efi
2013-01-29 14:42:18 +01:00
Source2 : openSUSE-UEFI-CA-Certificate.crt
2013-02-07 14:54:45 +01:00
Source3 : shim-install
2013-02-27 15:53:25 +01:00
Source4 : SLES-UEFI-CA-Certificate.crt
2013-01-17 10:43:06 +01:00
# PATCH-FIX-SUSE shim-suse-build.patch glin@suse.com -- Adjust Makefile for the build service
Patch0 : shim-suse-build.patch
# PATCH-FIX-UPSTREAM shim-local-key-sign-mokmanager.patch glin@suse.com -- Sign MokManager.efi with the local generated certificate
Patch1 : shim-local-key-sign-mokmanager.patch
# PATCH-FEATURE-UPSTREAM shim-get-2nd-stage-loader.patch glin@suse.com -- Get the second stage loader path from the load options
Patch2 : shim-get-2nd-stage-loader.patch
# PATCH-FIX-UPSTREAM shim-reboot-after-changes.patch glin@suse.com -- Reboot the system after enrolling or erasing keys
Patch3 : shim-reboot-after-changes.patch
# PATCH-FIX-UPSTREAM shim-clear-queued-key.patch glin@suse.com -- Clear the queued key to show the menu properly
Patch5 : shim-clear-queued-key.patch
# PATCH-FIX-UPSTREAM shim-fix-loadoptions.patch bnc#798043 glin@suse.com -- Adopt the UEFI shell style LoadOptions
Patch6 : shim-fix-loadoptions.patch
# PATCH-FIX-UPSTREAM shim-support-mok-delete.patch glin@suse.com -- Support for deleting specific keys
Patch7 : shim-support-mok-delete.patch
# PATCH-FIX-UPSTREAM shim-mokmanager-new-pw-hash.patch glin@suse.com -- Support the new password hash
Patch8 : shim-mokmanager-new-pw-hash.patch
2013-01-30 11:19:49 +01:00
# PATCH-FIX-UPSTREAM shim-mokmanager-support-crypt-hash-method.patch glin@suse.com -- Support the password hashes from /etc/shadow
Patch9 : shim-mokmanager-support-crypt-hash-method.patch
2013-02-07 14:54:45 +01:00
# PATCH-FIX-OPENSUSE shim-keep-unsigned-mokmanager.patch glin@suse.com -- Keep MokManager.efi and sign it with the openSUSE key later
Patch10 : shim-keep-unsigned-mokmanager.patch
2013-02-22 11:31:48 +01:00
# PATCH-FIX-UPSTREAM shim-bnc804631-fix-broken-bootpath.patch bnc#804631 glin@suse.com -- Fix the broken bootpath generated in generate_path()
Patch11 : shim-bnc804631-fix-broken-bootpath.patch
2013-03-05 11:12:49 +01:00
# PATCH-FIX-UPSTREAM shim-bnc798043-no-doulbe-separators.patch bnc#798043 glin@suse.com -- Remove all double-separators from the bootpath
Patch12 : shim-bnc798043-no-doulbe-separators.patch
2013-03-08 09:06:19 +01:00
# PATCH-FIX-UPSTREAM shim-bnc807760-change-pxe-2nd-loader-name.patch bnc#807760 glin@suse.com -- Change the PXE 2nd stage loader to match the filename we are using
Patch13 : shim-bnc807760-change-pxe-2nd-loader-name.patch
# PATCH-FIX-UPSTREAM shim-bnc808106-correct-certcount.patch bnc#808106 glin@suse.com -- Correct the certifcate count of the signature list
Patch14 : shim-bnc808106-correct-certcount.patch
2013-05-08 08:52:29 +02:00
# PATCH-FIX-UPSTREAM shim-mokmanager-ui-revamp.patch glin@suse.com -- Revamp the MokManager UI
Patch15 : shim-mokmanager-ui-revamp.patch
2013-01-17 10:43:06 +01:00
BuildRequires : gnu-efi >= 3.0q
BuildRequires : mozilla-nss-tools
BuildRequires : openssl >= 0.9.8
BuildRequires : pesign
2013-02-07 14:54:45 +01:00
BuildRequires : pesign-obs-integration
2013-04-03 08:25:09 +02:00
Requires : perl-Bootloader
2013-01-17 10:43:06 +01:00
BuildRoot : %{_tmppath} /%{name} -%{version} -build
2013-02-07 14:54:45 +01:00
Recommends: grub2-efi
2013-01-17 10:43:06 +01:00
ExclusiveArch : x86_64
%description
shim is a trivial EFI application that, when run, attempts to open and
execute another application.
Authors:
--------
Matthew Garrett <mjg59@srcf.ucam.org>
%prep
%setup -q
%patch0 -p1
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch5 -p1
%patch6 -p1
%patch7 -p1
%patch8 -p1
2013-01-30 11:19:49 +01:00
%patch9 -p1
2013-02-07 14:54:45 +01:00
%patch10 -p1
2013-02-22 11:31:48 +01:00
%patch11 -p1
2013-03-05 11:12:49 +01:00
%patch12 -p1
2013-03-08 09:06:19 +01:00
%patch13 -p1
%patch14 -p1
2013-05-08 08:52:29 +02:00
%patch15 -p1
2013-01-17 10:43:06 +01:00
%build
chmod +x " m a k e - c e r t s "
2013-02-27 15:53:25 +01:00
if test -e %{_sourcedir} /_projectcert.crt ; then
prjsubject=$(openssl x509 -in %{_sourcedir} /_projectcert.crt -noout -subject_hash)
prjissuer=$(openssl x509 -in %{_sourcedir} /_projectcert.crt -noout -issuer_hash)
opensusesubject=$(openssl x509 -in %{SOURCE2} -noout -subject_hash)
slessubject=$(openssl x509 -in %{SOURCE4} -noout -subject_hash)
if test " $ p r j i s s u e r " = " $ o p e n s u s e s u b j e c t " ; then
suffix=opensuse
cert=%{SOURCE2}
fi
if test " $ p r j i s s u e r " = " $ s l e s s u b j e c t " ; then
suffix=sles
cert=%{SOURCE4}
fi
if test " $ p r j s u b j e c t " = " $ p r j i s s u e r " ; then
suffix=local
cert=%{_sourcedir} /_projectcert.crt
fi
fi
2013-02-27 15:55:04 +01:00
if test -z " $ s u f f i x " ; then
2013-02-27 15:53:25 +01:00
echo " c a n n o t i d e n t i f y p r o j e c t , a s s u m i n g o p e n S U S E s i g n i n g "
suffix=opensuse
cert=%{SOURCE2}
fi
openssl x509 -in $cert -outform DER -out shim-$suffix.der
2013-02-27 16:35:48 +01:00
# create empty local cert file, we don't need a local key pair as we
# sign the mokmanager with our vendor key
2013-02-27 16:40:36 +01:00
touch shim.crt
2013-02-27 16:35:48 +01:00
touch shim.cer
2013-01-17 10:43:06 +01:00
# make sure cast warnings don't trigger post build check
2013-02-27 16:35:48 +01:00
make VENDOR_CERT_FILE=shim-$suffix.der shim.efi MokManager.efi 2>/dev/null
2013-01-17 10:43:06 +01:00
# make VENDOR_CERT_FILE=cert.der VENDOR_DBX_FILE=dbx
2013-02-27 15:53:25 +01:00
mv shim.efi shim-$suffix.efi
2013-01-17 10:43:06 +01:00
%install
2013-03-01 04:32:55 +01:00
export BRP_PESIGN_FILES='%{_libdir}/efi/shim*.efi %{_libdir}/efi/MokManager.efi'
2013-01-17 10:43:06 +01:00
install -d %{buildroot} /%{_libdir} /efi
2013-02-27 15:53:25 +01:00
install -m 444 shim-*.efi %{buildroot} /%{_libdir} /efi
install -m 444 shim-*.der %{buildroot} /%{_libdir} /efi
2013-02-07 17:09:29 +01:00
# FIXME: install signed shim here
install -m 444 %{SOURCE1} %{buildroot} /%{_libdir} /efi/shim.efi
2013-02-07 14:54:45 +01:00
install -m 444 MokManager.efi %{buildroot} /%{_libdir} /efi/MokManager.efi
install -d %{buildroot} /%{_sbindir}
install -m 755 %{SOURCE3} %{buildroot} /%{_sbindir} /
2013-01-17 10:43:06 +01:00
%clean
%{?buildroot:%__rm -rf " %{buildroot} " }
2013-04-03 08:25:09 +02:00
%post
/sbin/update-bootloader --refresh || true
2013-01-17 10:43:06 +01:00
%files
%defattr (-,root,root)
%doc COPYRIGHT
%dir %{_libdir} /efi
2013-02-07 17:09:29 +01:00
%{_libdir} /efi/shim.efi
2013-02-27 15:53:25 +01:00
%{_libdir} /efi/shim-*.efi
%{_libdir} /efi/shim-*.der
2013-01-17 10:43:06 +01:00
%{_libdir} /efi/MokManager.efi
2013-02-07 14:54:45 +01:00
%{_sbindir} /shim-install
2013-01-17 10:43:06 +01:00
%changelog
