Commit graph

794 commits

Author SHA1 Message Date
Robbie Harwood
2b909b72a4 Drop i32 support
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-03-29 18:45:49 +00:00
Adam Williamson
f29388d27a Fix a syntax error in the ostree BLS fix attempt 2022-03-23 16:48:18 -07:00
Peter Robinson
5d7c163550 Rebuild for secure-boot signing 2022-03-23 10:29:57 +00:00
Adam Williamson
5e72956199 Revert "Use my sort patch instead", fix BLS ostree detection
This reverts commit 93004a8494,
because it broke Rawhide. It also tries to fixes BLS ostree
detection to work in chroots (e.g. during installation) by also
checking for /ostree/repo.
2022-03-22 18:32:24 -07:00
Robbie Harwood
2a0a68c542 Fix rebase fuzz on x509 embedding patch
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-03-22 16:25:08 -04:00
Robbie Harwood
93004a8494 Use my sort patch instead
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-03-21 17:54:55 +00:00
Robbie Harwood
ac0e146ae3 Fix missing format specifier in appended signature commit
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-03-21 17:01:32 +00:00
Robbie Harwood
90dacf59d0 Don't verify kernels twice
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-03-18 18:33:12 +00:00
Robbie Harwood
e31fc7ca96 Skip updating BLS on ostree installations
Resolves: #2059776
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-03-10 19:46:17 +00:00
Robbie Harwood
3de994c662 Drop libusb dependency
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-03-09 15:28:03 -05:00
Robbie Harwood
e849938f16 Fix location of fix for fixing
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-03-09 12:50:39 -05:00
Robbie Harwood
e72456a804 Fix libusb dep
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-03-09 12:10:32 -05:00
Robbie Harwood
9a30e00fc0 Fix initialization in efidisk patch
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-03-09 16:50:45 +00:00
Robbie Harwood
95d197a80c Disable the .package_note awfulness
Resolves: #2058712
Resolves: #2058527
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-02-28 20:31:09 +00:00
Robbie Harwood
0bd5331192 Fix efi_modules to include connectefi
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-02-28 14:02:46 -05:00
Robbie Harwood
9027ec262f Bump spec
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-02-25 17:26:09 -05:00
Robbie Harwood
fe0248c0ce Fix stripping of annobin -spec
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-02-25 22:25:36 +00:00
Robbie Harwood
e82a4fd034 Add efidisk/connectefi patches
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-02-24 22:03:20 +00:00
Robbie Harwood
9c910dfa10 Fix appending signature support commit (thanks: pjones)
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-02-24 15:11:16 -05:00
Robbie Harwood
1c4e61c989 Don't forget the sources file
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-02-24 13:35:00 -05:00
Robbie Harwood
8a74d28ac8 Life is pain, but especially when it's gnulib
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-02-24 13:25:56 -05:00
Robbie Harwood
3e40727f72 Skip machine ID check when updating BLS
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-01-20 17:52:23 -05:00
Robbie Harwood
a382c9e3c9 Bump release; no code chages
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-01-18 14:47:04 -05:00
Robbie Harwood
357489e3ea Add location of DejaVu Sans font
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-01-18 19:46:15 +00:00
Robbie Harwood
e602a0629d Update patches; minor changes at most, if correct
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-01-17 18:09:27 -05:00
Robbie Harwood
b256068060 btrfs: use full bootloader area
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2022-01-06 17:42:54 +00:00
Robbie Harwood
46317f98bf Bump to rerun signing (no code changes)
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2021-12-10 17:34:40 +00:00
Robbie Harwood
d90546c5ee restore umask for grub.cfg (CVE-2021-3981)
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2021-12-09 11:11:30 -05:00
Robbie Harwood
9fdaa794e0 Drop UI patches and update provenance information
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2021-11-04 12:30:16 -04:00
Peter Jones
af038a0bdc Revert "Don't harcode grub2 in the spec file"
Two issues:
- line 538 switches the filename from "grub" to "grub2" where it
  shouldn't
- in general, things that aren't referring to the packaging itself
  shouldn't be %{name}; it just makes them less flexible.

This reverts commit 967c5629ed.
2021-10-07 17:38:20 -04:00
Peter Jones
42a07486d8 Fix "grub2-mkimage --appended-signature-size" parsing.
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-10-07 12:30:43 -04:00
Peter Jones
99bcf9931e Fix grub-mkimage --append-signature-size
0179-Add-suport-for-signing-grub-with-an-appended-signatu.patch was
written in Jun of 2020, before support for .sbat went upstream.  It adds
a command line option "--append-signature-size" to grub-mkimage with the
short argument '-s'.

Unfortunately, .sbat support also uses that short argument, and as a
result, trying to use "grub-mkimage --append-signature-size" on ppc64le
(where we need it) fails due to argument.sbat being set on a non-EFI
platform.

This patch makes the --append-signature-size use 'S' instead of 's'.

Related: rhbz#1951104
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-10-06 10:09:21 -04:00
Robbie Harwood
b3b9566edf Rebuild; no code changes 2021-09-29 18:05:43 +00:00
Robbie Harwood
07cf41c169 fs/xfs: Fix unreadable filesystem with v4 superblock
While we're here, also: check for the PE magic for the compiled arch

Resolves: rhbz#2008819
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2021-09-29 12:12:55 -04:00
Robbie Harwood
64dc7670b0 Add rpminspect config file
Signed-off-by: Robbie Harwood <rharwood@redhat.com>
2021-09-23 16:44:52 -04:00
Javier Martinez Canillas
1f9e8074ae
A few fixes for ppc64le LPAR Secure Boot support
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-08-30 16:55:22 +02:00
Peter Jones
db96a0c4de grub.macros: Remove annobin plugin from linker flags
The annobin GCC plugin is now turned on linking for LTO mode but it causes
build failures on at least powerpc. The plugin is already removed from the
CFLAGS but was added again through LDFLAGS, remove from there as well.

Signed-off-by: Peter Jones <pjones@redhat.com>
2021-08-30 10:33:06 -04:00
Peter Jones
702732583b Fix aarch64 kernel alignment.
Signed-off-by: Peter Jones <pjones@redhat.com>
2021-08-24 11:24:20 -04:00
Javier Martinez Canillas
67f07b7c9e
Another set of fixes for 2.06
- Add luks2 to GRUB_MODULES
- 20-grub-install: Create a symvers.gz symbolic link
- 20-grub-install: Always use fedora as the boot entry --class
  Resolves: rhbz#1957014
- grub.macros: Install font in /boot/grub2 instead of the ESP
  Resolves: rhbz#1739762
- grub.macros: Use consistent file mode for legacy and EFI
  Resolves: rhbz#1965794
- Drop grub2 prelink configuration
  Resolves: rhbz#1659675
- Remove triggers needed to upgrade from legacy GRUB
- Don't harcode grub2 in the spec file
- Update to unifont-13.0.06
  Resolves: rhbz#1939125
- 20-grub-install: Use relative paths for btrfs in BLS snippets
  Resolves: rhbz#1906191
- Don't update the cmdline when generating legacy menuentry commands
- Suppress gettext error message
  Resolves: rhbz#1592124
- grub-boot-success.timer: Only run if not in a container
  Resolves: rhbz#1914571
- grub-set-password: Always use /boot/grub2/user.cfg as password default
  Resolves: rhbz#1955294
- Remove outdated URL for BLS document
  Resolves: rhbz#1926453
- templates: Check for EFI at runtime instead of config generation time
  Resolves: rhbz#1823864
- efi: Print an error if boot to firmware setup is not supported
  Resolves: rhbz#1823864

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-07-06 11:18:04 +02:00
Eduardo
fbeda573a9
20-grub-install: Use relative paths for btrfs in BLS snippets
When SUSE_BTRFS_SNAPSHOT_BOOTING=true is set in /etc/default/grub, paths
to kernel and initrd images need to be relative. Since are used along with
snapper, configured so the default btrfs subvolume is the current snapshot.

Resolves: rhbz#1906191
2021-06-30 11:38:48 +02:00
Javier Martinez Canillas
419340f25e
Update to unifont-13.0.06
Resolves: rhbz#1939125

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-06-30 09:52:19 +02:00
Javier Martinez Canillas
967c5629ed
Don't harcode grub2 in the spec file
There's a variable for this, use it consistently.

Suggested-by: Benjamin Herrenschmidt <benh@amazon.com>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-06-30 09:20:25 +02:00
Javier Martinez Canillas
5e2444babe
Remove triggers needed to upgrade from legacy GRUB
The legacy GRUB package (grub2 < 1.99-4) had a %preun scriptlet that did a
rm -f /boot/%{name}/*.{mod,img,lst} and caused users who upgraded to grub2
to have an empty /boot/%{name} directory, leading to an unbootable system.

To workaround this, a set of %triggerun and %triggerpostun triggers were
added that backup and restore the /boot/%{name} directory. But that was an
issue in Fedora 16, almost a decade ago. These aren't needed anymore.

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-06-30 09:20:11 +02:00
Javier Martinez Canillas
8efaf82828
Drop grub2 prelink configuration
A /etc/prelink.conf.d/grub2.conf is shipped to avoid SELinux to warn about
security violations when SELinux is enforced and allow_execstack is off.

But the tools have been fixed a long time ago and the allow list shouldn't
be needed anymore, let's just drop it.

Resolves: rhbz#1659675

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-06-29 18:19:10 +02:00
Javier Martinez Canillas
504ecff2ed
grub.macros: Use consistent file mode for legacy and EFI
Currently the permissions are inconsistent for grub2-pc and grub2-efi:

$ rpm -qlvf --filesbypkg /boot/grub2/grub.cfg
...
grub2-efi-x64             /boot/grub2/grub.cfg
-rwx------    1 root     root
grub2-pc                  /boot/grub2/grub.cfg
-rw-r--r--    1 root     root

Resolves: rhbz#1965794

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-06-29 16:28:36 +02:00
Javier Martinez Canillas
9cf30d96e9
grub.macros: Install font in /boot/grub2 instead of the ESP
GRUB is now using /boot/grub2 as the directory where all the resources are
loaded, but the unicode.pf2 is still installed in the EFI System Partition.

Resolves: rhbz#1739762

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-06-29 16:28:36 +02:00
Javier Martinez Canillas
fc19d7847d
20-grub-install: Always use fedora as the boot entry --class
This is only used by themes and these assume that boot entries for Fedora
will be named "fedora". Currently we are using "kernel" that's not useful.

Resolves: rhbz#1957014

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-06-29 15:31:16 +02:00
Javier Martinez Canillas
a02c397786
20-grub-install: Create a symvers.gz symbolic link
This is not needed for boot, just a symlink would be enough for
tools that expect this file to be present in the boot directory.

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-06-21 08:50:53 +02:00
Austin Conatser
485dd93ff1 Add luks2 to GRUB_MODULES
Enable limited luks2 support for the built images.
Argon2 keys. the default used in cryptsetup for luks2, are not yet supported.
2021-06-17 01:24:42 +00:00
Javier Martinez Canillas
3459058062
Only try to generate a config if the ESP is mounted
The posttran scriptlet attempts to generate a GRUB configuration if there
isn't one in the EFI System Partition. But this leads to a failure if the
grub2 package is installed in a container.

To avoid this issue, only attempt to generate a GRUB config if the ESP is
mounted in /boot/efi.

Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2021-06-15 16:54:32 +02:00