efi-boot-shim.git, branch buster/updates (mirror of https://github.com/vyos/efi-boot-shim.git) https://git.amelek.net/vyos/efi-boot-shim.git/atom?h=buster%2Fupdates 2024-05-12T21:04:29+00:00 Switch distribution to buster-security 2024-05-12T21:04:29+00:00 Steve McIntyre steve@einval.com 2024-05-12T21:04:29+00:00 urn:sha1:485d07436d26c1f81fbb54d52a1f0f2e193ebdf5 Add salsa-ci 2024-05-06T19:22:47+00:00 Bastien Roucariès rouca@debian.org 2024-05-06T19:22:47+00:00 urn:sha1:c8691620c518559492431d45b2ab29d4cdb7001b Release 15.8-1~deb10u1 for buster 2024-05-06T19:21:02+00:00 Steve McIntyre steve@einval.com 2024-05-06T10:34:32+00:00 urn:sha1:e2081dcd554b34e2041efda7007542984429e7da check_nx: ignore arm64 binaries 2024-05-06T19:20:08+00:00 Steve McIntyre steve@einval.com 2024-05-05T00:39:00+00:00 urn:sha1:bbe9ce920070e2860200559870afa5df42ee828a the toolchain is too old Tweak arm64 patch 2024-05-06T19:20:02+00:00 Steve McIntyre steve@einval.com 2024-05-05T00:21:12+00:00 urn:sha1:dfd38f5f958ae71078be4ab9035be954b9220451 Clean up better after build. Closes: #1046268 2024-05-06T19:19:55+00:00 Steve McIntyre steve@einval.com 2024-05-04T13:54:25+00:00 urn:sha1:4da234ce0b772716d9e4fd08d454b27464faab9d Install a copy of the Debian CA certificate into /usr/share/shim. 2024-05-06T19:19:49+00:00 Steve McIntyre steve@einval.com 2024-05-04T13:36:15+00:00 urn:sha1:c9630addcac391372108d5569844110e21173b36 Closes: #1069054 Force usage of newest revocations at build time 2024-05-06T19:19:41+00:00 Steve McIntyre steve@einval.com 2024-05-03T13:46:24+00:00 urn:sha1:2c35bd94ca9a772abc228060ed0ce0a7cb4af461 Force shim to use the latest revocations by default to block some older grub / peimage issues. This is: "shim,4\ngrub,4\ngrub.peimage,2\n" This should work with the current released grub builds in all of buster, bullseye, bookwork and trixie/unstable. Let's not leave known security holes in the wild. Cherry-pick latest grub revocation patches from upstream shim 2024-05-06T19:19:24+00:00 Steve McIntyre steve@einval.com 2024-04-25T23:58:46+00:00 urn:sha1:0c07782d919b58d514faecaea1534eadeac3ee0b 0001-sbat-Add-grub.peimage-2-to-latest-CVE-2024-2312.patch 0002-sbat-Also-bump-latest-for-grub-4-and-to-todays-date.patch Log if the build is nx-compatible or not 2024-05-06T19:19:16+00:00 Steve McIntyre steve@einval.com 2024-04-25T21:42:28+00:00 urn:sha1:2a669792da370a7d43becc33e97d36e1405a9c4a Add a new simple script to do this: check_nx