efi-boot-shim.git/Makefile, branch Release_3.3.4

makefile: Fix detecting objcopy version

2016-06-30T20:31:43+00:00

Signed-off-by: Carlo Caione

Sign MokManager with sbsigntool instead of pesign

2016-06-30T19:43:11+00:00

Ubuntu infrastructure uses sbsigntool for all other EFI signing, so we use the same thing for signing MokManager with our ephemeral key. This also avoids an additional build dependency on libnss3-tools.

Chainload grubx64.efi, not grub.efi

2016-06-30T19:42:21+00:00

We qualify the second stage bootloader image with the architecture name, so we're forwards-compatible with any future 32-bit implementations. (Non-SB grub doesn't conflict, since the image will be named bootia32.efi anyway, not grub.efi.)

Work around binutils version string weirdness.

2016-05-18T14:33:38+00:00

Nick Clifton wrote to me and explained: Subject: SHIM - objcopy version check broken by RHEL 7.3 binutils Hi Peter, We (the tools group) have run across a small problem with the shim package for RHEL 7.3, whilst testing out a new version of the binutils. It complains that it needs a version of objcopy that is >= 2.23, despite the fact that the version is actually 2.25.1. I tracked the problem down to an extraneous space at the end of the version string being produced by objcopy: "GNU objcopy version 2.25.1-8.el7 " The Makefile in the shim package uses this rule to test the version of objcopy: OBJCOPY_GTE224 = $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.* //g' | cut -f1-2 -d.` \>= 2.24) But, because of that extra space, the sed expression clips the entire line and so the test fails. The extra space is there because normally the version number would be followed by a date. For example: "GNU objcopy version 2.23.52.0.1-56.el7 20130226" So in this case the sed will extract the date, not the version number, but the test will still pass. I could fix the binutils to remove the space, although it would be a bit messy and it would not fix the problem when a date is appended to the version number. Instead, I would like to propose a small patch to the shim Makefile. If you change the line to: OBJCOPY_GTE224 = $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.version //g' | cut -f1-2 -d.` \>= 2.24) then the test will work as intended, with or without an extra space at the end of the version and with or without a date appended. Would it be possible to have this change added to the shim package ? Cheers Signed-off-by: Peter Jones

Measure state and second stage into TPM

2016-05-11T15:11:05+00:00

Add support for measuring the MOK database and secure boot state into a TPM, and do the same for the second stage loader. This avoids a hole in TPM measurement between the firmware and the second stage loader.

shim: rebuild shim.o if headers change

2015-11-17T16:40:09+00:00

Signed-off-by: Peter Jones

Cryptlib: Define the va functions for EFIAPI

2015-11-09T14:50:50+00:00

It turned out that my previous crash fix(*) was wrong. We actually always used the gcc built-in va functions instead of the "real" va functions for EFIAPI, and we are just lucky that ERR_add_error_data didn't crash before. This commit copies the va functions from MdePkg/Include/Base.h in edk2 and introdues NO_BUILTIN_VA_FUNCS for x86_64, so that all the x86_64 build will adopt the new va functions. For safety, I also added EFIAPI to all the functions which use va_* to avoid the potential trouble. (*) a7f4b26cc35204165bd04e75c34e8e7aa2a87ecc Signed-off-by: Gary Ching-Pang Lin

Fix recursive reference for RELEASE

2015-09-18T18:49:34+00:00

Building 0.9 with GNU Make 4.0 fails with the following error: Makefile:4: *** Recursive variable 'RELEASE' references itself (eventually). Stop. Change RELEASE to simply-expanded. Signed-off-by: Linn Crosetto

Specify the gnu89 standard

2015-07-28T15:46:38+00:00

According to the gcc5 porting guideline (*), gcc5 defaults to -std=gnu11 instead of -std=gnu89. Append -std=gnu89 to CFLAGS to avoid the potential problems. (*) https://gcc.gnu.org/gcc-5/porting_to.html Based on the patch from Cristian Rodriguez Signed-off-by: Gary Ching-Pang Lin

Typo on aarch64 :/

2015-06-30T18:54:43+00:00

Signed-off-by: Peter Jones