diff options
| author | Steve McIntyre <steve@einval.com> | 2023-01-29 23:35:03 +0000 |
|---|---|---|
| committer | Steve McIntyre <steve@einval.com> | 2023-01-29 23:35:03 +0000 |
| commit | ba98d1fec3e3f37d3ced6abbe3f8d5406ebca02f (patch) | |
| tree | b44f96dcd4a571cd578242bb492f2a72394911f7 | |
| parent | 736533df5bddd7be9b27fa8051a71d731ab7a524 (diff) | |
| download | efi-boot-shim-ba98d1fec3e3f37d3ced6abbe3f8d5406ebca02f.tar.gz efi-boot-shim-ba98d1fec3e3f37d3ced6abbe3f8d5406ebca02f.zip | |
Block Debian grub binaries with sbat < 4 (see #1024617)
| -rw-r--r-- | debian/changelog | 3 | ||||
| -rw-r--r-- | debian/patches/block-grub-sbat3-debian.patch | 19 | ||||
| -rw-r--r-- | debian/patches/series | 1 |
3 files changed, 22 insertions, 1 deletions
diff --git a/debian/changelog b/debian/changelog index edc61f41..290bfe4c 100644 --- a/debian/changelog +++ b/debian/changelog @@ -7,8 +7,9 @@ shim (15.7-1) UNRELEASED; urgency=medium * Update to Standards-Version 4.6.2 (no changes needed) * Enable NX support at build time, as required by policy for signing new shim binaries. + * Block Debian grub binaries with sbat < 4 (see #1024617) - -- Steve McIntyre <93sam@debian.org> Sun, 22 Jan 2023 13:12:14 +0000 + -- Steve McIntyre <93sam@debian.org> Sun, 29 Jan 2023 23:34:40 +0000 shim (15.6-1) unstable; urgency=medium diff --git a/debian/patches/block-grub-sbat3-debian.patch b/debian/patches/block-grub-sbat3-debian.patch new file mode 100644 index 00000000..4b0aa39a --- /dev/null +++ b/debian/patches/block-grub-sbat3-debian.patch @@ -0,0 +1,19 @@ +diff --git a/include/sbat_var_defs.h b/include/sbat_var_defs.h +index 6b01573e..5b1a764f 100644 +--- a/include/sbat_var_defs.h ++++ b/include/sbat_var_defs.h +@@ -35,8 +35,12 @@ + SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_PREVIOUS_DATE "\n" \ + SBAT_VAR_PREVIOUS_REVOCATIONS + +-#define SBAT_VAR_LATEST_DATE "2022111500" +-#define SBAT_VAR_LATEST_REVOCATIONS "shim,2\ngrub,3\n" ++/* ++ * Debian's grub.3 update was broken - some binaries included the SBAT ++ * data update but not the security patches :-( ++ */ ++#define SBAT_VAR_LATEST_DATE "2023012900" ++#define SBAT_VAR_LATEST_REVOCATIONS "shim,2\ngrub,3\ngrub.debian,4\n" + #define SBAT_VAR_LATEST \ + SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_LATEST_DATE "\n" \ + SBAT_VAR_LATEST_REVOCATIONS diff --git a/debian/patches/series b/debian/patches/series index b3ddfc8f..683d1b90 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,3 @@ Make-sbat_var.S-parse-right-with-buggy-gcc-binutils.patch Enable-NX.patch +block-grub-sbat3-debian.patch |