diff options
| author | Steve McIntyre <steve@einval.com> | 2024-01-20 22:40:27 +0000 |
|---|---|---|
| committer | Steve McIntyre <steve@einval.com> | 2024-01-20 23:15:22 +0000 |
| commit | f4f4e39e16af685d5d6de16c4fcc0e04f651ab70 (patch) | |
| tree | 08f8baaea99b0bd01c4911c7ada55fba0c530288 | |
| parent | 7686debad858ce35d7b393a424f9b684120c778c (diff) | |
| download | efi-boot-shim-f4f4e39e16af685d5d6de16c4fcc0e04f651ab70.tar.gz efi-boot-shim-f4f4e39e16af685d5d6de16c4fcc0e04f651ab70.zip | |
generate_dbx_list: pick a fixed UUID
otherwise our build won't be reproducible, doh!
| -rw-r--r-- | debian/control | 1 | ||||
| -rwxr-xr-x | debian/generate_dbx_list | 7 |
2 files changed, 5 insertions, 3 deletions
diff --git a/debian/control b/debian/control index e251e917..a7dc9108 100644 --- a/debian/control +++ b/debian/control @@ -13,7 +13,6 @@ Build-Depends: debhelper-compat (= 12), dos2unix, pesign (>= 0.112-5), efivar, - uuid-runtime, xxd, libefivar-dev Vcs-Browser: https://salsa.debian.org/efi-team/shim diff --git a/debian/generate_dbx_list b/debian/generate_dbx_list index db9dc0f6..9f768943 100755 --- a/debian/generate_dbx_list +++ b/debian/generate_dbx_list @@ -16,6 +16,10 @@ ARCH=$1 IN=$2 OUT=$3 +# This needs to be fixed to make builds reproducible, of course. If +# you're deriving from Debian, please generate your own. +DEBIAN_UUID="fa31923d-6047-40bf-81d0-e63edefcf194" + rm -f $OUT if [ -x /usr/bin/efisiglist ] ; then # Older versions of the pesign package included the efisiglist @@ -28,12 +32,11 @@ if [ -x /usr/bin/efisiglist ] ; then else # It appears we don't have efisiglist, so use efisecdb # instead. It's a little more awkward to drive. - UUID=$(uuidgen) INTMP="" # First pass for HASH in $(grep -E "[[:xdigit:]]{32} $ARCH" < $IN | \ awk '{print $1}' | sort | uniq); do echo " Adding $HASH to dbx list" - efisecdb -g $UUID -a -t sha256 -h $HASH $INTMP -o $OUT + efisecdb -g "$DEBIAN_UUID" -a -t sha256 -h $HASH $INTMP -o $OUT # Subsequent passes need to read the previous output as input # each time, and won't overwrite the output. |