diff options
| -rw-r--r-- | debian/changelog | 4 | ||||
| -rw-r--r-- | debian/patches/sbsigntool-not-pesign | 26 | ||||
| -rw-r--r-- | debian/patches/series | 1 | ||||
| -rwxr-xr-x | debian/rules | 1 |
4 files changed, 4 insertions, 28 deletions
diff --git a/debian/changelog b/debian/changelog index 79d7966e..4afcdf19 100644 --- a/debian/changelog +++ b/debian/changelog @@ -9,9 +9,11 @@ shim (12+1503074702.5202f80-0ubuntu1) UNRELEASED; urgency=medium makes it possible to build a shim for other architectures than amd64. - Set ENABLE_SHIM_CERT, to keep using ephemeral self-signed certs built at compile-time for MokManager and fallback. + - Set ENABLE_SBSIGN, to use sbsign instead of pesign for signing fallback + and MokManager. * debian/patches/second-stage-path: dropped; the default loader path now includes an arch suffix. - * debian/patches/sbsigntool-no-pesign: refreshed. + * debian/patches/sbsigntool-no-pesign: dropped; no longer needed.. * debian/patches/0001-shim-fix-the-mirroring-MokSBState-fail.patch: dropped, included upstream. diff --git a/debian/patches/sbsigntool-not-pesign b/debian/patches/sbsigntool-not-pesign deleted file mode 100644 index 1220cabd..00000000 --- a/debian/patches/sbsigntool-not-pesign +++ /dev/null @@ -1,26 +0,0 @@ -Description: Sign MokManager with sbsigntool instead of pesign - Ubuntu infrastructure uses sbsigntool for all other EFI signing, so we use - the same thing for signing MokManager with our ephemeral key. This also - avoids an additional build dependency on libnss3-tools. -Author: Steve Langasek <steve.langasek@canonical.com> -Forwarded: not-needed - ---- - Makefile | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -Index: b/Makefile -=================================================================== ---- a/Makefile -+++ b/Makefile -@@ -206,8 +206,8 @@ endif - -j .note.gnu.build-id \ - $(FORMAT) $^ $@.debug - --%.efi.signed: %.efi certdb/secmod.db -- $(PESIGN) -n certdb -i $< -c "shim" -s -o $@ -f -+%.efi.signed: %.efi shim.crt -+ sbsign --key shim.key --cert shim.crt $< - - clean: - $(MAKE) -C Cryptlib -f $(TOPDIR)/Cryptlib/Makefile clean diff --git a/debian/patches/series b/debian/patches/series index b8e0e105..e69de29b 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1 +0,0 @@ -sbsigntool-not-pesign diff --git a/debian/rules b/debian/rules index b5f21367..3dc47aee 100755 --- a/debian/rules +++ b/debian/rules @@ -24,6 +24,7 @@ override_dh_auto_build: MAKELEVEL=0 \ EFI_PATH=/usr/lib \ ENABLE_SHIM_CERT=1 \ + ENABLE_SBSIGN=1 \ VENDOR_CERT_FILE=$(cert) override_dh_fixperms: |