summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2017-11-07releasing package shim version 13-0ubuntu2debian/13-0ubuntu2Mathieu Trudel-Lapierre
2017-11-07Clean up old patches.Mathieu Trudel-Lapierre
2017-11-06debian/patches/abort_abort_abort.patch: signtool.exe isn't happy with some ↵Mathieu Trudel-Lapierre
of the structure of our binary, partly because abort() is thought to be an external symbol, which causes some relocalisations to appear.
2017-09-29releasing package shim version 13-0ubuntu1debian/13-0ubuntu1Mathieu Trudel-Lapierre
2017-09-29Don't need to clean after .signed files, upstream Makefile does it now.Mathieu Trudel-Lapierre
Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-29Drop buildid_write_return.patch; no longer needed.Mathieu Trudel-Lapierre
Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-29Don't need to set -Wno-error=unused-variable anymoreMathieu Trudel-Lapierre
Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-29New upstream release: 13Mathieu Trudel-Lapierre
2017-09-29New upstream version 13upstream/13Mathieu Trudel-Lapierre
2017-09-29Updated version 13 from 'upstream/13'Mathieu Trudel-Lapierre
with Debian dir e38346a2eec5376ccf228af4ba0e2d170f07448f
2017-09-29Updated version 13~z1 from 'upstream/13_z1'Mathieu Trudel-Lapierre
with Debian dir e38346a2eec5376ccf228af4ba0e2d170f07448f
2017-09-29New upstream version 13~z1upstream/13_z1Mathieu Trudel-Lapierre
2017-09-29Bump the version to 1313Peter Jones
shim 13: - OpenSSL reverted to 1.0.2k to make the cert chaining of existing deployments stay working - Better PCR usage for TPM - TPM documentation in README.tpm - More configurable build via make variables: ENABLE_SHIM_CERT ENABLE_SHIM_HASH ENABLE_SBSIGN LIBDIR EFIDIR VENDOR_CERT_FILE VENDOR_DB_FILE - Better MoK documentation in MokVars.txt - Better debuginfo generation - Lots of minor bug fixes. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-29buildid: Check the return values of write() callsMathieu Trudel-Lapierre
Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-29Make shim_cert.h able to be included more safely.Peter Jones
If you build with ENABLE_SHIM_CERT=1, the include chain right now winds up meaning shim_cert is defined in a header that gets included in netboot.c as well, which never uses it: In file included from shim.h:125:0, from netboot.c:36: shim_cert.h:1:14: error: ‘shim_cert’ defined but not used [-Werror=unused-variable] static UINT8 shim_cert[] = { ^~~~~~~~~ cc1: all warnings being treated as errors So make that okay by adding __attribute__((__unused__)) to the variable decl. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-29buildid: make 'make clean' remove it.Peter Jones
2017-09-27New upstream snapshot: 13~git1506531982.23ce039Mathieu Trudel-Lapierre
2017-09-27Updated version 13~git1506531982.23ce039 from ↵Mathieu Trudel-Lapierre
'upstream/13_git1506531982.23ce039' with Debian dir bc85d2ed9d59b8c9e8d4bf33603c75c11feec4f8
2017-09-27New upstream version 13~git1506531982.23ce039upstream/13_git1506531982.23ce039Mathieu Trudel-Lapierre
2017-09-27We don't really need libnss3-tools.Mathieu Trudel-Lapierre
2017-09-27debian/control: add Breaks: for the previous shim-signed builds given that ↵Mathieu Trudel-Lapierre
shim will now build and ship BOOT.CSV by itself.
2017-09-27Ignore unused-variable errors.Mathieu Trudel-Lapierre
2017-09-27New upstream snapshot: 13~git1505328971.0780644aMathieu Trudel-Lapierre
2017-09-26Use iconv for UCS-2 encoding.Peter Jones
Cyphermox discovered that when you run this: ( printf "\xff\x00\xfe\x00" ; echo "shimx64.efi,foo,,This is the boot entry for foo" ) | sed -z 's/./&\x00/g' on some debian machines, printf(1) doesn't interpret the \x.. characters, and that results in this being the encoded text: 00000000 5c 78 66 66 5c 78 66 65 73 00 68 00 69 00 6d 00 |\xff\xfes.h.i.m.| 00000010 78 00 36 00 34 00 2e 00 65 00 66 00 69 00 2c 00 |x.6.4...e.f.i.,.| 00000020 66 00 6f 00 6f 00 2c 00 2c 00 54 00 68 00 69 00 |f.o.o.,.,.T.h.i.| which... yeah, that's wrong. So instead, use iconv instead of printf+sed to encode it in UCS-2. Unfortunately, that means we don't get endian markers, because for some reason iconv(1) doesn't have any way to say it should include them. But that's okay; fallback already handles not having them and just assumes the second byte being \x00 means UCS-2LE. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-19Fix an LDFLAGS issue on arm and aarch64Peter Jones
Commit 1e71734992 inadvertantly switched ARM's LDFLAGS+=--defsym=EFI_SUBSYSTEM=$(SUBSYSTEM) to be before LDFLAGS is set, and so it got clobbered away. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-19Try to do a slightly better job at 'make clean'Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-14New upstream version 13~git1505328971.0780644aupstream/13_git1505328971.0780644aMathieu Trudel-Lapierre
2017-09-14Updated version 13~git1505328971.0780644a from ↵Mathieu Trudel-Lapierre
'upstream/13_git1505328971.0780644a' with Debian dir 8d0dcc2dc48e0c1bf2e174c33432be6f73754e7a
2017-09-14Don't build shim_cert.h in parallel with other targets.Mathieu Trudel-Lapierre
shim_cert.h is required by other pieces (such as netboot.o, cert.o) and might not be built by the time these targets are reached. In that case the build would fail as it can't find a required header. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-14Clean up after BOOT$(ARCH).CSV.Mathieu Trudel-Lapierre
It should not be left around after clean since it's a generated file. Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-13try to show errors more usefully.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13Add some debugging data to the last malformed binary check...Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-13New upstream snapshot: 13~git1505328970.9c1c35c5Mathieu Trudel-Lapierre
2017-09-13Drop PHONY fix patch; merged upstream.Mathieu Trudel-Lapierre
2017-09-13New upstream version 13~git1505328970.9c1c35c5upstream/13_git1505328970.9c1c35c5Mathieu Trudel-Lapierre
2017-09-13Updated version 13~git1505328970.9c1c35c5 from ↵Mathieu Trudel-Lapierre
'upstream/13_git1505328970.9c1c35c5' with Debian dir 676fec75f526e6b8072deb5302628d27abfc7449
2017-09-13Add some defaults and a syntastic file so vim helps more.Peter Jones
Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Work around some annoying compiler grievancesPeter Jones
I'm still having some trouble with the offsetof() definition, so just nerf it to what stddef.h would say anyway. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Some things went weird with the openssl revert...Peter Jones
I think this works around most of them. Signed-off-by: Peter Jones <pjones@redhat.com>
2017-09-08Cryptlib: remove DESGary Lin
Disable DES completely since it's already old and insecure. This makes MokManager not support the DES based password hash but probably no one is using it. Signed-off-by: Gary Lin <glin@suse.com>
2017-09-08Cryptlib: Remove MD4Gary Lin
MD4 is known to be insecure and shim never uses it. Signed-off-by: Gary Lin <glin@suse.com>
2017-09-08Cryptlib: amend the headers and fix signnessGary Lin
- Declare some functions in the proper headers + We missed them for a long time... - Cast offsetof to UINTN + The original casting triggers the gcc warning since int can not present the offset for the 64bit machines. - Cast the "char" array to "CHAR8 *" to avoid the gcc warnings - Implement atoi correctly Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31changelog: ~test3 wasn't released; prepare for another test upload.Mathieu Trudel-Lapierre
Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-08-31debian/rules, debian/shim.install: make sure the 'make install' step does ↵Mathieu Trudel-Lapierre
what it's meant to do by upstream: we can easily make use of the end result to have the files we need.
2017-08-31debian/patches/buildid_write_return.patch: workaround our strict compile ↵Mathieu Trudel-Lapierre
rules failing the build: make sure write calls check the return value.
2017-08-31debian/control: add a Build-Depends on libelf-dev.Mathieu Trudel-Lapierre
2017-08-31Fix build with ENABLE_SHIM_CERT and ENABLE_SBSIGN: shim.key is created by ↵Mathieu Trudel-Lapierre
the shim.crt target Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-08-31Cryptlib: implement strcmp() and strcasecmp()Gary Lin
strcmp() and strcasecmp() are widely used in openssl. Implement those two functions to eliminate the gcc warnings and the potential crash. Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Cryptlib: Include stddef.h in CrtLibSupport.hGary Lin
The changes in the openssl headers cause the inclusion of CrtLibSupport.h eariler than the inclusion of stddef.h, so "offsetof" was defined twice and this caused the followling build error: In file included from Cryptlib/Include/openssl/buffer.h:23:0, from Cryptlib/Include/openssl/x509.h:22, from shim.c:56: /usr/lib64/gcc/x86_64-suse-linux/6/include/stddef.h:417:0: error: "offsetof" redefined [-Werror] #define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) In file included from Cryptlib/Include/limits.h:15:0, from Cryptlib/Include/openssl/ossl_typ.h:13, from Cryptlib/Include/openssl/x509.h:20, from shim.c:56: Cryptlib/Include/CrtLibSupport.h:192:0: note: this is the location of the previous definition #define offsetof(type, member) ( (int) & ((type*)0) -> member ) We can lower the priority of the gcc include path or just remove the path, but this might cause problem since the path was introduced on purpose(*). Instead, including stddef.h first is more feasible. (*) https://github.com/rhinstaller/shim/commit/d51739a416400ad348d8a1c7e3886abce11fff1b Signed-off-by: Gary Lin <glin@suse.com>
2017-08-31Revert lots of Cryptlib updates.Peter Jones
OpenSSL changes quite a bit of the key validation, and most of the keys I can find in the wild aren't marked as trusted by the new checker. Intel noticed this too: https://github.com/vathpela/edk2/commit/f536d7c3ed but instead of fixing the compatibility error, they switched their test data to match the bug. So that's pretty broken. For now, I'm reverting OpenSSL 1.1.0e, because we need those certs in the wild to work. This reverts commit 513cbe2aea689bf968f171f894f3d4cdb43524d5. This reverts commit e9cc33d6f2b7f35c6f5e349fd83fb9ae0bc66226. This reverts commit 80d49f758ead0180bfe6161931838e0578248303. This reverts commit 9bc647e2b23bcfd69a0077c0717fbc454c919a57. This reverts commit ae75df6232ad30f3e8736e9449692d58a7439260. This reverts commit e883479f35644d17db7efed710657c8543cfcb68. This reverts commit 97469449fda5ba933a64280917e776487301a127. This reverts commit e39692647f78e13d757ddbfdd36f440d5f526050. This reverts commit 0f3dfc01e2d5e7df882c963dd8dc4a0dfbfc96ad. This reverts commit 4da6ac819510c7cc4ba21d7a735d69b45daa5873. This reverts commit d064bd7eef201f26cb926450a76260b5187ac689. This reverts commit 9bc86cfd6f9387f0da9d5c0102b6aa5627e91c91. This reverts commit ab9a05a10f16b33f7ee1e9da360c7801eebdb9d2. Signed-off-by: Peter Jones <pjones@redhat.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-22 18:14:46 +0000