summaryrefslogtreecommitdiff
path: root/debian/rules
AgeCommit message (Collapse)Author
2021-03-24Rebuild the new upstream version for busterdebian/15.3-1_deb10u1Steve McIntyre
2021-03-23Switch to using the 15.3 release from upstreamSteve McIntyre
2021-03-23Fix up some of the options we're using at build timeSteve McIntyre
Definitely don't want to be setting EFI_PATH, as that over-rides the vendored gnu-efi. Argh
2021-03-23Improve how the dbx hashes are handledSteve McIntyre
Only include the hashes for the architecture we're building for - no point in adding bloat and delay here. Add a script "block_signed_deb" to scan a set of .deb files, extract the hashes for .efi binaries and list them in the format wanted for the dbx hashes file. Split out the code to use that file from the rules file into a separate helper.
2021-03-23Tweak the gnu-efi tarball codeSteve McIntyre
2021-03-23Add an extra rule to generate the extra gnu-efi tarballSteve McIntyre
Thanks to Dmitri John Ledkov for help
2021-03-23Add Debian SBAT data to the shim buildSteve McIntyre
Add a Debian SBAT template, and rules to use it Adds a build-dep on dos2unix
2021-02-21Remove artifacts that upstream installs that we don't useSteve McIntyre
... to keep debhelper from complaining
2021-02-21Switch to using gcc-10 rather than gcc-9. Closes: #978521Steve McIntyre
2021-02-21Switch to newer upstream "release" 15+1613861442.888f5b5Steve McIntyre
Many many updates, but caring mainly about SBAT support
2020-07-24Use sort and uniq - minimise the size of the list hereSteve McIntyre
We may end up with duplicates, let's not include hashes twice in the shim binary blacklist
2020-03-24Update debhelper compat level to 11Steve McIntyre
2020-03-24Switch to using gcc-9 for builds. Closes: #925826Steve McIntyre
Pull upstream commit aaa09b35e73c4a35fc119d225e5241199d7cf5aa to fix an FTBFS.
2019-05-06Output efisiglist commands to the build logdann frazier
It wouldn't hurt to keep a record of them.
2019-05-06Require dbx hashesdann frazier
While it maybe convenient for a developer to be able to do a build w/o any dbx hashes, it prevents the $(DBX_LIST) target from having a proper dependency on the $(DBX_HASHES) file. If a developer were to add a new hash in a built tree, make would not detect that on a subsequent build and would not update the $(DBX_LIST) file. Continue to support a NULL $(DBX_LIST) build by touching the $(DBX_LIST) file in case no efisiglist commands ran. Developers can now create an empty $(DBX_HASHES) file to get that.
2019-05-06Use $@ instead of referencing ${DBX_LIST} in multiple placesdann frazier
2019-05-06'set -e' the code that generates the dbx listdann frazier
Without this we would silently ignore an efisiglist command error.
2019-05-06Remove unnecessary exportsdann frazier
2019-05-04Generate a vendor dbx file at build timeSteve McIntyre
This allow us to block executing binaries with specific checksums. Generate the dbx list at runtime from a simple list of sha256 hashes, so we can update this easily. If we need to also blacklist a cert later, we'll need to update this code to add that option too. Add a build-dep on pesign to get the needed efisiglist program.
2019-05-03Build using gcc-7Steve McIntyre
To get better control of reproducibility during the lifetime of Buster
2019-03-23Fix FTCBFS: Set CROSS_COMPILE. (Closes: #922152)Helmut Grohne
2019-02-15Include /usr/share/dpkg/architecture.mk instead of shelling out.Luca Boccassi
2019-02-15Add shim-$arch-signed-template supportPhilipp Hahn
for getting the MOK-manager and fall-back binary to be signed by Debians singing service instead of using an ephemeral key. Closes: #922228
2019-02-15Disable ephemeral key on DebianPhilipp Hahn
shim creates an ephemeral key, which gets embedded into shim and is used to sign the corresponding mok-manager (mm*.efi) and fall-back-manager (fb*.efi). This makes the build unreproducible. For Debian we will get those two binaries signed by our Debian-UEFI-CA, which is the primary (and only) key embedded in shim.
2019-02-15debian/rules: fixing permissions no longer requiredPhilipp Hahn
as Makefiles used "install -m 0644" by now.
2019-02-10Ensure DEB_HOST_ARCH is set even if not present in the environment.Steve Langasek
2019-02-10Enable build for i386.Steve Langasek
2019-02-10Fix debian/rules syntax for arm64 build.Steve Langasek
2018-08-22Make sure we pass the right COMMIT_ID to buildMathieu Trudel-Lapierre
2018-07-24* debian/rules:Mathieu Trudel-Lapierre
- define RELEASE and COMMIT_ID for the snapshot. - Set ENABLE_HTTPBOOT to enable the HTTP Boot feature.
2018-04-24Enable arm64 build.dann frazier
2017-09-29Don't need to clean after .signed files, upstream Makefile does it now.Mathieu Trudel-Lapierre
Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-29Don't need to set -Wno-error=unused-variable anymoreMathieu Trudel-Lapierre
Signed-off-by: Mathieu Trudel-Lapierre <mathieu.trudel-lapierre@canonical.com>
2017-09-27Ignore unused-variable errors.Mathieu Trudel-Lapierre
2017-08-31debian/rules, debian/shim.install: make sure the 'make install' step does ↵Mathieu Trudel-Lapierre
what it's meant to do by upstream: we can easily make use of the end result to have the files we need.
2017-08-29Set EFIDIR=ubuntu for dh_auto_install; that will let files be installed in ↵Mathieu Trudel-Lapierre
the "right" final directories, and makes boot.csv for us.
2017-08-29Update dh_auto_build/dh_auto_clean/dh_auto_install for new upstream options: ↵Mathieu Trudel-Lapierre
set MAKELEVEL.
2017-08-29debian/rules: clean up after *.signed files.Mathieu Trudel-Lapierre
2017-08-29Set ENABLE_SBSIGN, to use sbsign instead of pesign for signing fallback and ↵Mathieu Trudel-Lapierre
MokManager. Also drop debian/patches/sbsigntool-no-pesign: with this change from upstream it is no longer needed..
2017-08-29Set ENABLE_SHIM_CERT, to keep using ephemeral self-signed certs built at ↵Mathieu Trudel-Lapierre
compile-time for MokManager and fallback.
2017-08-29debian/patches/second-stage-path: dropped; the default loader path now ↵Mathieu Trudel-Lapierre
includes an arch suffix.
2017-08-07Fix typo for DEFAULT_LOADER: missing a backslash, also needs quoting.Mathieu Trudel-Lapierre
2017-08-07Define an EFI_ARCH variable, and use that for paths to shim. This makes it ↵Mathieu Trudel-Lapierre
possible to build a shim for other architectures than amd64.
2017-08-07Set DEFAULT_LOADER; this makes second-stage-path unnecessary.Mathieu Trudel-Lapierre
2017-08-07* debian/rules:Mathieu Trudel-Lapierre
- Update dh_auto_build/dh_auto_clean for new upstream options: set MAKELEVEL.
2016-10-01fix path we're chmodding, for current upstreamSteve Langasek
2016-10-01* Initial Debian upload. Closes: #820052.Steve Langasek
* Update Standards-Version. * Embed the newly-minted Debian CA certificate. * Vendorize debian/rules so that the same package can be used in both Debian and Ubuntu without modification. * Fix debian/copyright to match the spec (last match wins, not first) * Fix shim.efi to not be executable. * Add watchfile. * Support parallel builds, because eh why not * Update Vcs-Bzr.
2012-10-04Use a clearer name for the VENDOR_CERT_FILE.Steve Langasek
2012-10-04Pull newer upstream snapshot, which fixes verification of the signature on ↵Steve Langasek
our signed GRUB efi
2012-10-03Include the Canonical Secure Boot master CA (cert.der) and include asSteve Langasek
cert.h at build time.
generated by cgit v1.2.3 (git 2.39.1) at 2025-09-01 10:48:57 +0000