summaryrefslogtreecommitdiff
path: root/debian
AgeCommit message (Collapse)Author
2021-03-24Tweak the SBAT data to keep reproducibilitydebian/15.3-1_deb10u3Steve McIntyre
Only include the upstream version in the Debian SBAT metadata, so we don't break reproducibility on every minor packaging change.
2021-03-24Add missing build-dep on xxd for build-time unit testsdebian/15.3-1_deb10u2Steve McIntyre
2021-03-24Rebuild the new upstream version for busterdebian/15.3-1_deb10u1Steve McIntyre
2021-03-24Merge the new upstream version into busterSteve McIntyre
Merge branch 'master' into buster/updates
2021-03-23Switch to using the 15.3 release from upstreamSteve McIntyre
2021-03-23Remove all out outstanding patchesSteve McIntyre
* cast-CHAR8-string-handling.patch no longer needed * fix-Make.coverity-bashisms.patch went upstream
2021-03-23Update copyright fileSteve McIntyre
Update a couple of top-level changes, copy in gnu-efi information from the gnu-efi package
2021-03-23Fix up some of the options we're using at build timeSteve McIntyre
Definitely don't want to be setting EFI_PATH, as that over-rides the vendored gnu-efi. Argh
2021-03-23Improve how the dbx hashes are handledSteve McIntyre
Only include the hashes for the architecture we're building for - no point in adding bloat and delay here. Add a script "block_signed_deb" to scan a set of .deb files, extract the hashes for .efi binaries and list them in the format wanted for the dbx hashes file. Split out the code to use that file from the rules file into a separate helper.
2021-03-23Tweak the gnu-efi tarball codeSteve McIntyre
2021-03-23Add an extra rule to generate the extra gnu-efi tarballSteve McIntyre
Thanks to Dmitri John Ledkov for help
2021-03-23Add Debian SBAT data to the shim buildSteve McIntyre
Add a Debian SBAT template, and rules to use it Adds a build-dep on dos2unix
2021-03-23Add dbx entries for all our existing grub binariesSteve McIntyre
They're insecure, let's break the chainloading hole
2021-02-21Change changelog to shut lintian upSteve McIntyre
2021-02-21Remove artifacts that upstream installs that we don't useSteve McIntyre
... to keep debhelper from complaining
2021-02-21Add new patch cast-CHAR8-string-handling.patchSteve McIntyre
Cast CHAR8 strings to use (const char *) when using string functions Looks like gnu-efi definitions of CHAR8 are problematic
2021-02-21Trivial change to remove bashisms in Make.coveritySteve McIntyre
2021-02-21Remove all our old patches, no longer needed:Steve McIntyre
- avoid_null_vsprint.patch - check_null_sn_ln.patch - fixup_git.patch - uname.patch - use_compare_mem_gcc9.patch
2021-02-21Switch to using gcc-10 rather than gcc-9. Closes: #978521Steve McIntyre
2021-02-21Switch to newer upstream "release" 15+1613861442.888f5b5Steve McIntyre
Many many updates, but caring mainly about SBAT support
2020-07-24Prepare 15+1533136590.3beb971-10 uploaddebian/15+1533136590.3beb971-10Steve McIntyre
2020-07-24Minimal-change upload to pick up rotated Debian signing keysSteve McIntyre
2020-07-24Use sort and uniq - minimise the size of the list hereSteve McIntyre
We may end up with duplicates, let's not include hashes twice in the shim binary blacklist
2020-07-24Typo fixSteve McIntyre
2020-07-24Update changelog for a buster uploaddebian/15+1533136590.3beb971-7+deb10u1Steve McIntyre
2020-07-06Typo fixSteve McIntyre
2020-07-06Tweak the version dependency of the -helpers-ARCH-signed packagesSteve McIntyre
Change the version dependency on shim-unsigned to be >= and not =. This will allow for installation to still work in the window while we wait for the template package to do its second trip through the archive. Closes: #955356
2020-07-06Use --padding when calling pesign to generate hashesSteve McIntyre
for the dbx list, as recommended by Peter Jones. No actual changes needed in our list of hashes at this point - they work out the same either way.
2020-04-01Update standards version to 4.4.1, no changes needed.Debian Janitor
Fixes: lintian: out-of-date-standards-version See-also: https://lintian.debian.org/tags/out-of-date-standards-version.html
2020-04-01Set upstream metadata fields: Bug-Database, Bug-Submit.Debian Janitor
Fixes: lintian: upstream-metadata-file-is-missing See-also: https://lintian.debian.org/tags/upstream-metadata-file-is-missing.html
2020-04-01Set debhelper-compat version in Build-Depends.Debian Janitor
Fixes: lintian: uses-debhelper-compat-file See-also: https://lintian.debian.org/tags/uses-debhelper-compat-file.html
2020-04-01Bump debhelper from old 11 to 12.Debian Janitor
Fixes: lintian: package-uses-old-debhelper-compat-version See-also: https://lintian.debian.org/tags/package-uses-old-debhelper-compat-version.html
2020-04-01debian/copyright: use spaces rather than tabs to start continuation lines.Debian Janitor
Fixes: lintian: tab-in-license-text See-also: https://lintian.debian.org/tags/tab-in-license-text.html
2020-04-01Use secure copyright file specification URI.Debian Janitor
Fixes: lintian: insecure-copyright-format-uri See-also: https://lintian.debian.org/tags/insecure-copyright-format-uri.html
2020-04-01Trim trailing whitespace.Debian Janitor
Fixes: lintian: file-contains-trailing-whitespace See-also: https://lintian.debian.org/tags/file-contains-trailing-whitespace.html
2020-03-30Tweak the version dependency of the -helpers-ARCH-signed packagesdebian/15+1533136590.3beb971-9Steve McIntyre
Change the version dependency on shim-unsigned to be >= and not =. This will allow for installation to still work in the window while we wait for the template package to do its second trip through the archive. Closes: #955356
2020-03-24Prepare Debian release 15+1533136590.3beb971-8debian/15+1533136590.3beb971-8Steve McIntyre
2020-03-24Update debhelper compat level to 11Steve McIntyre
2020-03-24Switch to using gcc-9 for builds. Closes: #925826Steve McIntyre
Pull upstream commit aaa09b35e73c4a35fc119d225e5241199d7cf5aa to fix an FTBFS.
2019-05-08Use --padding when calling pesign to generate hashesSteve McIntyre
for the dbx list, as recommended by Peter Jones. No actual changes needed in our list of hashes at this point - they work out the same either way.
2019-05-08Prepare Debian release 15+1533136590.3beb971-7debian/15+1533136590.3beb971-7Steve McIntyre
2019-05-08Remove the hash for Sledge's test arm64 grub binarySteve McIntyre
Not needed now.
2019-05-07Add an empty list of hashes for the Ubuntu buildSteve McIntyre
so they'll get an empty dbs list rather than breaking the build
2019-05-06Output efisiglist commands to the build logdann frazier
It wouldn't hurt to keep a record of them.
2019-05-06Require dbx hashesdann frazier
While it maybe convenient for a developer to be able to do a build w/o any dbx hashes, it prevents the $(DBX_LIST) target from having a proper dependency on the $(DBX_HASHES) file. If a developer were to add a new hash in a built tree, make would not detect that on a subsequent build and would not update the $(DBX_LIST) file. Continue to support a NULL $(DBX_LIST) build by touching the $(DBX_LIST) file in case no efisiglist commands ran. Developers can now create an empty $(DBX_HASHES) file to get that.
2019-05-06Use $@ instead of referencing ${DBX_LIST} in multiple placesdann frazier
2019-05-06'set -e' the code that generates the dbx listdann frazier
Without this we would silently ignore an efisiglist command error.
2019-05-06Remove unnecessary exportsdann frazier
2019-05-06Merge branch 'hack' from 93samSteve McIntyre
Changes: crash fixes generate dbx file at runtime
2019-05-06Add more hashes that we want to blacklistSteve McIntyre
signed arm64 grub binaries that allow use of the devicetree command, as found in grub-efi-arm64-signed_1+2.02+dfsg1+16_arm64.deb grub-efi-arm64-signed_1+2.02+dfsg1+17_arm64.deb
generated by cgit v1.2.3 (git 2.39.1) at 2025-08-30 04:07:12 +0000