New signed binaries corresponding to 15.7-1

  We now have arm64 signed shims again \o/
    Closes: #1008942, #992073

  Pulls multiple other bugfixes in for the signed version:
    Make sbat_var.S parse right with buggy gcc/binutils
    Enable NX support at build time, as required by policy for signing
    new shim binaries.

  Update build-dep on shim-unsigned to use 15.7-1
  Block Debian grub binaries with sbat < 4 (see #1024617)

7 files changed, 15 insertions, 28 deletions

diff --git a/debian/arm64.description b/debian/arm64.description
deleted file mode 100644
index 2c18ab0..0000000
--- a/debian/arm64.description
+++ /dev/null
@@ -1,15 +0,0 @@
-Description: Secure Boot chain-loading bootloader - **NOT** signed
-This package provides a minimalist boot loader which allows verifying
-signatures of other UEFI binaries against either the Secure Boot DB/DBX or
-against a built-in signature database.  Its purpose is to allow a small,
-infrequently-changing binary to be signed by the UEFI CA, while allowing
-an OS distributor to revision their main bootloader independently of the CA.
-
-NOTICE: This package used to contain the version of the bootloader
-binary signed by the Microsoft UEFI CA, but significant toolchain
-problems on arm64 have made it impossible to reliably build a safe
-arm64 shim for now. See
-https://wiki.debian.org/SecureBoot#arm64_problems for more
-information. In the hope that we can resolve these problems soon, for
-now this package instead contains another copy of the *unsigned* shim
-on arm64 to maintain package dependencies.
diff --git a/debian/changelog b/debian/changelog
index 7588f6a..6bcf1f2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,17 @@
+shim-signed (1.39) UNRELEASED; urgency=medium
+
+  * Build against new signed binaries corresponding to 15.7-1
+    + We now have arm64 signed shims again \o/
+      Closes: #1008942, #992073
+    Pulls multiple other bugfixes in for the signed version:
+    + Make sbat_var.S parse right with buggy gcc/binutils
+    + Enable NX support at build time, as required by policy for signing
+      new shim binaries.
+  * Update build-dep on shim-unsigned to use 15.7-1
+  * Block Debian grub binaries with sbat < 4 (see #1024617)
+
+ -- Steve McIntyre <93sam@debian.org>  Fri, 17 Feb 2023 13:21:24 +0000
+
 shim-signed (1.38) unstable; urgency=medium
 
   * Tweak how we call grub-install; don't abort on error. Not ideal
diff --git a/debian/control b/debian/control
index 6f5c478..cc2107e 100644
--- a/debian/control
+++ b/debian/control
@@ -4,7 +4,7 @@ Priority: optional
 Maintainer: Debian EFI Team <debian-efi@lists.debian.org>
 Uploaders: Steve McIntyre <93sam@debian.org>, Steve Langasek <vorlon@debian.org>
 Build-Depends: debhelper (>= 13),
- shim-unsigned (= 15.4-7),
+ shim-unsigned (= 15.7-1),
 # sbsigntool before 0.9.2-2 had a horrid bug with checksum calculation
 # which broke our build
  sbsigntool (>= 0.9.2-2),
diff --git a/debian/rules b/debian/rules
index 48a8275..91ea525 100755
--- a/debian/rules
+++ b/debian/rules
@@ -32,17 +32,5 @@ endif
 	dh_installdeb
 
 override_dh_gencontrol:
-ifeq ($(DEB_HOST_ARCH),arm64)
-	# On arm64, substitute our package description with "not
-	# signed" warning at build time
-	dh_gencontrol -pshim-signed -- \
-		-v$(VERSION)+$(SHIM_VERSION) \
-		-Vshim:Version=$(SHIM_VERSION) \
-		-DDescription="$$(cat debian/arm64.description)"
-	dh_gencontrol --remaining-packages -- \
-		-v$(VERSION)+$(SHIM_VERSION) \
-		-Vshim:Version=$(SHIM_VERSION)
-else
 	dh_gencontrol -- -v$(VERSION)+$(SHIM_VERSION) \
 		-Vshim:Version=$(SHIM_VERSION)
-endif
diff --git a/shimaa64.efi.signed b/shimaa64.efi.signed
new file mode 100644
index 0000000..6fd839f
--- /dev/null
+++ b/shimaa64.efi.signed
diff --git a/shimia32.efi.signed b/shimia32.efi.signed
index 580263a..19d8946 100644
--- a/shimia32.efi.signed
+++ b/shimia32.efi.signed
diff --git a/shimx64.efi.signed b/shimx64.efi.signed
index dcd8b50..292ade1 100644
--- a/shimx64.efi.signed
+++ b/shimx64.efi.signed