diff options
| author | Steve McIntyre <steve@einval.com> | 2021-05-03 18:31:45 +0100 |
|---|---|---|
| committer | Steve McIntyre <steve@einval.com> | 2021-05-03 17:38:30 +0000 |
| commit | e76fa65f427164b04cecffe5eb2f0ba2591c7433 (patch) | |
| tree | 9e90642d9b14c75f27abf79426fcdc7b72dd8182 | |
| parent | 7011153faa233ec4d7e5689f049d2716aad84883 (diff) | |
| download | shim-signed-e76fa65f427164b04cecffe5eb2f0ba2591c7433.tar.gz shim-signed-e76fa65f427164b04cecffe5eb2f0ba2591c7433.zip | |
Add a NEWS file for shim-signed to talk about arm64
As it's in the package now, no need to link to the wiki.
| -rw-r--r-- | debian/changelog | 3 | ||||
| -rw-r--r-- | debian/shim-signed.NEWS | 30 |
2 files changed, 31 insertions, 2 deletions
diff --git a/debian/changelog b/debian/changelog index b6de7a8..87dd41c 100644 --- a/debian/changelog +++ b/debian/changelog @@ -3,8 +3,7 @@ shim-signed (1.34) UNRELEASED; urgency=medium * Build against new signed binaries corresponding to 15.4-2 Closes: #971129, #987991 * ***WARNING***: arm64 shim is no longer signed, due to major - toolchain problems. See - https://wiki.debian.org/SecureBoot#arm64_problems for more + toolchain problems. See NEWS.Debian for more information. Separated out the binary package for arm64 to allow for a different description, and tweaked the Makefile too. * Update build-deps and Standards-Version diff --git a/debian/shim-signed.NEWS b/debian/shim-signed.NEWS new file mode 100644 index 0000000..ddbeb58 --- /dev/null +++ b/debian/shim-signed.NEWS @@ -0,0 +1,30 @@ +shim-signed (1.34) unstable; urgency=medium + + Debian no longer supports UEFI Secure Boot on arm64 systems + + Shim and other EFI programs have always been difficult to build on + arm64, compared to x86 platforms. Binutils for amd64 and i386 + includes explicit support for creating programs in the PE/COFF + binary format that EFI uses, but this has never been added for + arm64. + + In the past, shim developers added some local hacks into the shim + package to generate a *mostly*-compliant PE/COFF EFI binary without + this toolchain support, and that seemed to be sufficient for + use. Everything seemed to work. *However*, during the development + and testing phase of shim 15.3 and 15.4, we found found significant + issues with this approach. New security features needed in shim + (SBAT) showed up severe problems with the lack of proper toolchain + support. See https://github.com/rhboot/shim/issues/366 for more + details. The old hacks around binutils are no longer sustainable. + + Statistics tell us that very few people have attempted to use arm64 + Secure Boot with Debian so far. In the interests of releasing needed + updates in a timely manner, we have decided *for the time being* to + disable signed shim support for Debian arm64. + + We hope to re-introduce arm64 Secure Boot support as soon as + possible in the future. + + -- Steve McIntyre <93sam@debian.org> Mon, 03 May 2021 18:28:58 +0100 + |