Tweak arm64 building a lot

And various other minor packaging tweaks

Add a different description at package build time to warn users that
shim-signed on arm64 is *not* actually signed. Add a doc link to the
wiki for more details.

Comment out a lintian override for arm64

6 files changed, 43 insertions, 10 deletions

diff --git a/debian/arm64.description b/debian/arm64.description
new file mode 100644
index 0000000..2c18ab0
--- /dev/null
+++ b/debian/arm64.description
@@ -0,0 +1,15 @@
+Description: Secure Boot chain-loading bootloader - **NOT** signed
+This package provides a minimalist boot loader which allows verifying
+signatures of other UEFI binaries against either the Secure Boot DB/DBX or
+against a built-in signature database.  Its purpose is to allow a small,
+infrequently-changing binary to be signed by the UEFI CA, while allowing
+an OS distributor to revision their main bootloader independently of the CA.
+
+NOTICE: This package used to contain the version of the bootloader
+binary signed by the Microsoft UEFI CA, but significant toolchain
+problems on arm64 have made it impossible to reliably build a safe
+arm64 shim for now. See
+https://wiki.debian.org/SecureBoot#arm64_problems for more
+information. In the hope that we can resolve these problems soon, for
+now this package instead contains another copy of the *unsigned* shim
+on arm64 to maintain package dependencies.
diff --git a/debian/changelog b/debian/changelog
index ae60329..b42b800 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,8 +1,14 @@
 shim-signed (1.34) UNRELEASED; urgency=medium
 
   * Build against new signed binaries corresponding to 15.4-2
-
- -- Steve McIntyre <93sam@debian.org>  Wed, 28 Apr 2021 22:54:43 +0100
+  * ***WARNING***: arm64 shim is no longer signed, due to major
+    toolchain problems. See
+    https://wiki.debian.org/SecureBoot#arm64_problems for more
+    information. Separated out the binary package for arm64 to allow
+    for a different description, and tweaked the Makefile too.
+  * Update build-deps and Standards-Version
+
+ -- Steve McIntyre <93sam@debian.org>  Thu, 29 Apr 2021 22:04:33 +0100
 
 shim-signed (1.33) unstable; urgency=medium
 
diff --git a/debian/compat b/debian/compat
index ec63514..b1bd38b 100644
--- a/debian/compat
+++ b/debian/compat
@@ -1 +1 @@
-9
+13
diff --git a/debian/control b/debian/control
index da859e3..42400c1 100644
--- a/debian/control
+++ b/debian/control
@@ -3,13 +3,13 @@ Section: utils
 Priority: optional
 Maintainer: Debian EFI Team <debian-efi@lists.debian.org>
 Uploaders: Steve McIntyre <93sam@debian.org>, Steve Langasek <vorlon@debian.org>
-Build-Depends: debhelper (>= 9),
- shim-unsigned (= 15+1533136590.3beb971-7),
+Build-Depends: debhelper (>= 13),
+ shim-unsigned (= 15.4-2),
 # sbsigntool before 0.9.2-2 had a horrid bug with checksum calculation
 # which broke our build
  sbsigntool (>= 0.9.2-2),
  po-debconf
-Standards-Version: 4.3.0
+Standards-Version: 4.5.1
 Vcs-Browser: https://salsa.debian.org/efi-team/shim-signed
 Vcs-Git: https://salsa.debian.org/efi-team/shim-signed.git
 
@@ -18,11 +18,11 @@ Architecture: amd64 i386 arm64
 Multi-Arch: same
 Depends: ${misc:Depends},
  grub-efi-amd64-bin [amd64],
- shim-helpers-amd64-signed (>= 1+15+1533136590.3beb971+7) [amd64],
+ shim-helpers-amd64-signed (>= 1+15.4+2) [amd64],
  grub-efi-ia32-bin [i386],
- shim-helpers-i386-signed (>= 1+15+1533136590.3beb971+7) [i386],
+ shim-helpers-i386-signed (>= 1+15.4+2) [i386],
  grub-efi-arm64-bin [arm64],
- shim-helpers-arm64-signed (>= 1+15+1533136590.3beb971+7) [arm64],
+ shim-helpers-iarm64-signed (>= 1+15.4+2) [arm64],
  grub2-common (>= 2.02+dfsg1-16)
 Recommends: secureboot-db
 Built-Using: shim (= ${shim:Version})
diff --git a/debian/rules b/debian/rules
index e23b521..0276fa2 100755
--- a/debian/rules
+++ b/debian/rules
@@ -31,5 +31,17 @@ override_dh_installdebconf:
 	dh_installdebconf -p shim-signed-common
 
 override_dh_gencontrol:
+ifeq ($(DEB_HOST_ARCH),arm64)
+	# On arm64, substitute our package description with "not
+	# signed" warning at build time
+	dh_gencontrol -- -v$(VERSION)+$(SHIM_VERSION) \
+		-Vshim:Version=$(SHIM_VERSION) \
+		-p shim-signed \
+		-DDescription="$$(cat debian/arm64.description)"
+	dh_gencontrol -- -v$(VERSION)+$(SHIM_VERSION) \
+		-Vshim:Version=$(SHIM_VERSION) \
+		--remaining-packages
+else
 	dh_gencontrol -- -v$(VERSION)+$(SHIM_VERSION) \
 		-Vshim:Version=$(SHIM_VERSION)
+endif
diff --git a/debian/source/lintian-overrides b/debian/source/lintian-overrides
index 9dfa023..e942a5f 100644
--- a/debian/source/lintian-overrides
+++ b/debian/source/lintian-overrides
@@ -1,3 +1,3 @@
-shim-signed: source-contains-prebuilt-windows-binary shimaa64.efi.signed
+#shim-signed: source-contains-prebuilt-windows-binary shimaa64.efi.signed
 shim-signed: source-contains-prebuilt-windows-binary shimia32.efi.signed
 shim-signed: source-contains-prebuilt-windows-binary shimx64.efi.signed