openSUSE Build Service

Overview Repositories Revisions Requests Users Attributes Meta

File project.diff of Package grub2 (Revision 42781c2f92e828429efad7c9f01669d8)

Currently displaying revision 42781c2f92e828429efad7c9f01669d8 , Show latest

--- grub2.spec.orig
+++ grub2.spec
@@ -53,11 +53,9 @@ BuildRequires:  python
 %endif
 BuildRequires:  xz-devel
 %ifarch x86_64 aarch64 ppc ppc64 ppc64le
-%if 0%{?suse_version} >= 1230 || 0%{?suse_version} == 1110
 BuildRequires:  openssl >= 0.9.8
 BuildRequires:  pesign-obs-integration
 %endif
-%endif
 %if 0%{?suse_version} >= 1210
 # Package systemd services files grub2-once.service
 BuildRequires:  systemd-rpm-macros
@@ -172,6 +170,7 @@ Source16:       grub2-xen-pv-firmware.cf
 Source17:       grub2-systemd-sleep.sh
 Source18:       grub2-check-default.sh
 Source19:       grub2-instdev-fixup.pl
+Source20:       SLES-UEFI-SIGN-Certificate-20210225.crt
 Source1000:     PATCH_POLICY
 Patch1:         rename-grub-info-file-to-grub2.patch
 Patch2:         grub2-linux.patch
@@ -641,6 +640,36 @@ GRUB_MODULES="${CD_MODULES} ${FS_MODULES
 GRUB_MODULES="${GRUB_MODULES} appendedsig memdisk tar regexp"
 %endif
 
+if test -e %{_sourcedir}/_projectcert.crt ; then
+    prjsubject=$(openssl x509 -in %{_sourcedir}/_projectcert.crt -noout -subject_hash)
+    prjissuer=$(openssl x509 -in %{_sourcedir}/_projectcert.crt -noout -issuer_hash)
+    opensusesubject=$(openssl x509 -in %{SOURCE10} -noout -subject_hash)
+    slessubject=$(openssl x509 -in %{SOURCE11} -noout -subject_hash)
+    if test "$prjissuer" = "$opensusesubject" ; then
+        %ifarch ppc ppc64 ppc64le
+            # FIXME should use openSUSE project certificate here in case grub is built in openSUSE
+            cert=%{SOURCE20}
+        %else
+            cert=%{SOURCE10}
+        %endif
+    fi
+    if test "$prjissuer" = "$slessubject" ; then
+        %ifarch ppc ppc64 ppc64le
+            # shim supports CA chain but grub does not, embed SLE project cert on ppc
+            cert=%{SOURCE20}
+        %else
+            cert=%{SOURCE11}
+        %endif
+    fi
+    if test "$prjsubject" = "$prjissuer" ; then
+        cert=%{_sourcedir}/_projectcert.crt
+    fi
+fi
+if test -z "$cert" ; then
+    echo "cannot identify project, assuming openSUSE signing"
+    cert=%{SOURCE10}
+fi
+
 %ifarch %{efi}
 cd build-efi
 ../configure   				                \
@@ -675,30 +704,9 @@ echo "grub.${distro_id},${distro_sbat},$
 %endif
 
 %ifarch x86_64 aarch64
-%if 0%{?suse_version} >= 1230 || 0%{?suse_version} == 1110
-if test -e %{_sourcedir}/_projectcert.crt ; then
-    prjsubject=$(openssl x509 -in %{_sourcedir}/_projectcert.crt -noout -subject_hash)
-    prjissuer=$(openssl x509 -in %{_sourcedir}/_projectcert.crt -noout -issuer_hash)
-    opensusesubject=$(openssl x509 -in %{SOURCE10} -noout -subject_hash)
-    slessubject=$(openssl x509 -in %{SOURCE11} -noout -subject_hash)
-    if test "$prjissuer" = "$opensusesubject" ; then
-        cert=%{SOURCE10}
-    fi
-    if test "$prjissuer" = "$slessubject" ; then
-        cert=%{SOURCE11}
-    fi
-    if test "$prjsubject" = "$prjissuer" ; then
-        cert=%{_sourcedir}/_projectcert.crt
-    fi
-fi
-if test -z "$cert" ; then
-    echo "cannot identify project, assuming openSUSE signing"
-    cert=%{SOURCE10}
-fi
-
+# For EFI use CA cert if known
 openssl x509 -in $cert -outform DER -out grub.der
 %endif
-%endif
 
 cd ..
 %endif
@@ -729,8 +737,18 @@ TLFLAGS="-static"
 make %{?_smp_mflags}
 
 if [ "%{platform}" = "ieee1275" ]; then
-        cert="%{_sourcedir}/_projectcert.crt"
-        openssl x509 -in "$cert" -outform DER -out grub.der
+        # So far OpenFirmware does not support CA chain, only certificate pinning
+        # Use project certificate always in the shipped informational file
+        projectcert="%{_sourcedir}/_projectcert.crt"
+        openssl x509 -in "$projectcert" -outform DER -out grub.der
+        # Use the CA cert in grub to verify kernels
+        openssl x509 -in "$cert" -outform DER -out grub_builtin.der
+        # To be able to boot SLE kernels with grub test builds always include SLE project cert
+        extracert=""
+        if [ "$cert" != "%{SOURCE20}" ] ; then
+                openssl x509 -in "%{SOURCE20}" -outform DER -out SLE.der
+                extracert="-x SLE.der"
+        fi
         cat > %{platform}-config <<'EOF'
 set root=memdisk
 set prefix=($root)/
@@ -783,7 +801,7 @@ if [ -n "$prefix" ]; then
 fi
 EOF
         %{__tar} cvf memdisk.tar ./grub.cfg
-        ./grub-mkimage -O %{grubarch} -o grub.elf -d grub-core -x grub.der -m memdisk.tar \
+        ./grub-mkimage -O %{grubarch} -o grub.elf -d grub-core -x grub_builtin.der $extracert -m memdisk.tar \
             -c %{platform}-config --appended-signature-size %brp_pesign_reservation ${GRUB_MODULES}
         ls -l "grub.elf"
         truncate -s -%brp_pesign_reservation "grub.elf"
@@ -835,14 +853,12 @@ EoM
 %endif
 
 %ifarch x86_64 aarch64
-%if 0%{?suse_version} >= 1230 || 0%{?suse_version} == 1110
 export BRP_PESIGN_FILES="%{_datadir}/%{name}/%{grubefiarch}/grub.efi"
 %ifarch x86_64
 BRP_PESIGN_FILES="${BRP_PESIGN_FILES} %{_datadir}/%{name}/%{grubefiarch}/grub-tpm.efi"
 %endif
 install -m 444 grub.der %{buildroot}/%{sysefidir}/
 %endif
-%endif
 
 cd ..
 %endif
@@ -1285,10 +1301,8 @@ fi
 %endif
 
 %ifarch x86_64 aarch64
-%if 0%{?suse_version} >= 1230 || 0%{?suse_version} == 1110
 %{sysefidir}/grub.der
 %endif
-%endif
 
 %files %{grubefiarch}-debug
 %defattr(-,root,root,-)

Places

File project.diff of Package grub2 (Revision 42781c2f92e828429efad7c9f01669d8)

Places