File uefi-certificates.spec of Package uefi-certificates

Overview Repositories Revisions Requests Users Attributes Meta

File uefi-certificates.spec of Package uefi-certificates (Revision f4459e8eca1c27c5c8d14112b3c9540a)

Currently displaying revision f4459e8eca1c27c5c8d14112b3c9540a , Show latest

#
# spec file for package uefi-certificates
#
# Copyright (c) 2024 SUSE LLC
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
# upon. The license for this file, and modifications and additions to the
# file, is the same license as for the pristine package itself (unless the
# license for the pristine package is not an Open Source License, in which
# case the license is the MIT License). An "Open Source License" is a
# license that conforms to the Open Source Definition (Version 1.9)
# published by the Open Source Initiative.

# Please submit bugfixes or comments via https://bugs.opensuse.org/
#

# random UUID for SUSE
%define suse_guid 353f0911-0788-451c-aaf7-31688391e8fd

%define certdir /usr/share/uefi

Name:           uefi-certificates
Version:        84.87
Release:        0
Summary:        Well known UEFI certificates
License:        MIT
# order of first two matters!
Source:         openSUSE-UEFI-CA-Certificate.pem
Source:         SLES-UEFI-CA-Certificate.pem
Source:         https://www.microsoft.com/pkiops/certs/MicWinProPCA2011_2011-10-19.crt
Source:         https://www.microsoft.com/pkiops/certs/MicCorUEFCA2011_2011-06-27.crt
Source:         https://www.microsoft.com/pkiops/certs/MicCorKEKCA2011_2011-06-24.crt
Source:         revoked-openSUSE-UEFI-SIGN-Certificate-2013-01.pem
Source:         revoked-openSUSE-UEFI-SIGN-Certificate-2013-08.pem
Source:         revoked-openSUSE-UEFI-SIGN-Certificate-2020-01.pem
Source:         revoked-openSUSE-UEFI-SIGN-Certificate-2020-07.pem
Source:         revoked-openSUSE-UEFI-SIGN-Certificate-2021-05.pem
Source:         revoked-SLES-UEFI-SIGN-Certificate-2013-01.pem
Source:         revoked-SLES-UEFI-SIGN-Certificate-2013-04.pem
Source:         revoked-SLES-UEFI-SIGN-Certificate-2016-02.pem
Source:         revoked-SLES-UEFI-SIGN-Certificate-2020-07.pem
Source:         revoked-SLES-UEFI-SIGN-Certificate-2021-05.pem
BuildRequires:  openssl
BuildRequires:  efitools
BuildRequires:  pesign-obs-integration

%description

%prep
%setup -qcT

%build
rm -f *.esl *.auth

%install
mkdir -p "%{buildroot}%{certdir}/"{certs,ms,revoked}
sources=(%sources)
if [ -e "%{_sourcedir}/_projectcert.crt" ]; then
    prjsubject="$(openssl x509 -in "%{_sourcedir}/_projectcert.crt" -noout -subject_hash)"
    prjissuer="$(openssl x509 -in "%{_sourcedir}/_projectcert.crt" -noout -issuer_hash)"
    opensusesubject="$(openssl x509 -in "%{SOURCE0}" -noout -subject_hash)"
    slessubject="$(openssl x509 -in "%{SOURCE1}" -noout -subject_hash)"
    if [ "$prjissuer" != "$opensusesubject" ] && [ "$prjissuer" != "$slessubject" ]; then
	    cp "%{_sourcedir}/_projectcert.crt" "$prjsubject.pem"
	    sources+=("$prjsubject.pem")
    fi
fi
for i in "${sources[@]}"; do
	b="${i##*/}"
	case "$b" in
		revoked*)
			install -m 644 "$i" "%{buildroot}%{certdir}/revoked/${b#revoked-}"
			cert-to-efi-sig-list -g "%suse_guid" "$i" foo
			case "$b" in
				*openSUSE*) cat foo >> "dbx-opensuse.esl" ;;
				*SLES*) cat foo >> "dbx-sles.esl" ;;
			esac
			;;
		Mic*crt)
			o=${b%%.crt}.pem
			openssl x509 -inform der -outform pem -in "$i" -out "$o"
			install -m 644 "$o" "%{buildroot}%{certdir}/ms/$o"
			cert-to-efi-sig-list -g "%suse_guid" "$o" foo
			case "$b" in
				*KEKCA*) cat foo >> "KEK-ms.esl" ;;
				*) cat foo >> "db-ms.esl" ;;
			esac
			;;
		*.pem)
			install -m 644 "$i" "%{buildroot}%{certdir}/certs/$b"
			cert-to-efi-sig-list -g "%suse_guid" "$i" foo
			case "$b" in
				*openSUSE*) cat foo >> "db-opensuse.esl" ;;
				*SLES*) cat foo >> "db-sles.esl" ;;
			esac
			;;
	esac
done
#
cp db-opensuse.esl KEK-opensuse.esl
cp db-opensuse.esl PK-opensuse.esl
cat db-opensuse.esl db-ms.esl > db-opensuse+ms.esl
cat KEK-opensuse.esl KEK-ms.esl > KEK-opensuse+ms.esl
#
cp db-sles.esl KEK-sles.esl
cp db-sles.esl PK-sles.esl
cat db-sles.esl db-ms.esl > db-sles+ms.esl
cat KEK-sles.esl KEK-ms.esl > KEK-sles+ms.esl
#
for i in *.esl; do
	sign-efi-sig-list -o -g "%suse_guid" -t "$SOURCE_DATE_EPOCH" "${i%%-*}" "$i" "${i%.esl}.auth"
	install -m 644 "${i%.esl}.auth" "%{buildroot}%{certdir}/${i%.esl}.auth"
	rm "$i"
done
export BRP_PESIGN_FILES="%certdir/*.auth"

%files
%certdir

%changelog

Places

File uefi-certificates.spec of Package uefi-certificates (Revision f4459e8eca1c27c5c8d14112b3c9540a)

Places