proxmox-mirrors/efi-boot-shim
1
0
Fork 0
mirror of https://git.proxmox.com/git/efi-boot-shim synced 2025-08-11 12:55:34 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Block Debian grub binaries with sbat < 4 (see #1024617)

Browse Source
This commit is contained in:
Steve McIntyre 2023-01-29 23:35:03 +00:00
parent 736533df5b
commit ba98d1fec3
3 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
debian/changelog vendored
View File

@ -7,8 +7,9 @@ shim (15.7-1) UNRELEASED; urgency=medium
* Update to Standards-Version 4.6.2 (no changes needed)
* Enable NX support at build time, as required by policy for signing
new shim binaries.
* Block Debian grub binaries with sbat < 4 (see #1024617)
-- Steve McIntyre <93sam@debian.org> Sun, 22 Jan 2023 13:12:14 +0000
-- Steve McIntyre <93sam@debian.org> Sun, 29 Jan 2023 23:34:40 +0000
shim (15.6-1) unstable; urgency=medium

19
debian/patches/block-grub-sbat3-debian.patch vendored Normal file
View File

@ -0,0 +1,19 @@
diff --git a/include/sbat_var_defs.h b/include/sbat_var_defs.h
index 6b01573e..5b1a764f 100644
--- a/include/sbat_var_defs.h
+++ b/include/sbat_var_defs.h
@@ -35,8 +35,12 @@
SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_PREVIOUS_DATE "\n" \
SBAT_VAR_PREVIOUS_REVOCATIONS
-#define SBAT_VAR_LATEST_DATE "2022111500"
-#define SBAT_VAR_LATEST_REVOCATIONS "shim,2\ngrub,3\n"
+/*
+ * Debian's grub.3 update was broken - some binaries included the SBAT
+ * data update but not the security patches :-(
+ */
+#define SBAT_VAR_LATEST_DATE "2023012900"
+#define SBAT_VAR_LATEST_REVOCATIONS "shim,2\ngrub,3\ngrub.debian,4\n"
#define SBAT_VAR_LATEST \
SBAT_VAR_SIG SBAT_VAR_VERSION SBAT_VAR_LATEST_DATE "\n" \
SBAT_VAR_LATEST_REVOCATIONS

1
debian/patches/series vendored
View File

@ -1,2 +1,3 @@
Make-sbat_var.S-parse-right-with-buggy-gcc-binutils.patch
Enable-NX.patch
block-grub-sbat3-debian.patch