diff --git a/base/comps/fwupd-efi/fwupd-efi.comp.toml b/base/comps/fwupd-efi/fwupd-efi.comp.toml index b939c22484c..fea75641283 100644 --- a/base/comps/fwupd-efi/fwupd-efi.comp.toml +++ b/base/comps/fwupd-efi/fwupd-efi.comp.toml @@ -59,5 +59,60 @@ replacement = '''# Re-inject the upstream Fedora provenance SBAT line, ahead of # emitted by the meson distro slot (AB#20493). objcopy --dump-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn} sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-sbat.csv -objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn} -%pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp''' +objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}''' + +[[components.fwupd-efi.overlays]] +description = "Remove the upstream pesign-client certificate macro" +type = "spec-search-replace" +section = "%install" +regex = '^%define __pesign_client_cert fwupd-signer$' + +[[components.fwupd-efi.overlays]] +description = "Sign the packaged EFI binary with the configured secure boot certificate" +type = "spec-search-replace" +section = "%install" +regex = '^%pesign -s -i %\{fwup_efi_fn\}\.tmp -o %\{fwup_efi_fn\}\.signed$' +replacement = '''PESIGN_CLIENT=/usr/bin/pesign +TEST_FILE=%{fwup_efi_fn} +SIGNED_TEST_FILE=%{fwup_efi_fn}.signed +SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES}," + +if [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then + pesign-client \ + --verbose \ + --debug \ + --sign \ + --certificate "cp-459159-pgp" \ + --token "unused-token-name" \ + --infile "$TEST_FILE" \ + --outfile "$SIGNED_TEST_FILE" +elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then + pesign-client \ + --verbose \ + --debug \ + --sign \ + --certificate "cp-450778-pgp" \ + --token "unused-token-name" \ + --infile "$TEST_FILE" \ + --outfile "$SIGNED_TEST_FILE" +elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then + pesign-client \ + --verbose \ + --debug \ + --sign \ + --certificate "secure-boot-self-signing" \ + --token "unused-token-name" \ + --infile "$TEST_FILE" \ + --outfile "$SIGNED_TEST_FILE" +else + %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.signed +fi + +ls -la "$TEST_FILE" +ls -la "$SIGNED_TEST_FILE"''' + +[[components.fwupd-efi.overlays]] +description = "Remove cleanup for the eliminated intermediate signed EFI file" +type = "spec-search-replace" +section = "%install" +regex = '^rm -vf %\{fwup_efi_fn\}\.tmp$' diff --git a/locks/fwupd-efi.lock b/locks/fwupd-efi.lock index 833908fe6c8..7452b203f36 100644 --- a/locks/fwupd-efi.lock +++ b/locks/fwupd-efi.lock @@ -2,5 +2,5 @@ version = 1 import-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7' upstream-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7' -input-fingerprint = 'sha256:85f46532d25fe03c80cbefb79afa43c01e2644df55f3a9432ccbe1aa9c038ba1' +input-fingerprint = 'sha256:0871c26cb3a764f76ad923c6606b52bd6b5418197bfbcacb952e54975e034da5' resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e' diff --git a/specs/f/fwupd-efi/fwupd-efi.spec b/specs/f/fwupd-efi/fwupd-efi.spec index 10f0f908307..7fcbd13d5ea 100644 --- a/specs/f/fwupd-efi/fwupd-efi.spec +++ b/specs/f/fwupd-efi/fwupd-efi.spec @@ -2,7 +2,7 @@ ## (rpmautospec version 0.8.3) ## RPMAUTOSPEC: autorelease, autochangelog %define autorelease(e:s:pb:n) %{?-p:0.}%{lua: - release_number = 3; + release_number = 5; base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}")); print(release_number + base_release_number - 1); }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}} @@ -74,10 +74,46 @@ the EFI binary that is used for updating using UpdateCapsule. objcopy --dump-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn} sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-sbat.csv objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn} -%pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp -%define __pesign_client_cert fwupd-signer -%pesign -s -i %{fwup_efi_fn}.tmp -o %{fwup_efi_fn}.signed -rm -vf %{fwup_efi_fn}.tmp + +PESIGN_CLIENT=/usr/bin/pesign +TEST_FILE=%{fwup_efi_fn} +SIGNED_TEST_FILE=%{fwup_efi_fn}.signed +SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES}," + +if [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then + pesign-client \ + --verbose \ + --debug \ + --sign \ + --certificate "cp-459159-pgp" \ + --token "unused-token-name" \ + --infile "$TEST_FILE" \ + --outfile "$SIGNED_TEST_FILE" +elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then + pesign-client \ + --verbose \ + --debug \ + --sign \ + --certificate "cp-450778-pgp" \ + --token "unused-token-name" \ + --infile "$TEST_FILE" \ + --outfile "$SIGNED_TEST_FILE" +elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then + pesign-client \ + --verbose \ + --debug \ + --sign \ + --certificate "secure-boot-self-signing" \ + --token "unused-token-name" \ + --infile "$TEST_FILE" \ + --outfile "$SIGNED_TEST_FILE" +else + %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.signed +fi + +ls -la "$TEST_FILE" +ls -la "$SIGNED_TEST_FILE" + %files %doc README.md AUTHORS @@ -89,6 +125,12 @@ rm -vf %{fwup_efi_fn}.tmp %changelog ## START: Generated by rpmautospec +* Wed Sep 02 2026 azldev - 1.8-5 +- Local changes (uncommitted) + +* Wed Sep 02 2026 George Mileka - 1.8-4 +- Update gwupd and fwupd-efi + * Mon Jul 27 2026 Lynsey Rydberg - 1.8-3 - feat(fwupd-efi): add AZL SBAT line, keep upstream provenance diff --git a/specs/x/xsign-proxy-test/README b/specs/x/xsign-proxy-test/README new file mode 100644 index 00000000000..8fc31cdd3b7 --- /dev/null +++ b/specs/x/xsign-proxy-test/README @@ -0,0 +1,3 @@ +xsign-proxy-test dummy package + +This package tests xsign-proxy client-server communication during RPM builds. diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec new file mode 100644 index 00000000000..671dc310901 --- /dev/null +++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec @@ -0,0 +1,102 @@ +Name: xsign-proxy-test +Version: 1.0.0 +Release: 1%{?dist} +Summary: Dummy package to test xsign-proxy client-server communication + +License: MIT +URL: https://example.com/xsign-proxy-test + +Source0: README + +BuildArch: noarch +BuildRequires: python3 +BuildRequires: pesign + +%description +A dummy package that exercises the xsign-proxy-client during the build phase. +This package is used to verify that the xsign-proxy daemon is reachable from +within the mock chroot via the bind-mounted Unix socket. + +%prep +cp %{SOURCE0} . + +%build + +echo "=== Building the binary ===" +TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt" +mkdir -p %{_builddir}/%{name}-%{version} +echo "This is a test file for xsign-proxy signing" > "$TEST_FILE" +echo "Created test file: $TEST_FILE" + +# Check if pesign is available for direct signing +PESIGN_CLIENT=/usr/bin/pesign + +# Are we running on a secure-boot image? +if [ -x "$PESIGN_CLIENT" ]; then + + SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt" + + echo "=== Using pesign for secure-boot signing ===" + + # Sign using pesign-client + # --certificat "short-circuit-signing" + # --certificat "unused-certificate-name" + # + echo "=== signing the test file with pesign ===" + SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES}," + if [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then + pesign-client \ + --verbose \ + --debug \ + --sign \ + --certificate "cp-459159-pgp" \ + --token "unused-token-name" \ + --infile "$TEST_FILE" \ + --outfile "$SIGNED_TEST_FILE" + elif [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then + pesign-client \ + --verbose \ + --debug \ + --sign \ + --certificate "cp-450778-pgp" \ + --token "unused-token-name" \ + --infile "$TEST_FILE" \ + --outfile "$SIGNED_TEST_FILE" + elif [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then + pesign-client \ + --verbose \ + --debug \ + --sign \ + --certificate "secure-boot-self-signing" \ + --token "unused-token-name" \ + --infile "$TEST_FILE" \ + --outfile "$SIGNED_TEST_FILE" + fi + echo "PASS: pesign sign request completed successfully" + + ls -la "$TEST_FILE" + ls -la "$SIGNED_TEST_FILE" + + echo "=== secure boot signing completed ===" +else + echo "=== skipped secure boot signing ===" +fi + +%install +TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt" +SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt" + +if [ -f "$SIGNED_TEST_FILE" ]; then + install -D -m 0644 "$SIGNED_TEST_FILE" \ + %{buildroot}%{_sysconfdir}/xsign-proxy-test.txt +else + install -D -m 0644 "$TEST_FILE" \ + %{buildroot}%{_sysconfdir}/xsign-proxy-test.txt +fi + +%files +%config(noreplace) %{_sysconfdir}/xsign-proxy-test.txt + +%changelog +* Fri Jun 26 2026 Test User - 1.0.0-1 +- Initial package to test xsign-proxy client-server communication