From f99897cd7337e7519ba53905dcf66be36114f3c2 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Mon, 10 Aug 2026 15:15:21 -0700
Subject: [PATCH 01/29] Add xsign-proxy-test

---
 specs/x/xsign-proxy-test/README               |  3 +
 .../x/xsign-proxy-test/xsign-proxy-test.spec  | 84 +++++++++++++++++++
 2 files changed, 87 insertions(+)
 create mode 100644 specs/x/xsign-proxy-test/README
 create mode 100644 specs/x/xsign-proxy-test/xsign-proxy-test.spec

diff --git a/specs/x/xsign-proxy-test/README b/specs/x/xsign-proxy-test/README
new file mode 100644
index 00000000000..8fc31cdd3b7
--- /dev/null
+++ b/specs/x/xsign-proxy-test/README
@@ -0,0 +1,3 @@
+xsign-proxy-test dummy package
+
+This package tests xsign-proxy client-server communication during RPM builds.
diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
new file mode 100644
index 00000000000..7d063b16cb8
--- /dev/null
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -0,0 +1,84 @@
+Name:           xsign-proxy-test
+Version:        1.0.0
+Release:        1%{?dist}
+Summary:        Dummy package to test xsign-proxy client-server communication
+
+License:        MIT
+URL:            https://example.com/xsign-proxy-test
+
+Source0:        README
+
+BuildArch:      noarch
+
+%description
+A dummy package that exercises the xsign-proxy-client during the build phase.
+This package is used to verify that the xsign-proxy daemon is reachable from
+within the mock chroot via the bind-mounted Unix socket.
+
+%prep
+cp %{SOURCE0} .
+
+%build
+echo "=== Testing xsign-proxy connectivity ==="
+
+# Test 1: Verify the client script is available in the chroot
+if [ -x /usr/local/bin/xsign_proxy_client.py ]; then
+    echo "PASS: xsign_proxy_client.py is present and executable"
+else
+    echo "FAIL: xsign_proxy_client.py not found or not executable"
+    exit 1
+fi
+
+# Test 2: Verify the socket directory is bind-mounted
+if [ -d /var/run/xsign-proxy ]; then
+    echo "PASS: Socket directory /var/run/xsign-proxy exists"
+else
+    echo "FAIL: Socket directory /var/run/xsign-proxy not found"
+    exit 1
+fi
+
+# Test 3: Verify the exchange directory is bind-mounted
+if [ -d /var/lib/xsign-exchange ]; then
+    echo "PASS: Exchange directory /var/lib/xsign-exchange exists"
+else
+    echo "FAIL: Exchange directory /var/lib/xsign-exchange not found"
+    exit 1
+fi
+
+# Test 4: Ping the daemon to verify connectivity
+echo "Pinging xsign-proxy-d daemon..."
+if /usr/local/bin/xsign_proxy_client.py ping; then
+    echo "PASS: Daemon responded to ping"
+else
+    echo "FAIL: Daemon did not respond to ping"
+    exit 1
+fi
+
+# Test 5: Create a test file in the exchange directory and submit it for signing
+TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.txt"
+echo "This is a test file for xsign-proxy signing" > "$TEST_FILE"
+echo "Created test file: $TEST_FILE"
+
+echo "Submitting test file for signing..."
+if /usr/local/bin/xsign_proxy_client.py sign "$TEST_FILE"; then
+    echo "PASS: Sign request submitted successfully"
+else
+    echo "FAIL: Sign request failed"
+    rm -f "$TEST_FILE"
+    exit 1
+fi
+
+# Clean up test file
+rm -f "$TEST_FILE"
+echo "=== All xsign-proxy tests passed ==="
+
+%install
+mkdir -p %{buildroot}%{_docdir}/%{name}
+echo "xsign-proxy-test package installed successfully" > %{buildroot}%{_docdir}/%{name}/README
+
+%files
+%{_docdir}/%{name}/README
+
+%changelog
+* Thu Jun 26 2026 Test User <test@example.com> - 1.0.0-1
+- Initial package to test xsign-proxy client-server communication

From 50bb1fc32922048e3a1d18116d247bb3b0ffc30e Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Mon, 10 Aug 2026 16:01:57 -0700
Subject: [PATCH 02/29] Comment everything

---
 .../x/xsign-proxy-test/xsign-proxy-test.spec  | 78 +++++++++----------
 1 file changed, 39 insertions(+), 39 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 7d063b16cb8..812da413a85 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -22,55 +22,55 @@ cp %{SOURCE0} .
 echo "=== Testing xsign-proxy connectivity ==="
 
 # Test 1: Verify the client script is available in the chroot
-if [ -x /usr/local/bin/xsign_proxy_client.py ]; then
-    echo "PASS: xsign_proxy_client.py is present and executable"
-else
-    echo "FAIL: xsign_proxy_client.py not found or not executable"
-    exit 1
-fi
+# if [ -x /usr/local/bin/xsign_proxy_client.py ]; then
+#     echo "PASS: xsign_proxy_client.py is present and executable"
+# else
+#     echo "FAIL: xsign_proxy_client.py not found or not executable"
+#     exit 1
+# fi
 
 # Test 2: Verify the socket directory is bind-mounted
-if [ -d /var/run/xsign-proxy ]; then
-    echo "PASS: Socket directory /var/run/xsign-proxy exists"
-else
-    echo "FAIL: Socket directory /var/run/xsign-proxy not found"
-    exit 1
-fi
+# if [ -d /var/run/xsign-proxy ]; then
+#     echo "PASS: Socket directory /var/run/xsign-proxy exists"
+# else
+#     echo "FAIL: Socket directory /var/run/xsign-proxy not found"
+#     exit 1
+# fi
 
 # Test 3: Verify the exchange directory is bind-mounted
-if [ -d /var/lib/xsign-exchange ]; then
-    echo "PASS: Exchange directory /var/lib/xsign-exchange exists"
-else
-    echo "FAIL: Exchange directory /var/lib/xsign-exchange not found"
-    exit 1
-fi
+# if [ -d /var/lib/xsign-exchange ]; then
+#     echo "PASS: Exchange directory /var/lib/xsign-exchange exists"
+# else
+#     echo "FAIL: Exchange directory /var/lib/xsign-exchange not found"
+#     exit 1
+# fi
 
 # Test 4: Ping the daemon to verify connectivity
-echo "Pinging xsign-proxy-d daemon..."
-if /usr/local/bin/xsign_proxy_client.py ping; then
-    echo "PASS: Daemon responded to ping"
-else
-    echo "FAIL: Daemon did not respond to ping"
-    exit 1
-fi
+# echo "Pinging xsign-proxy-d daemon..."
+# if /usr/local/bin/xsign_proxy_client.py ping; then
+#     echo "PASS: Daemon responded to ping"
+# else
+#     echo "FAIL: Daemon did not respond to ping"
+#     exit 1
+# fi
 
 # Test 5: Create a test file in the exchange directory and submit it for signing
-TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.txt"
-echo "This is a test file for xsign-proxy signing" > "$TEST_FILE"
-echo "Created test file: $TEST_FILE"
-
-echo "Submitting test file for signing..."
-if /usr/local/bin/xsign_proxy_client.py sign "$TEST_FILE"; then
-    echo "PASS: Sign request submitted successfully"
-else
-    echo "FAIL: Sign request failed"
-    rm -f "$TEST_FILE"
-    exit 1
-fi
+# TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.txt"
+# echo "This is a test file for xsign-proxy signing" > "$TEST_FILE"
+# echo "Created test file: $TEST_FILE"
+
+# echo "Submitting test file for signing..."
+# if /usr/local/bin/xsign_proxy_client.py sign "$TEST_FILE"; then
+#     echo "PASS: Sign request submitted successfully"
+# else
+#     echo "FAIL: Sign request failed"
+#     rm -f "$TEST_FILE"
+#     exit 1
+# fi
 
 # Clean up test file
-rm -f "$TEST_FILE"
-echo "=== All xsign-proxy tests passed ==="
+# rm -f "$TEST_FILE"
+# echo "=== All xsign-proxy tests passed ==="
 
 %install
 mkdir -p %{buildroot}%{_docdir}/%{name}

From fc135ab6593c3c85077ba1cc1dec5e05fa16dacf Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Mon, 10 Aug 2026 16:16:39 -0700
Subject: [PATCH 03/29] Enable testing the proxy

---
 .../x/xsign-proxy-test/xsign-proxy-test.spec  | 67 +++++++++----------
 1 file changed, 31 insertions(+), 36 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 812da413a85..6a502722a47 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -22,55 +22,50 @@ cp %{SOURCE0} .
 echo "=== Testing xsign-proxy connectivity ==="
 
 # Test 1: Verify the client script is available in the chroot
-# if [ -x /usr/local/bin/xsign_proxy_client.py ]; then
-#     echo "PASS: xsign_proxy_client.py is present and executable"
-# else
-#     echo "FAIL: xsign_proxy_client.py not found or not executable"
-#     exit 1
-# fi
+if [ -x /usr/local/bin/xsign_proxy_client.py ]; then
+    echo "PASS: xsign_proxy_client.py is present and executable"
+else
+    echo "FAIL: xsign_proxy_client.py not found or not executable"
+fi
 
 # Test 2: Verify the socket directory is bind-mounted
-# if [ -d /var/run/xsign-proxy ]; then
-#     echo "PASS: Socket directory /var/run/xsign-proxy exists"
-# else
-#     echo "FAIL: Socket directory /var/run/xsign-proxy not found"
-#     exit 1
-# fi
+if [ -d /var/run/xsign-proxy ]; then
+    echo "PASS: Socket directory /var/run/xsign-proxy exists"
+else
+    echo "FAIL: Socket directory /var/run/xsign-proxy not found"
+fi
 
 # Test 3: Verify the exchange directory is bind-mounted
-# if [ -d /var/lib/xsign-exchange ]; then
-#     echo "PASS: Exchange directory /var/lib/xsign-exchange exists"
-# else
-#     echo "FAIL: Exchange directory /var/lib/xsign-exchange not found"
-#     exit 1
-# fi
+if [ -d /var/lib/xsign-exchange ]; then
+    echo "PASS: Exchange directory /var/lib/xsign-exchange exists"
+else
+    echo "FAIL: Exchange directory /var/lib/xsign-exchange not found"
+fi
 
 # Test 4: Ping the daemon to verify connectivity
-# echo "Pinging xsign-proxy-d daemon..."
-# if /usr/local/bin/xsign_proxy_client.py ping; then
+echo "Pinging xsign-proxy-d daemon..."
+if /usr/local/bin/xsign_proxy_client.py ping; then
 #     echo "PASS: Daemon responded to ping"
-# else
-#     echo "FAIL: Daemon did not respond to ping"
-#     exit 1
-# fi
+else
+    echo "FAIL: Daemon did not respond to ping"
+fi
 
 # Test 5: Create a test file in the exchange directory and submit it for signing
-# TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.txt"
-# echo "This is a test file for xsign-proxy signing" > "$TEST_FILE"
-# echo "Created test file: $TEST_FILE"
+TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.txt"
+echo "This is a test file for xsign-proxy signing" > "$TEST_FILE"
+echo "Created test file: $TEST_FILE"
 
 # echo "Submitting test file for signing..."
-# if /usr/local/bin/xsign_proxy_client.py sign "$TEST_FILE"; then
-#     echo "PASS: Sign request submitted successfully"
-# else
-#     echo "FAIL: Sign request failed"
-#     rm -f "$TEST_FILE"
-#     exit 1
-# fi
+if /usr/local/bin/xsign_proxy_client.py sign "$TEST_FILE"; then
+    echo "PASS: Sign request submitted successfully"
+else
+    echo "FAIL: Sign request failed"
+    rm -f "$TEST_FILE"
+fi
 
 # Clean up test file
-# rm -f "$TEST_FILE"
-# echo "=== All xsign-proxy tests passed ==="
+rm -f "$TEST_FILE"
+echo "=== All xsign-proxy tests passed ==="
 
 %install
 mkdir -p %{buildroot}%{_docdir}/%{name}

From ab2055f889167dad1c78e6523fb647ec12e8a076 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Mon, 10 Aug 2026 16:26:17 -0700
Subject: [PATCH 04/29] Fix typo

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 6a502722a47..f6b56073dd0 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -45,7 +45,7 @@ fi
 # Test 4: Ping the daemon to verify connectivity
 echo "Pinging xsign-proxy-d daemon..."
 if /usr/local/bin/xsign_proxy_client.py ping; then
-#     echo "PASS: Daemon responded to ping"
+    echo "PASS: Daemon responded to ping"
 else
     echo "FAIL: Daemon did not respond to ping"
 fi

From 88d0a1dfc812c1c2532dd47b720a2f58c440ff77 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Mon, 10 Aug 2026 16:38:22 -0700
Subject: [PATCH 05/29] Fix typo

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index f6b56073dd0..ed772f6f39d 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -8,7 +8,8 @@ URL:            https://example.com/xsign-proxy-test
 
 Source0:        README
 
-BuildArch:      noarch
+BuildArch:      amd64
+BuildRequires:  python3
 
 %description
 A dummy package that exercises the xsign-proxy-client during the build phase.
@@ -55,7 +56,7 @@ TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.txt"
 echo "This is a test file for xsign-proxy signing" > "$TEST_FILE"
 echo "Created test file: $TEST_FILE"
 
-# echo "Submitting test file for signing..."
+echo "Submitting test file for signing..."
 if /usr/local/bin/xsign_proxy_client.py sign "$TEST_FILE"; then
     echo "PASS: Sign request submitted successfully"
 else

From 0d5841b944135b2d657d84f49ddf1813db145ca1 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Mon, 10 Aug 2026 16:49:44 -0700
Subject: [PATCH 06/29] Fix architecture

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index ed772f6f39d..e674ac12eed 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -8,7 +8,7 @@ URL:            https://example.com/xsign-proxy-test
 
 Source0:        README
 
-BuildArch:      amd64
+BuildArch:      x86_64
 BuildRequires:  python3
 
 %description

From 9b3c865b097b7a901ab4f0c8044bef97153c8e56 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Tue, 11 Aug 2026 12:38:48 -0700
Subject: [PATCH 07/29] Fix architecture

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index e674ac12eed..436ba5b7335 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -8,7 +8,7 @@ URL:            https://example.com/xsign-proxy-test
 
 Source0:        README
 
-BuildArch:      x86_64
+BuildArch:      noarch
 BuildRequires:  python3
 
 %description

From 4f74e1db93d34435f29db5d96165b8121aef7b3a Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 12 Aug 2026 14:14:48 -0700
Subject: [PATCH 08/29] Update spec file with new xsign-proxy-client parameters

---
 .../x/xsign-proxy-test/xsign-proxy-test.spec  | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 436ba5b7335..bd3bc36562c 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -52,27 +52,32 @@ else
 fi
 
 # Test 5: Create a test file in the exchange directory and submit it for signing
-TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.txt"
-echo "This is a test file for xsign-proxy signing" > "$TEST_FILE"
-echo "Created test file: $TEST_FILE"
+UNSIGNED_TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.txt"
+SIGNED_TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.signed.txt"
+echo "This is a test file for xsign-proxy signing" > "$UNSIGNED_TEST_FILE"
+echo "Created test file: $UNSIGNED_TEST_FILE"
 
 echo "Submitting test file for signing..."
-if /usr/local/bin/xsign_proxy_client.py sign "$TEST_FILE"; then
+if /usr/local/bin/xsign_proxy_client.py sign \
+    --input-file "$UNSIGNED_TEST_FILE" \
+    --output-file "$SIGNED_TEST_FILE"; then
     echo "PASS: Sign request submitted successfully"
 else
     echo "FAIL: Sign request failed"
-    rm -f "$TEST_FILE"
 fi
 
-# Clean up test file
-rm -f "$TEST_FILE"
+# Clean up test files
+# rm -f "$UNSIGNED_TEST_FILE" "$SIGNED_TEST_FILE"
 echo "=== All xsign-proxy tests passed ==="
 
 %install
 mkdir -p %{buildroot}%{_docdir}/%{name}
 echo "xsign-proxy-test package installed successfully" > %{buildroot}%{_docdir}/%{name}/README
+install -D -m 0644 "$SIGNED_TEST_FILE" \
+    %{buildroot}%{_sysconfdir}/xsign-proxy-test.signed.txt
 
 %files
+%config(noreplace) %{_sysconfdir}/xsign-proxy-test.signed.txt
 %{_docdir}/%{name}/README
 
 %changelog

From 5596cff98405f2d640f1ab0455d0ed06c468b707 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 12 Aug 2026 14:31:12 -0700
Subject: [PATCH 09/29] Fix env vars

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index bd3bc36562c..3abfaf045d0 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -61,16 +61,22 @@ echo "Submitting test file for signing..."
 if /usr/local/bin/xsign_proxy_client.py sign \
     --input-file "$UNSIGNED_TEST_FILE" \
     --output-file "$SIGNED_TEST_FILE"; then
-    echo "PASS: Sign request submitted successfully"
+    echo "PASS: Sign request completed successfully"
 else
     echo "FAIL: Sign request failed"
 fi
 
+ls -la "$UNSIGNED_TEST_FILE"
+ls -la "$SIGNED_TEST_FILE"
+
 # Clean up test files
 # rm -f "$UNSIGNED_TEST_FILE" "$SIGNED_TEST_FILE"
 echo "=== All xsign-proxy tests passed ==="
 
 %install
+UNSIGNED_TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.txt"
+SIGNED_TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.signed.txt"
+
 mkdir -p %{buildroot}%{_docdir}/%{name}
 echo "xsign-proxy-test package installed successfully" > %{buildroot}%{_docdir}/%{name}/README
 install -D -m 0644 "$SIGNED_TEST_FILE" \

From a6c58fd4bd9d9545f1b9a554e957aa7634675b17 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 12 Aug 2026 16:47:30 -0700
Subject: [PATCH 10/29] Use non-exchange paths

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 3abfaf045d0..8889c24c377 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -52,8 +52,8 @@ else
 fi
 
 # Test 5: Create a test file in the exchange directory and submit it for signing
-UNSIGNED_TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.txt"
-SIGNED_TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.signed.txt"
+UNSIGNED_TEST_FILE="/var/lib/test-file-%{name}-%{version}.txt"
+SIGNED_TEST_FILE="/var/lib/test-file-%{name}-%{version}.signed.txt"
 echo "This is a test file for xsign-proxy signing" > "$UNSIGNED_TEST_FILE"
 echo "Created test file: $UNSIGNED_TEST_FILE"
 
@@ -74,8 +74,8 @@ ls -la "$SIGNED_TEST_FILE"
 echo "=== All xsign-proxy tests passed ==="
 
 %install
-UNSIGNED_TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.txt"
-SIGNED_TEST_FILE="/var/lib/xsign-exchange/test-file-%{name}-%{version}.signed.txt"
+UNSIGNED_TEST_FILE="/var/lib/test-file-%{name}-%{version}.txt"
+SIGNED_TEST_FILE="/var/lib/test-file-%{name}-%{version}.signed.txt"
 
 mkdir -p %{buildroot}%{_docdir}/%{name}
 echo "xsign-proxy-test package installed successfully" > %{buildroot}%{_docdir}/%{name}/README

From 9d08693a6e1a927775e137385c264e543b6ffcdc Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 12 Aug 2026 16:52:07 -0700
Subject: [PATCH 11/29] Print

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 8889c24c377..698c5b36ee3 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -68,6 +68,8 @@ fi
 
 ls -la "$UNSIGNED_TEST_FILE"
 ls -la "$SIGNED_TEST_FILE"
+ls -la /var/lib/xsign-exchange/
+find /var/lib/xsign-exchange/
 
 # Clean up test files
 # rm -f "$UNSIGNED_TEST_FILE" "$SIGNED_TEST_FILE"

From 7c780aaaea542b6d334fd46e1f0236776e69c89b Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 12 Aug 2026 17:00:41 -0700
Subject: [PATCH 12/29] Create in arbitrary paths

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 698c5b36ee3..5b71f9cddf8 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -51,9 +51,9 @@ else
     echo "FAIL: Daemon did not respond to ping"
 fi
 
-# Test 5: Create a test file in the exchange directory and submit it for signing
-UNSIGNED_TEST_FILE="/var/lib/test-file-%{name}-%{version}.txt"
-SIGNED_TEST_FILE="/var/lib/test-file-%{name}-%{version}.signed.txt"
+# Test 5: Create a test file in the writable RPM build directory and submit it for signing
+UNSIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
+SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.signed.txt"
 echo "This is a test file for xsign-proxy signing" > "$UNSIGNED_TEST_FILE"
 echo "Created test file: $UNSIGNED_TEST_FILE"
 
@@ -76,8 +76,8 @@ find /var/lib/xsign-exchange/
 echo "=== All xsign-proxy tests passed ==="
 
 %install
-UNSIGNED_TEST_FILE="/var/lib/test-file-%{name}-%{version}.txt"
-SIGNED_TEST_FILE="/var/lib/test-file-%{name}-%{version}.signed.txt"
+UNSIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
+SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.signed.txt"
 
 mkdir -p %{buildroot}%{_docdir}/%{name}
 echo "xsign-proxy-test package installed successfully" > %{buildroot}%{_docdir}/%{name}/README

From dd2ad8ee1833cb1b76f6bf50a6f6f130cae884cc Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 12 Aug 2026 17:09:03 -0700
Subject: [PATCH 13/29] Create in arbitrary paths

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 5b71f9cddf8..9c2a82923b0 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -52,6 +52,7 @@ else
 fi
 
 # Test 5: Create a test file in the writable RPM build directory and submit it for signing
+mkdir -p %{_builddir}/%{name}-%{version}
 UNSIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
 SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.signed.txt"
 echo "This is a test file for xsign-proxy signing" > "$UNSIGNED_TEST_FILE"

From 07881cc224c1d15b2cdec732e7df10e15d36a5b2 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 12 Aug 2026 20:04:51 -0700
Subject: [PATCH 14/29] Remove exchange

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 9c2a82923b0..865e39506de 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -36,14 +36,7 @@ else
     echo "FAIL: Socket directory /var/run/xsign-proxy not found"
 fi
 
-# Test 3: Verify the exchange directory is bind-mounted
-if [ -d /var/lib/xsign-exchange ]; then
-    echo "PASS: Exchange directory /var/lib/xsign-exchange exists"
-else
-    echo "FAIL: Exchange directory /var/lib/xsign-exchange not found"
-fi
-
-# Test 4: Ping the daemon to verify connectivity
+# Test 3: Ping the daemon to verify connectivity
 echo "Pinging xsign-proxy-d daemon..."
 if /usr/local/bin/xsign_proxy_client.py ping; then
     echo "PASS: Daemon responded to ping"
@@ -51,7 +44,7 @@ else
     echo "FAIL: Daemon did not respond to ping"
 fi
 
-# Test 5: Create a test file in the writable RPM build directory and submit it for signing
+# Test 4: Create a test file in the writable RPM build directory and submit it for signing
 mkdir -p %{_builddir}/%{name}-%{version}
 UNSIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
 SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.signed.txt"
@@ -69,8 +62,6 @@ fi
 
 ls -la "$UNSIGNED_TEST_FILE"
 ls -la "$SIGNED_TEST_FILE"
-ls -la /var/lib/xsign-exchange/
-find /var/lib/xsign-exchange/
 
 # Clean up test files
 # rm -f "$UNSIGNED_TEST_FILE" "$SIGNED_TEST_FILE"

From d01c0a55b0984cd743e98764fe61faba7e3004cf Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 12 Aug 2026 20:17:10 -0700
Subject: [PATCH 15/29] Fix date

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 865e39506de..36a3f194b39 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -81,5 +81,5 @@ install -D -m 0644 "$SIGNED_TEST_FILE" \
 %{_docdir}/%{name}/README
 
 %changelog
-* Thu Jun 26 2026 Test User <test@example.com> - 1.0.0-1
+* Fri Jun 26 2026 Test User <test@example.com> - 1.0.0-1
 - Initial package to test xsign-proxy client-server communication

From a8c278a829c3090e518b6b3f602c03bb06c0256a Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 12 Aug 2026 21:27:38 -0700
Subject: [PATCH 16/29] Retrieve tag name

---
 .../x/xsign-proxy-test/xsign-proxy-test.spec  | 43 +++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 36a3f194b39..ecc7e821542 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -22,6 +22,38 @@ cp %{SOURCE0} .
 %build
 echo "=== Testing xsign-proxy connectivity ==="
 
+# Function to retrieve the Mock buildroot name from chroot files
+get_buildroot_name() {
+    local buildroot_name
+    
+    # Method 1: Read from /etc/mock/default.cfg (created by Mock inside chroot)
+    if [ -f /etc/mock/default.cfg ]; then
+        buildroot_name=$(grep -oP "config_opts\['root'\]\s*=\s*['\047]\K[^\047]*" /etc/mock/default.cfg | head -1)
+        if [ -n "$buildroot_name" ]; then
+            echo "$buildroot_name"
+            return 0
+        fi
+    fi
+    
+    # Method 2: Parse /proc/self/cgroup for mock hints
+    if [ -f /proc/self/cgroup ]; then
+        buildroot_name=$(grep -oP 'mock[.-]\K[^/.\s]+' /proc/self/cgroup | head -1)
+        if [ -n "$buildroot_name" ]; then
+            echo "$buildroot_name"
+            return 0
+        fi
+    fi
+    
+    return 1
+}
+
+# Function to extract the Koji build tag from buildroot name
+parse_build_tag() {
+    local buildroot_name=$1
+    # Strip trailing -<digits>-<digits> suffix added by mock
+    echo "$buildroot_name" | sed 's/-[0-9]\+-[0-9]\+$//'
+}
+
 # Test 1: Verify the client script is available in the chroot
 if [ -x /usr/local/bin/xsign_proxy_client.py ]; then
     echo "PASS: xsign_proxy_client.py is present and executable"
@@ -36,6 +68,17 @@ else
     echo "FAIL: Socket directory /var/run/xsign-proxy not found"
 fi
 
+# Test 2.5: Retrieve and display the buildroot name and build tag
+echo "Retrieving buildroot name..."
+buildroot_name=$(get_buildroot_name)
+if [ -n "$buildroot_name" ]; then
+    echo "PASS: Retrieved buildroot name: $buildroot_name"
+    build_tag=$(parse_build_tag "$buildroot_name")
+    echo "      Extracted build tag: $build_tag"
+else
+    echo "WARN: Could not retrieve buildroot name from chroot files"
+fi
+
 # Test 3: Ping the daemon to verify connectivity
 echo "Pinging xsign-proxy-d daemon..."
 if /usr/local/bin/xsign_proxy_client.py ping; then

From 5753d199fc059b01ee2541b0ed141513e4113e0d Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 12 Aug 2026 22:30:10 -0700
Subject: [PATCH 17/29] Using tag_info

---
 .../x/xsign-proxy-test/xsign-proxy-test.spec  | 68 ++++++++-----------
 1 file changed, 29 insertions(+), 39 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index ecc7e821542..5ab68e4c1bb 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -22,38 +22,18 @@ cp %{SOURCE0} .
 %build
 echo "=== Testing xsign-proxy connectivity ==="
 
-# Function to retrieve the Mock buildroot name from chroot files
-get_buildroot_name() {
-    local buildroot_name
-    
-    # Method 1: Read from /etc/mock/default.cfg (created by Mock inside chroot)
-    if [ -f /etc/mock/default.cfg ]; then
-        buildroot_name=$(grep -oP "config_opts\['root'\]\s*=\s*['\047]\K[^\047]*" /etc/mock/default.cfg | head -1)
-        if [ -n "$buildroot_name" ]; then
-            echo "$buildroot_name"
-            return 0
-        fi
+# Path written by the tag_info mock plugin before the build starts.
+KOJI_BUILD_TAG_FILE=/etc/koji-build-tag
+
+# Read the Koji build tag published into the chroot by the tag_info plugin.
+get_build_tag() {
+    if [ -r "$KOJI_BUILD_TAG_FILE" ]; then
+        tr -d '[:space:]' < "$KOJI_BUILD_TAG_FILE"
+        return 0
     fi
-    
-    # Method 2: Parse /proc/self/cgroup for mock hints
-    if [ -f /proc/self/cgroup ]; then
-        buildroot_name=$(grep -oP 'mock[.-]\K[^/.\s]+' /proc/self/cgroup | head -1)
-        if [ -n "$buildroot_name" ]; then
-            echo "$buildroot_name"
-            return 0
-        fi
-    fi
-    
     return 1
 }
 
-# Function to extract the Koji build tag from buildroot name
-parse_build_tag() {
-    local buildroot_name=$1
-    # Strip trailing -<digits>-<digits> suffix added by mock
-    echo "$buildroot_name" | sed 's/-[0-9]\+-[0-9]\+$//'
-}
-
 # Test 1: Verify the client script is available in the chroot
 if [ -x /usr/local/bin/xsign_proxy_client.py ]; then
     echo "PASS: xsign_proxy_client.py is present and executable"
@@ -68,15 +48,13 @@ else
     echo "FAIL: Socket directory /var/run/xsign-proxy not found"
 fi
 
-# Test 2.5: Retrieve and display the buildroot name and build tag
-echo "Retrieving buildroot name..."
-buildroot_name=$(get_buildroot_name)
-if [ -n "$buildroot_name" ]; then
-    echo "PASS: Retrieved buildroot name: $buildroot_name"
-    build_tag=$(parse_build_tag "$buildroot_name")
-    echo "      Extracted build tag: $build_tag"
+# Test 2.5: Read and display the Koji build tag written by the tag_info plugin
+echo "Reading Koji build tag from $KOJI_BUILD_TAG_FILE..."
+build_tag=$(get_build_tag)
+if [ -n "$build_tag" ]; then
+    echo "PASS: Koji build tag: $build_tag"
 else
-    echo "WARN: Could not retrieve buildroot name from chroot files"
+    echo "WARN: Could not read Koji build tag from $KOJI_BUILD_TAG_FILE"
 fi
 
 # Test 3: Ping the daemon to verify connectivity
@@ -104,7 +82,12 @@ else
 fi
 
 ls -la "$UNSIGNED_TEST_FILE"
-ls -la "$SIGNED_TEST_FILE"
+# On unsigned tags the client skips the request, so no signed file is produced.
+if [ -f "$SIGNED_TEST_FILE" ]; then
+    ls -la "$SIGNED_TEST_FILE"
+else
+    echo "No signed file produced (expected on tags that are not signed tags)"
+fi
 
 # Clean up test files
 # rm -f "$UNSIGNED_TEST_FILE" "$SIGNED_TEST_FILE"
@@ -116,8 +99,15 @@ SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.s
 
 mkdir -p %{buildroot}%{_docdir}/%{name}
 echo "xsign-proxy-test package installed successfully" > %{buildroot}%{_docdir}/%{name}/README
-install -D -m 0644 "$SIGNED_TEST_FILE" \
-    %{buildroot}%{_sysconfdir}/xsign-proxy-test.signed.txt
+# Fall back to the unsigned file so the package still builds on tags where the
+# client intentionally skips signing.
+if [ -f "$SIGNED_TEST_FILE" ]; then
+    install -D -m 0644 "$SIGNED_TEST_FILE" \
+        %{buildroot}%{_sysconfdir}/xsign-proxy-test.signed.txt
+else
+    install -D -m 0644 "$UNSIGNED_TEST_FILE" \
+        %{buildroot}%{_sysconfdir}/xsign-proxy-test.signed.txt
+fi
 
 %files
 %config(noreplace) %{_sysconfdir}/xsign-proxy-test.signed.txt

From 1776a7abc83dfdbbac0250e0400c7a8f2caf52c9 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Sat, 15 Aug 2026 08:27:25 -0700
Subject: [PATCH 18/29] Remove tag references

---
 .../x/xsign-proxy-test/xsign-proxy-test.spec  | 39 ++-----------------
 1 file changed, 3 insertions(+), 36 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 5ab68e4c1bb..36a3f194b39 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -22,18 +22,6 @@ cp %{SOURCE0} .
 %build
 echo "=== Testing xsign-proxy connectivity ==="
 
-# Path written by the tag_info mock plugin before the build starts.
-KOJI_BUILD_TAG_FILE=/etc/koji-build-tag
-
-# Read the Koji build tag published into the chroot by the tag_info plugin.
-get_build_tag() {
-    if [ -r "$KOJI_BUILD_TAG_FILE" ]; then
-        tr -d '[:space:]' < "$KOJI_BUILD_TAG_FILE"
-        return 0
-    fi
-    return 1
-}
-
 # Test 1: Verify the client script is available in the chroot
 if [ -x /usr/local/bin/xsign_proxy_client.py ]; then
     echo "PASS: xsign_proxy_client.py is present and executable"
@@ -48,15 +36,6 @@ else
     echo "FAIL: Socket directory /var/run/xsign-proxy not found"
 fi
 
-# Test 2.5: Read and display the Koji build tag written by the tag_info plugin
-echo "Reading Koji build tag from $KOJI_BUILD_TAG_FILE..."
-build_tag=$(get_build_tag)
-if [ -n "$build_tag" ]; then
-    echo "PASS: Koji build tag: $build_tag"
-else
-    echo "WARN: Could not read Koji build tag from $KOJI_BUILD_TAG_FILE"
-fi
-
 # Test 3: Ping the daemon to verify connectivity
 echo "Pinging xsign-proxy-d daemon..."
 if /usr/local/bin/xsign_proxy_client.py ping; then
@@ -82,12 +61,7 @@ else
 fi
 
 ls -la "$UNSIGNED_TEST_FILE"
-# On unsigned tags the client skips the request, so no signed file is produced.
-if [ -f "$SIGNED_TEST_FILE" ]; then
-    ls -la "$SIGNED_TEST_FILE"
-else
-    echo "No signed file produced (expected on tags that are not signed tags)"
-fi
+ls -la "$SIGNED_TEST_FILE"
 
 # Clean up test files
 # rm -f "$UNSIGNED_TEST_FILE" "$SIGNED_TEST_FILE"
@@ -99,15 +73,8 @@ SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.s
 
 mkdir -p %{buildroot}%{_docdir}/%{name}
 echo "xsign-proxy-test package installed successfully" > %{buildroot}%{_docdir}/%{name}/README
-# Fall back to the unsigned file so the package still builds on tags where the
-# client intentionally skips signing.
-if [ -f "$SIGNED_TEST_FILE" ]; then
-    install -D -m 0644 "$SIGNED_TEST_FILE" \
-        %{buildroot}%{_sysconfdir}/xsign-proxy-test.signed.txt
-else
-    install -D -m 0644 "$UNSIGNED_TEST_FILE" \
-        %{buildroot}%{_sysconfdir}/xsign-proxy-test.signed.txt
-fi
+install -D -m 0644 "$SIGNED_TEST_FILE" \
+    %{buildroot}%{_sysconfdir}/xsign-proxy-test.signed.txt
 
 %files
 %config(noreplace) %{_sysconfdir}/xsign-proxy-test.signed.txt

From 454c1af5e86ff92a913a8359cc22f5f857c38599 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Sun, 16 Aug 2026 00:24:45 -0700
Subject: [PATCH 19/29] Update test spec

---
 .../x/xsign-proxy-test/xsign-proxy-test.spec  | 85 +++++++++----------
 1 file changed, 39 insertions(+), 46 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 36a3f194b39..da165a7b904 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -20,65 +20,58 @@ within the mock chroot via the bind-mounted Unix socket.
 cp %{SOURCE0} .
 
 %build
-echo "=== Testing xsign-proxy connectivity ==="
 
-# Test 1: Verify the client script is available in the chroot
-if [ -x /usr/local/bin/xsign_proxy_client.py ]; then
-    echo "PASS: xsign_proxy_client.py is present and executable"
-else
-    echo "FAIL: xsign_proxy_client.py not found or not executable"
-fi
+echo "=== Building the binary ==="
+TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
+mkdir -p %{_builddir}/%{name}-%{version}
+echo "This is a test file for xsign-proxy signing" > "$TEST_FILE"
+echo "Created test file: $TEST_FILE"
 
-# Test 2: Verify the socket directory is bind-mounted
-if [ -d /var/run/xsign-proxy ]; then
-    echo "PASS: Socket directory /var/run/xsign-proxy exists"
-else
-    echo "FAIL: Socket directory /var/run/xsign-proxy not found"
-fi
+XSIGN_PROXY_CLIENT=/usr/local/bin/xsign_proxy_client.py
 
-# Test 3: Ping the daemon to verify connectivity
-echo "Pinging xsign-proxy-d daemon..."
-if /usr/local/bin/xsign_proxy_client.py ping; then
+# Are we running on a secure-boot image?
+if [ -x "$XSIGN_PROXY_CLIENT" ]; then
+
+    SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
+
+    echo "===  verify the socket directory is bind-mounted ==="
+    if [ ! -d /var/run/xsign-proxy ]; then
+        echo "FAIL: Socket directory /var/run/xsign-proxy not found"
+        exit 1
+    fi
+
+    echo "===  pinging xsign-proxy-d daemon ==="
+    "$XSIGN_PROXY_CLIENT" ping
     echo "PASS: Daemon responded to ping"
-else
-    echo "FAIL: Daemon did not respond to ping"
-fi
 
-# Test 4: Create a test file in the writable RPM build directory and submit it for signing
-mkdir -p %{_builddir}/%{name}-%{version}
-UNSIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
-SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.signed.txt"
-echo "This is a test file for xsign-proxy signing" > "$UNSIGNED_TEST_FILE"
-echo "Created test file: $UNSIGNED_TEST_FILE"
-
-echo "Submitting test file for signing..."
-if /usr/local/bin/xsign_proxy_client.py sign \
-    --input-file "$UNSIGNED_TEST_FILE" \
-    --output-file "$SIGNED_TEST_FILE"; then
+    echo "=== signing the test file ==="
+    "$XSIGN_PROXY_CLIENT" sign \
+        --input-file "$TEST_FILE" \
+        --output-file "$SIGNED_TEST_FILE"
     echo "PASS: Sign request completed successfully"
-else
-    echo "FAIL: Sign request failed"
-fi
 
-ls -la "$UNSIGNED_TEST_FILE"
-ls -la "$SIGNED_TEST_FILE"
+    ls -la "$TEST_FILE"
+    ls -la "$SIGNED_TEST_FILE"
 
-# Clean up test files
-# rm -f "$UNSIGNED_TEST_FILE" "$SIGNED_TEST_FILE"
-echo "=== All xsign-proxy tests passed ==="
+    echo "=== secure boot signing completed ==="
+else
+    echo "=== skipped secure boot signing ==="
+fi
 
 %install
-UNSIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
-SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.signed.txt"
+TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
+SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
 
-mkdir -p %{buildroot}%{_docdir}/%{name}
-echo "xsign-proxy-test package installed successfully" > %{buildroot}%{_docdir}/%{name}/README
-install -D -m 0644 "$SIGNED_TEST_FILE" \
-    %{buildroot}%{_sysconfdir}/xsign-proxy-test.signed.txt
+if [ -f "$SIGNED_TEST_FILE" ]; then
+    install -D -m 0644 "$SIGNED_TEST_FILE" \
+        %{buildroot}%{_sysconfdir}/xsign-proxy-test.txt
+else
+    install -D -m 0644 "$TEST_FILE" \
+        %{buildroot}%{_sysconfdir}/xsign-proxy-test.txt
+fi
 
 %files
-%config(noreplace) %{_sysconfdir}/xsign-proxy-test.signed.txt
-%{_docdir}/%{name}/README
+%config(noreplace) %{_sysconfdir}/xsign-proxy-test.txt
 
 %changelog
 * Fri Jun 26 2026 Test User <test@example.com> - 1.0.0-1

From 60015ae71f5b04e9fcc3d25788bcfee5c30822ae Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 19 Aug 2026 13:41:45 -0700
Subject: [PATCH 20/29] Add pesign

---
 .../x/xsign-proxy-test/xsign-proxy-test.spec  | 31 +++++++++----------
 1 file changed, 14 insertions(+), 17 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index da165a7b904..9d80cd7f6d8 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -27,28 +27,25 @@ mkdir -p %{_builddir}/%{name}-%{version}
 echo "This is a test file for xsign-proxy signing" > "$TEST_FILE"
 echo "Created test file: $TEST_FILE"
 
-XSIGN_PROXY_CLIENT=/usr/local/bin/xsign_proxy_client.py
+# Check if pesign is available for direct signing
+PESIGN_CLIENT=/usr/bin/pesign
 
 # Are we running on a secure-boot image?
-if [ -x "$XSIGN_PROXY_CLIENT" ]; then
+if [ -x "$PESIGN_CLIENT" ]; then
 
     SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
 
-    echo "===  verify the socket directory is bind-mounted ==="
-    if [ ! -d /var/run/xsign-proxy ]; then
-        echo "FAIL: Socket directory /var/run/xsign-proxy not found"
-        exit 1
-    fi
-
-    echo "===  pinging xsign-proxy-d daemon ==="
-    "$XSIGN_PROXY_CLIENT" ping
-    echo "PASS: Daemon responded to ping"
-
-    echo "=== signing the test file ==="
-    "$XSIGN_PROXY_CLIENT" sign \
-        --input-file "$TEST_FILE" \
-        --output-file "$SIGNED_TEST_FILE"
-    echo "PASS: Sign request completed successfully"
+    echo "=== Using pesign for secure-boot signing ==="
+    
+    # Sign using pesign-client
+    echo "=== signing the test file with pesign ==="
+    sudo -u pesign pesign-client \
+        --sign \
+        --token "OpenSC Card" \
+        --certificate "IPL" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+    echo "PASS: pesign sign request completed successfully"
 
     ls -la "$TEST_FILE"
     ls -la "$SIGNED_TEST_FILE"

From 35643fdd088258a65c2bd59ccbe14f52475807fb Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 19 Aug 2026 14:06:47 -0700
Subject: [PATCH 21/29] Update spec

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 9d80cd7f6d8..ae648f1935f 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -39,7 +39,7 @@ if [ -x "$PESIGN_CLIENT" ]; then
     
     # Sign using pesign-client
     echo "=== signing the test file with pesign ==="
-    sudo -u pesign pesign-client \
+    pesign pesign-client \
         --sign \
         --token "OpenSC Card" \
         --certificate "IPL" \

From 09450004da63033a3e50680028443a45f3b05499 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 19 Aug 2026 14:42:21 -0700
Subject: [PATCH 22/29] Install pesign inside mock

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 1 +
 1 file changed, 1 insertion(+)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index ae648f1935f..24a89c534c1 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -10,6 +10,7 @@ Source0:        README
 
 BuildArch:      noarch
 BuildRequires:  python3
+BuildRequires:  pesign
 
 %description
 A dummy package that exercises the xsign-proxy-client during the build phase.

From b910db5e6cab833feb026abd2a4b0bad9821d463 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Thu, 20 Aug 2026 16:24:49 -0700
Subject: [PATCH 23/29] Update pesign parameters

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 24a89c534c1..a647905bbb5 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -44,8 +44,8 @@ if [ -x "$PESIGN_CLIENT" ]; then
         --sign \
         --token "OpenSC Card" \
         --certificate "IPL" \
-        --infile "$TEST_FILE" \
-        --outfile "$SIGNED_TEST_FILE"
+        --in "$TEST_FILE" \
+        --out "$SIGNED_TEST_FILE"
     echo "PASS: pesign sign request completed successfully"
 
     ls -la "$TEST_FILE"

From 745576e9e88cca1ba76563cecbf55e90b6ef02b8 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Fri, 21 Aug 2026 11:08:07 -0700
Subject: [PATCH 24/29] Fix pesign-client call

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index a647905bbb5..82654746d78 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -40,12 +40,14 @@ if [ -x "$PESIGN_CLIENT" ]; then
     
     # Sign using pesign-client
     echo "=== signing the test file with pesign ==="
-    pesign pesign-client \
+    pesign-client \
+        --verbose \
+        --debug \
         --sign \
-        --token "OpenSC Card" \
-        --certificate "IPL" \
-        --in "$TEST_FILE" \
-        --out "$SIGNED_TEST_FILE"
+        --token "dummy-token" \
+        --certificate "dummy-certificate" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
     echo "PASS: pesign sign request completed successfully"
 
     ls -la "$TEST_FILE"

From 768a240c45e450739486b33ab1281ff0fbc03b2e Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Fri, 21 Aug 2026 23:28:06 -0700
Subject: [PATCH 25/29] Update pesign-client params

---
 specs/x/xsign-proxy-test/xsign-proxy-test.spec | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index 82654746d78..c4c93f29ebb 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -39,13 +39,16 @@ if [ -x "$PESIGN_CLIENT" ]; then
     echo "=== Using pesign for secure-boot signing ==="
     
     # Sign using pesign-client
+    # --certificat "short-circuit-signing"
+    # --certificat "unused-certificate-name"
+    #
     echo "=== signing the test file with pesign ==="
     pesign-client \
         --verbose \
         --debug \
         --sign \
-        --token "dummy-token" \
-        --certificate "dummy-certificate" \
+        --token "unused-token-name" \
+        --certificate "short-circuit-signing" \
         --infile "$TEST_FILE" \
         --outfile "$SIGNED_TEST_FILE"
     echo "PASS: pesign sign request completed successfully"

From d0111677392ffdfeeea41d0b2600a0ccb3e300ee Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Mon, 24 Aug 2026 20:25:51 -0700
Subject: [PATCH 26/29] Update spec

---
 .../x/xsign-proxy-test/xsign-proxy-test.spec  | 37 +++++++++++++++----
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/specs/x/xsign-proxy-test/xsign-proxy-test.spec b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
index c4c93f29ebb..671dc310901 100644
--- a/specs/x/xsign-proxy-test/xsign-proxy-test.spec
+++ b/specs/x/xsign-proxy-test/xsign-proxy-test.spec
@@ -43,14 +43,35 @@ if [ -x "$PESIGN_CLIENT" ]; then
     # --certificat "unused-certificate-name"
     #
     echo "=== signing the test file with pesign ==="
-    pesign-client \
-        --verbose \
-        --debug \
-        --sign \
-        --token "unused-token-name" \
-        --certificate "short-circuit-signing" \
-        --infile "$TEST_FILE" \
-        --outfile "$SIGNED_TEST_FILE"
+    SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
+    if [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "cp-459159-pgp" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    elif [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "cp-450778-pgp" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    elif [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "secure-boot-self-signing" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    fi
     echo "PASS: pesign sign request completed successfully"
 
     ls -la "$TEST_FILE"

From 4fac0df4778003a35268918bae946a92bca244af Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Tue, 1 Sep 2026 19:33:13 -0700
Subject: [PATCH 27/29] Update gwupd and fwupd-efi

---
 base/comps/components.toml               |  1 -
 base/comps/fwupd-efi/fwupd-efi.comp.toml | 44 +++++++++++++++++
 base/comps/fwupd/fwupd.comp.toml         | 63 ++++++++++++++++++++++++
 locks/fwupd-efi.lock                     |  2 +-
 locks/fwupd.lock                         |  2 +-
 specs/f/fwupd-efi/fwupd-efi.spec         | 44 ++++++++++++++++-
 specs/f/fwupd/fwupd.spec                 | 60 +++++++++++++++++++++-
 7 files changed, 210 insertions(+), 6 deletions(-)
 create mode 100644 base/comps/fwupd/fwupd.comp.toml

diff --git a/base/comps/components.toml b/base/comps/components.toml
index 4c27a1f560e..18b861d692f 100644
--- a/base/comps/components.toml
+++ b/base/comps/components.toml
@@ -486,7 +486,6 @@ overlay-files = ["overlays/*.overlay.toml"]
 [components.fuse]
 [components.fuse-overlayfs]
 [components.fusesource-pom]
-[components.fwupd]
 [components.fxdiv]
 [components.fxload]
 [components.galera]
diff --git a/base/comps/fwupd-efi/fwupd-efi.comp.toml b/base/comps/fwupd-efi/fwupd-efi.comp.toml
index b939c22484c..5ba7d68ce91 100644
--- a/base/comps/fwupd-efi/fwupd-efi.comp.toml
+++ b/base/comps/fwupd-efi/fwupd-efi.comp.toml
@@ -61,3 +61,47 @@ objcopy --dump-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
 sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-sbat.csv
 objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
 %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp'''
+
+[[components.fwupd-efi.overlays]]
+description = "Sign the packaged EFI binary with the configured secure boot certificate"
+type = "spec-search-replace"
+section = "%install"
+regex = '^%pesign -s -i %\{fwup_efi_fn\}\.tmp -o %\{fwup_efi_fn\}\.signed$'
+replacement = '''PESIGN_CLIENT=/usr/bin/pesign
+TEST_FILE=%{fwup_efi_fn}.tmp
+SIGNED_TEST_FILE=%{fwup_efi_fn}.signed
+SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
+
+if [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "cp-459159-pgp" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "cp-450778-pgp" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "secure-boot-self-signing" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+else
+    %pesign -s -i %{fwup_efi_fn}.tmp -o %{fwup_efi_fn}.signed
+fi
+
+ls -la "$TEST_FILE"
+ls -la "$SIGNED_TEST_FILE"'''
diff --git a/base/comps/fwupd/fwupd.comp.toml b/base/comps/fwupd/fwupd.comp.toml
new file mode 100644
index 00000000000..0896171c13c
--- /dev/null
+++ b/base/comps/fwupd/fwupd.comp.toml
@@ -0,0 +1,63 @@
+[components.fwupd]
+
+[[components.fwupd.overlays]]
+description = "Sign the secure boot test file through the pesign client when available"
+type = "spec-search-replace"
+section = "%build"
+regex = '^%meson_build$'
+replacement = '''%meson_build
+
+# Check if pesign is available for direct signing
+PESIGN_CLIENT=/usr/bin/pesign
+
+# Are we running on a secure-boot image?
+if [ -x "$PESIGN_CLIENT" ]; then
+
+    SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
+
+    echo "=== Using pesign for secure-boot signing ==="
+
+    # Sign using pesign-client
+    # --certificat "short-circuit-signing"
+    # --certificat "unused-certificate-name"
+    #
+    echo "=== signing the test file with pesign ==="
+    SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
+    if [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "cp-459159-pgp" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    elif [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "cp-450778-pgp" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    elif [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "secure-boot-self-signing" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    fi
+    echo "PASS: pesign sign request completed successfully"
+
+    ls -la "$TEST_FILE"
+    ls -la "$SIGNED_TEST_FILE"
+
+    echo "=== secure boot signing completed ==="
+else
+    echo "=== skipped secure boot signing ==="
+fi
+'''
diff --git a/locks/fwupd-efi.lock b/locks/fwupd-efi.lock
index 833908fe6c8..a1bf5ca23d6 100644
--- a/locks/fwupd-efi.lock
+++ b/locks/fwupd-efi.lock
@@ -2,5 +2,5 @@
 version = 1
 import-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7'
 upstream-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7'
-input-fingerprint = 'sha256:85f46532d25fe03c80cbefb79afa43c01e2644df55f3a9432ccbe1aa9c038ba1'
+input-fingerprint = 'sha256:9a82af7c9d4715cef459c4c00bec8e09ef3de51fc40d8b6c962df93ea82631aa'
 resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
diff --git a/locks/fwupd.lock b/locks/fwupd.lock
index 93d8f07cd29..2be0958fc96 100644
--- a/locks/fwupd.lock
+++ b/locks/fwupd.lock
@@ -2,5 +2,5 @@
 version = 1
 import-commit = 'd701c0ed12a33b358df30e66d15797ee225e86d5'
 upstream-commit = 'd701c0ed12a33b358df30e66d15797ee225e86d5'
-input-fingerprint = 'sha256:32682cd07eeb84553ce6ca0cfbf562a1ec10a53d6df8612927866ef467a60768'
+input-fingerprint = 'sha256:37714ae4dec56c6e51f8048e3f909732046ab2dfc2c5f81462ab3a6a92a37db2'
 resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
diff --git a/specs/f/fwupd-efi/fwupd-efi.spec b/specs/f/fwupd-efi/fwupd-efi.spec
index 10f0f908307..6f5bd43d3ed 100644
--- a/specs/f/fwupd-efi/fwupd-efi.spec
+++ b/specs/f/fwupd-efi/fwupd-efi.spec
@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.8.3)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 3;
+    release_number = 4;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -76,7 +76,44 @@ sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-s
 objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
 %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp
 %define __pesign_client_cert fwupd-signer
-%pesign -s -i %{fwup_efi_fn}.tmp -o %{fwup_efi_fn}.signed
+PESIGN_CLIENT=/usr/bin/pesign
+TEST_FILE=%{fwup_efi_fn}.tmp
+SIGNED_TEST_FILE=%{fwup_efi_fn}.signed
+SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
+
+if [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "cp-459159-pgp" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "cp-450778-pgp" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "secure-boot-self-signing" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+else
+    %pesign -s -i %{fwup_efi_fn}.tmp -o %{fwup_efi_fn}.signed
+fi
+
+ls -la "$TEST_FILE"
+ls -la "$SIGNED_TEST_FILE"
 rm -vf %{fwup_efi_fn}.tmp
 
 %files
@@ -89,6 +126,9 @@ rm -vf %{fwup_efi_fn}.tmp
 
 %changelog
 ## START: Generated by rpmautospec
+* Wed Sep 02 2026 azldev <azldev@local> - 1.8-4
+- Local changes (uncommitted)
+
 * Mon Jul 27 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 1.8-3
 - feat(fwupd-efi): add AZL SBAT line, keep upstream provenance
 
diff --git a/specs/f/fwupd/fwupd.spec b/specs/f/fwupd/fwupd.spec
index 6651bef18a7..5980a808f01 100644
--- a/specs/f/fwupd/fwupd.spec
+++ b/specs/f/fwupd/fwupd.spec
@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.8.3)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 2;
+    release_number = 3;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -236,6 +236,61 @@ or server machines.
 
 %meson_build
 
+# Check if pesign is available for direct signing
+PESIGN_CLIENT=/usr/bin/pesign
+
+# Are we running on a secure-boot image?
+if [ -x "$PESIGN_CLIENT" ]; then
+
+    SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
+
+    echo "=== Using pesign for secure-boot signing ==="
+
+    # Sign using pesign-client
+    # --certificat "short-circuit-signing"
+    # --certificat "unused-certificate-name"
+    #
+    echo "=== signing the test file with pesign ==="
+    SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
+    if [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "cp-459159-pgp" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    elif [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "cp-450778-pgp" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    elif [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "secure-boot-self-signing" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    fi
+    echo "PASS: pesign sign request completed successfully"
+
+    ls -la "$TEST_FILE"
+    ls -la "$SIGNED_TEST_FILE"
+
+    echo "=== secure boot signing completed ==="
+else
+    echo "=== skipped secure boot signing ==="
+fi
+
+
 %if 0%{?enable_tests}
 %check
 %meson_test
@@ -371,6 +426,9 @@ systemctl --no-reload preset fwupd-refresh.timer &>/dev/null || :
 
 %changelog
 ## START: Generated by rpmautospec
+* Wed Sep 02 2026 azldev <azldev@local> - 2.0.19-3
+- Local changes (uncommitted)
+
 * Thu Apr 30 2026 Daniel McIlvaney <damcilva@microsoft.com> - 2.0.19-2
 - feat: introduce deterministic commit resolution via Azure Linux lock file
 

From f9d24c2648e6dea974fc6d7af930823fbf5eea19 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 2 Sep 2026 12:07:26 -0700
Subject: [PATCH 28/29] Stop original pesign

---
 base/comps/fwupd-efi/fwupd-efi.comp.toml | 19 +++++++++++++++----
 locks/fwupd-efi.lock                     |  2 +-
 specs/f/fwupd-efi/fwupd-efi.spec         | 16 +++++++++-------
 3 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/base/comps/fwupd-efi/fwupd-efi.comp.toml b/base/comps/fwupd-efi/fwupd-efi.comp.toml
index 5ba7d68ce91..fea75641283 100644
--- a/base/comps/fwupd-efi/fwupd-efi.comp.toml
+++ b/base/comps/fwupd-efi/fwupd-efi.comp.toml
@@ -59,8 +59,13 @@ replacement = '''# Re-inject the upstream Fedora provenance SBAT line, ahead of
 # emitted by the meson distro slot (AB#20493).
 objcopy --dump-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
 sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-sbat.csv
-objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
-%pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp'''
+objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}'''
+
+[[components.fwupd-efi.overlays]]
+description = "Remove the upstream pesign-client certificate macro"
+type = "spec-search-replace"
+section = "%install"
+regex = '^%define __pesign_client_cert fwupd-signer$'
 
 [[components.fwupd-efi.overlays]]
 description = "Sign the packaged EFI binary with the configured secure boot certificate"
@@ -68,7 +73,7 @@ type = "spec-search-replace"
 section = "%install"
 regex = '^%pesign -s -i %\{fwup_efi_fn\}\.tmp -o %\{fwup_efi_fn\}\.signed$'
 replacement = '''PESIGN_CLIENT=/usr/bin/pesign
-TEST_FILE=%{fwup_efi_fn}.tmp
+TEST_FILE=%{fwup_efi_fn}
 SIGNED_TEST_FILE=%{fwup_efi_fn}.signed
 SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
 
@@ -100,8 +105,14 @@ elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-self-signi
         --infile "$TEST_FILE" \
         --outfile "$SIGNED_TEST_FILE"
 else
-    %pesign -s -i %{fwup_efi_fn}.tmp -o %{fwup_efi_fn}.signed
+    %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.signed
 fi
 
 ls -la "$TEST_FILE"
 ls -la "$SIGNED_TEST_FILE"'''
+
+[[components.fwupd-efi.overlays]]
+description = "Remove cleanup for the eliminated intermediate signed EFI file"
+type = "spec-search-replace"
+section = "%install"
+regex = '^rm -vf %\{fwup_efi_fn\}\.tmp$'
diff --git a/locks/fwupd-efi.lock b/locks/fwupd-efi.lock
index a1bf5ca23d6..7452b203f36 100644
--- a/locks/fwupd-efi.lock
+++ b/locks/fwupd-efi.lock
@@ -2,5 +2,5 @@
 version = 1
 import-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7'
 upstream-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7'
-input-fingerprint = 'sha256:9a82af7c9d4715cef459c4c00bec8e09ef3de51fc40d8b6c962df93ea82631aa'
+input-fingerprint = 'sha256:0871c26cb3a764f76ad923c6606b52bd6b5418197bfbcacb952e54975e034da5'
 resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
diff --git a/specs/f/fwupd-efi/fwupd-efi.spec b/specs/f/fwupd-efi/fwupd-efi.spec
index 6f5bd43d3ed..7fcbd13d5ea 100644
--- a/specs/f/fwupd-efi/fwupd-efi.spec
+++ b/specs/f/fwupd-efi/fwupd-efi.spec
@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.8.3)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 4;
+    release_number = 5;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -74,10 +74,9 @@ the EFI binary that is used for updating using UpdateCapsule.
 objcopy --dump-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
 sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-sbat.csv
 objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
-%pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp
-%define __pesign_client_cert fwupd-signer
+
 PESIGN_CLIENT=/usr/bin/pesign
-TEST_FILE=%{fwup_efi_fn}.tmp
+TEST_FILE=%{fwup_efi_fn}
 SIGNED_TEST_FILE=%{fwup_efi_fn}.signed
 SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
 
@@ -109,12 +108,12 @@ elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-self-signi
         --infile "$TEST_FILE" \
         --outfile "$SIGNED_TEST_FILE"
 else
-    %pesign -s -i %{fwup_efi_fn}.tmp -o %{fwup_efi_fn}.signed
+    %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.signed
 fi
 
 ls -la "$TEST_FILE"
 ls -la "$SIGNED_TEST_FILE"
-rm -vf %{fwup_efi_fn}.tmp
+
 
 %files
 %doc README.md AUTHORS
@@ -126,9 +125,12 @@ rm -vf %{fwup_efi_fn}.tmp
 
 %changelog
 ## START: Generated by rpmautospec
-* Wed Sep 02 2026 azldev <azldev@local> - 1.8-4
+* Wed Sep 02 2026 azldev <azldev@local> - 1.8-5
 - Local changes (uncommitted)
 
+* Wed Sep 02 2026 George Mileka <gmileka@microsoft.com> - 1.8-4
+- Update gwupd and fwupd-efi
+
 * Mon Jul 27 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 1.8-3
 - feat(fwupd-efi): add AZL SBAT line, keep upstream provenance
 

From 64fef876645ab8a8a7843f465351ba37cffeef22 Mon Sep 17 00:00:00 2001
From: George Mileka <gmileka@microsoft.com>
Date: Wed, 2 Sep 2026 17:17:41 -0700
Subject: [PATCH 29/29] Revert fwupd changes

---
 base/comps/components.toml       |  1 +
 base/comps/fwupd/fwupd.comp.toml | 63 --------------------------------
 locks/fwupd.lock                 |  2 +-
 specs/f/fwupd/fwupd.spec         | 60 +-----------------------------
 4 files changed, 3 insertions(+), 123 deletions(-)
 delete mode 100644 base/comps/fwupd/fwupd.comp.toml

diff --git a/base/comps/components.toml b/base/comps/components.toml
index 18b861d692f..4c27a1f560e 100644
--- a/base/comps/components.toml
+++ b/base/comps/components.toml
@@ -486,6 +486,7 @@ overlay-files = ["overlays/*.overlay.toml"]
 [components.fuse]
 [components.fuse-overlayfs]
 [components.fusesource-pom]
+[components.fwupd]
 [components.fxdiv]
 [components.fxload]
 [components.galera]
diff --git a/base/comps/fwupd/fwupd.comp.toml b/base/comps/fwupd/fwupd.comp.toml
deleted file mode 100644
index 0896171c13c..00000000000
--- a/base/comps/fwupd/fwupd.comp.toml
+++ /dev/null
@@ -1,63 +0,0 @@
-[components.fwupd]
-
-[[components.fwupd.overlays]]
-description = "Sign the secure boot test file through the pesign client when available"
-type = "spec-search-replace"
-section = "%build"
-regex = '^%meson_build$'
-replacement = '''%meson_build
-
-# Check if pesign is available for direct signing
-PESIGN_CLIENT=/usr/bin/pesign
-
-# Are we running on a secure-boot image?
-if [ -x "$PESIGN_CLIENT" ]; then
-
-    SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
-
-    echo "=== Using pesign for secure-boot signing ==="
-
-    # Sign using pesign-client
-    # --certificat "short-circuit-signing"
-    # --certificat "unused-certificate-name"
-    #
-    echo "=== signing the test file with pesign ==="
-    SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
-    if [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then
-        pesign-client \
-            --verbose \
-            --debug \
-            --sign \
-            --certificate "cp-459159-pgp" \
-            --token "unused-token-name" \
-            --infile "$TEST_FILE" \
-            --outfile "$SIGNED_TEST_FILE"
-    elif [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then
-        pesign-client \
-            --verbose \
-            --debug \
-            --sign \
-            --certificate "cp-450778-pgp" \
-            --token "unused-token-name" \
-            --infile "$TEST_FILE" \
-            --outfile "$SIGNED_TEST_FILE"
-    elif [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then
-        pesign-client \
-            --verbose \
-            --debug \
-            --sign \
-            --certificate "secure-boot-self-signing" \
-            --token "unused-token-name" \
-            --infile "$TEST_FILE" \
-            --outfile "$SIGNED_TEST_FILE"
-    fi
-    echo "PASS: pesign sign request completed successfully"
-
-    ls -la "$TEST_FILE"
-    ls -la "$SIGNED_TEST_FILE"
-
-    echo "=== secure boot signing completed ==="
-else
-    echo "=== skipped secure boot signing ==="
-fi
-'''
diff --git a/locks/fwupd.lock b/locks/fwupd.lock
index 2be0958fc96..93d8f07cd29 100644
--- a/locks/fwupd.lock
+++ b/locks/fwupd.lock
@@ -2,5 +2,5 @@
 version = 1
 import-commit = 'd701c0ed12a33b358df30e66d15797ee225e86d5'
 upstream-commit = 'd701c0ed12a33b358df30e66d15797ee225e86d5'
-input-fingerprint = 'sha256:37714ae4dec56c6e51f8048e3f909732046ab2dfc2c5f81462ab3a6a92a37db2'
+input-fingerprint = 'sha256:32682cd07eeb84553ce6ca0cfbf562a1ec10a53d6df8612927866ef467a60768'
 resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
diff --git a/specs/f/fwupd/fwupd.spec b/specs/f/fwupd/fwupd.spec
index 5980a808f01..6651bef18a7 100644
--- a/specs/f/fwupd/fwupd.spec
+++ b/specs/f/fwupd/fwupd.spec
@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.8.3)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 3;
+    release_number = 2;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -236,61 +236,6 @@ or server machines.
 
 %meson_build
 
-# Check if pesign is available for direct signing
-PESIGN_CLIENT=/usr/bin/pesign
-
-# Are we running on a secure-boot image?
-if [ -x "$PESIGN_CLIENT" ]; then
-
-    SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
-
-    echo "=== Using pesign for secure-boot signing ==="
-
-    # Sign using pesign-client
-    # --certificat "short-circuit-signing"
-    # --certificat "unused-certificate-name"
-    #
-    echo "=== signing the test file with pesign ==="
-    SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
-    if [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then
-        pesign-client \
-            --verbose \
-            --debug \
-            --sign \
-            --certificate "cp-459159-pgp" \
-            --token "unused-token-name" \
-            --infile "$TEST_FILE" \
-            --outfile "$SIGNED_TEST_FILE"
-    elif [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then
-        pesign-client \
-            --verbose \
-            --debug \
-            --sign \
-            --certificate "cp-450778-pgp" \
-            --token "unused-token-name" \
-            --infile "$TEST_FILE" \
-            --outfile "$SIGNED_TEST_FILE"
-    elif [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then
-        pesign-client \
-            --verbose \
-            --debug \
-            --sign \
-            --certificate "secure-boot-self-signing" \
-            --token "unused-token-name" \
-            --infile "$TEST_FILE" \
-            --outfile "$SIGNED_TEST_FILE"
-    fi
-    echo "PASS: pesign sign request completed successfully"
-
-    ls -la "$TEST_FILE"
-    ls -la "$SIGNED_TEST_FILE"
-
-    echo "=== secure boot signing completed ==="
-else
-    echo "=== skipped secure boot signing ==="
-fi
-
-
 %if 0%{?enable_tests}
 %check
 %meson_test
@@ -426,9 +371,6 @@ systemctl --no-reload preset fwupd-refresh.timer &>/dev/null || :
 
 %changelog
 ## START: Generated by rpmautospec
-* Wed Sep 02 2026 azldev <azldev@local> - 2.0.19-3
-- Local changes (uncommitted)
-
 * Thu Apr 30 2026 Daniel McIlvaney <damcilva@microsoft.com> - 2.0.19-2
 - feat: introduce deterministic commit resolution via Azure Linux lock file