User/gmileka/test branch

base/comps/fwupd-efi/fwupd-efi.comp.toml

@@ -59,5 +59,60 @@ replacement = '''# Re-inject the upstream Fedora provenance SBAT line, ahead of
 # emitted by the meson distro slot (AB#20493).
 objcopy --dump-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
 sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-sbat.csv
-objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
-%pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp'''
+objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}'''
+
+[[components.fwupd-efi.overlays]]
+description = "Remove the upstream pesign-client certificate macro"
+type = "spec-search-replace"
+section = "%install"
+regex = '^%define __pesign_client_cert fwupd-signer$'
+
+[[components.fwupd-efi.overlays]]
+description = "Sign the packaged EFI binary with the configured secure boot certificate"
+type = "spec-search-replace"
+section = "%install"
+regex = '^%pesign -s -i %\{fwup_efi_fn\}\.tmp -o %\{fwup_efi_fn\}\.signed$'
+replacement = '''PESIGN_CLIENT=/usr/bin/pesign
+TEST_FILE=%{fwup_efi_fn}
+SIGNED_TEST_FILE=%{fwup_efi_fn}.signed
+SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
+
+if [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "cp-459159-pgp" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "cp-450778-pgp" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "secure-boot-self-signing" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+else
+    %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.signed
+fi
+
+ls -la "$TEST_FILE"
+ls -la "$SIGNED_TEST_FILE"'''
+
+[[components.fwupd-efi.overlays]]
+description = "Remove cleanup for the eliminated intermediate signed EFI file"
+type = "spec-search-replace"
+section = "%install"
+regex = '^rm -vf %\{fwup_efi_fn\}\.tmp$'

locks/fwupd-efi.lock

@@ -2,5 +2,5 @@
 version = 1
 import-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7'
 upstream-commit = '66b52c7dcf3734300c9f9b1a70856f7524d2f5f7'
-input-fingerprint = 'sha256:85f46532d25fe03c80cbefb79afa43c01e2644df55f3a9432ccbe1aa9c038ba1'
+input-fingerprint = 'sha256:0871c26cb3a764f76ad923c6606b52bd6b5418197bfbcacb952e54975e034da5'
 resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'

specs/f/fwupd-efi/fwupd-efi.spec

@@ -2,7 +2,7 @@
 ## (rpmautospec version 0.8.3)
 ## RPMAUTOSPEC: autorelease, autochangelog
 %define autorelease(e:s:pb:n) %{?-p:0.}%{lua:
-    release_number = 3;
+    release_number = 5;
     base_release_number = tonumber(rpm.expand("%{?-b*}%{!?-b:1}"));
     print(release_number + base_release_number - 1);
 }%{?-e:.%{-e*}}%{?-s:.%{-s*}}%{!?-n:%{?dist}}
@@ -74,10 +74,46 @@ the EFI binary that is used for updating using UpdateCapsule.
 objcopy --dump-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
 sed -i '/^fwupd-efi\.azurelinux,/i %{sbat_fedora_line}' %{_builddir}/fwupd-efi-sbat.csv
 objcopy --update-section .sbat=%{_builddir}/fwupd-efi-sbat.csv %{fwup_efi_fn}
-%pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.tmp
-%define __pesign_client_cert fwupd-signer
-%pesign -s -i %{fwup_efi_fn}.tmp -o %{fwup_efi_fn}.signed
-rm -vf %{fwup_efi_fn}.tmp
+
+PESIGN_CLIENT=/usr/bin/pesign
+TEST_FILE=%{fwup_efi_fn}
+SIGNED_TEST_FILE=%{fwup_efi_fn}.signed
+SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
+
+if [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "cp-459159-pgp" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "cp-450778-pgp" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+elif [ -x "$PESIGN_CLIENT" ] && [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then
+    pesign-client \
+        --verbose \
+        --debug \
+        --sign \
+        --certificate "secure-boot-self-signing" \
+        --token "unused-token-name" \
+        --infile "$TEST_FILE" \
+        --outfile "$SIGNED_TEST_FILE"
+else
+    %pesign -s -i %{fwup_efi_fn} -o %{fwup_efi_fn}.signed
+fi
+
+ls -la "$TEST_FILE"
+ls -la "$SIGNED_TEST_FILE"
+
 
 %files
 %doc README.md AUTHORS
@@ -89,6 +125,12 @@ rm -vf %{fwup_efi_fn}.tmp
 
 %changelog
 ## START: Generated by rpmautospec
+* Wed Sep 02 2026 azldev <azldev@local> - 1.8-5
+- Local changes (uncommitted)
+
+* Wed Sep 02 2026 George Mileka <gmileka@microsoft.com> - 1.8-4
+- Update gwupd and fwupd-efi
+
 * Mon Jul 27 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 1.8-3
 - feat(fwupd-efi): add AZL SBAT line, keep upstream provenance
 

specs/x/xsign-proxy-test/README

@@ -0,0 +1,3 @@
+xsign-proxy-test dummy package
+
+This package tests xsign-proxy client-server communication during RPM builds.

specs/x/xsign-proxy-test/xsign-proxy-test.spec

@@ -0,0 +1,102 @@
+Name:           xsign-proxy-test
+Version:        1.0.0
+Release:        1%{?dist}
+Summary:        Dummy package to test xsign-proxy client-server communication
+
+License:        MIT
+URL:            https://example.com/xsign-proxy-test
+
+Source0:        README
+
+BuildArch:      noarch
+BuildRequires:  python3
+BuildRequires:  pesign
+
+%description
+A dummy package that exercises the xsign-proxy-client during the build phase.
+This package is used to verify that the xsign-proxy daemon is reachable from
+within the mock chroot via the bind-mounted Unix socket.
+
+%prep
+cp %{SOURCE0} .
+
+%build
+
+echo "=== Building the binary ==="
+TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
+mkdir -p %{_builddir}/%{name}-%{version}
+echo "This is a test file for xsign-proxy signing" > "$TEST_FILE"
+echo "Created test file: $TEST_FILE"
+
+# Check if pesign is available for direct signing
+PESIGN_CLIENT=/usr/bin/pesign
+
+# Are we running on a secure-boot image?
+if [ -x "$PESIGN_CLIENT" ]; then
+
+    SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
+
+    echo "=== Using pesign for secure-boot signing ==="
+
+    # Sign using pesign-client
+    # --certificat "short-circuit-signing"
+    # --certificat "unused-certificate-name"
+    #
+    echo "=== signing the test file with pesign ==="
+    SIGNING_TYPES=",${SIGULDRY_PESIGN_BRIDGE_SIGNING_TYPES},"
+    if [[ "$SIGNING_TYPES" == *",secure-boot-esrp-prod-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "cp-459159-pgp" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    elif [[ "$SIGNING_TYPES" == *",secure-boot-esrp-test-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "cp-450778-pgp" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    elif [[ "$SIGNING_TYPES" == *",secure-boot-self-signing,"* ]]; then
+        pesign-client \
+            --verbose \
+            --debug \
+            --sign \
+            --certificate "secure-boot-self-signing" \
+            --token "unused-token-name" \
+            --infile "$TEST_FILE" \
+            --outfile "$SIGNED_TEST_FILE"
+    fi
+    echo "PASS: pesign sign request completed successfully"
+
+    ls -la "$TEST_FILE"
+    ls -la "$SIGNED_TEST_FILE"
+
+    echo "=== secure boot signing completed ==="
+else
+    echo "=== skipped secure boot signing ==="
+fi
+
+%install
+TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
+SIGNED_TEST_FILE="%{_builddir}/%{name}-%{version}/test-file-%{name}-%{version}.txt"
+
+if [ -f "$SIGNED_TEST_FILE" ]; then
+    install -D -m 0644 "$SIGNED_TEST_FILE" \
+        %{buildroot}%{_sysconfdir}/xsign-proxy-test.txt
+else
+    install -D -m 0644 "$TEST_FILE" \
+        %{buildroot}%{_sysconfdir}/xsign-proxy-test.txt
+fi
+
+%files
+%config(noreplace) %{_sysconfdir}/xsign-proxy-test.txt
+
+%changelog
+* Fri Jun 26 2026 Test User <test@example.com> - 1.0.0-1
+- Initial package to test xsign-proxy client-server communication