The package rpms/edk2.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/edk2.git/commit/?id=07922022858a2979....
Change: +%ifarch x86_64
Thanks.
Full change: ============
commit b7103cb49ab20d5ff1eaab303a2ab085975da1cf Author: Cole Robinson crobinso@redhat.com Date: Tue May 1 13:58:41 2018 -0400
Bump release for new build
diff --git a/edk2.spec b/edk2.spec index 0139c63..c5da2a1 100644 --- a/edk2.spec +++ b/edk2.spec @@ -35,7 +35,7 @@
Name: edk2 Version: %{edk2_date}git%{edk2_githash} -Release: 6%{dist} +Release: 7%{dist} Summary: EFI Development Kit II
Group: Applications/Emulators @@ -516,6 +516,9 @@ install qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator %{buildroot}%{_
%changelog +* Tue May 01 2018 Cole Robinson crobinso@redhat.com - 20171011git92d07e4-7 +- Bump release for new build + * Fri Mar 30 2018 Patrick Uiterwijk puiterwijk@redhat.com - 20171011git92d07e4-6 - Add qemu-ovmf-secureboot (qosb) - Generate pre-enrolled Secure Boot OVMF VARS files
commit 48f745a9ce8f55ca544321b404cab5b065aa054a Author: Cole Robinson crobinso@redhat.com Date: Mon Apr 30 11:43:54 2018 -0400
Add qemu-ovmf-secureboot sources, tweak qemu dep
diff --git a/.gitignore b/.gitignore index 67b5ada..66866b8 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /edk2-20170209-296153c5.tar.xz /edk2-20171011-92d07e4.tar.xz /openssl-1.1.0e-hobbled.tar.xz +/qemu-ovmf-secureboot-1.1.2.tar.gz diff --git a/edk2.spec b/edk2.spec index e753e65..0139c63 100644 --- a/edk2.spec +++ b/edk2.spec @@ -119,7 +119,7 @@ BuildRequires: genisoimage
# These are for QOSB BuildRequires: python3-requests -BuildRequires: qemu +BuildRequires: qemu-system-x86 %if %{?qosb_testing} # This is used for testing the enrollment: builds are run in a chroot, lacking # a kernel. The testing is only performed on x86_64 for now, but we can't make diff --git a/sources b/sources index 71f06bb..0bf4ee0 100644 --- a/sources +++ b/sources @@ -1,2 +1,3 @@ SHA512 (edk2-20171011-92d07e4.tar.xz) = b7afcefd21470df730648c32455d19e0e31caf15d6a9aedc36a1c390fccddd18719d2710cdd01cf6156bb7551c67fce2a3073bf640b756c32184d889a8d40d46 SHA512 (openssl-1.1.0e-hobbled.tar.xz) = 25e7d5bddd28501de3f1488c91f4effb0e271986c836302680ea3754d73dceb1d34dd7460096bc28d3c0bced7dd5736dda15ccf5936d9313f4587f68a256efbc +SHA512 (qemu-ovmf-secureboot-1.1.2.tar.gz) = 4dd7e06663bde90cea99849d47d4c94c48d573ac0454e56eab9174ade999b4dcef73fea63a9bc64d2bccecf8f69c9df2945b237a2f95a08c83d42d744e76d687
commit 07922022858a2979f54961f2b82526227752eead Author: Patrick Uiterwijk puiterwijk@redhat.com Date: Mon Apr 30 11:57:51 2018 +0000
Add qosb to generate pre-enrolled Secure Boot VARS files
Signed-off-by: Patrick Uiterwijk puiterwijk@redhat.com Reviewed-by: Laszlo Ersek lersek@redhat.com
diff --git a/edk2.spec b/edk2.spec index ecf952d..e753e65 100644 --- a/edk2.spec +++ b/edk2.spec @@ -1,7 +1,13 @@ %global edk2_date 20171011 %global edk2_githash 92d07e4 %global openssl_version 1.1.0e +%global qosb_version 1.1.2
+%define qosb_testing 0 + +%ifarch x86_64 +%define qosb_testing 1 +%endif %if 0%{?fedora:1} %define cross 1 %endif @@ -29,7 +35,7 @@
Name: edk2 Version: %{edk2_date}git%{edk2_githash} -Release: 5%{dist} +Release: 6%{dist} Summary: EFI Development Kit II
Group: Applications/Emulators @@ -38,6 +44,7 @@ URL: http://www.tianocore.org/edk2/ Source0: edk2-%{edk2_date}-%{edk2_githash}.tar.xz Source1: openssl-%{openssl_version}-hobbled.tar.xz Source2: ovmf-whitepaper-c770f8c.txt +Source3: https://github.com/puiterwijk/qemu-ovmf-secureboot/archive/v%%7Bqosb_version... Source10: hobble-openssl Source11: build-iso.sh Source12: update-tarball.sh @@ -110,6 +117,19 @@ BuildRequires: nasm BuildRequires: qemu-img BuildRequires: genisoimage
+# These are for QOSB +BuildRequires: python3-requests +BuildRequires: qemu +%if %{?qosb_testing} +# This is used for testing the enrollment: builds are run in a chroot, lacking +# a kernel. The testing is only performed on x86_64 for now, but we can't make +# the BuildRequires only on a specific arch, as that'd come through in the SRPM +# NOTE: The actual enrollment needs to happen in all builds for all architectures, +# because OVMF is built as noarch, which means that koji enforces that the build +# results don't actually differ per arch, and then it picks a random arches' build +# for the actual RPM. +BuildRequires: kernel-core +%endif
%description EDK II is a development code base for creating UEFI drivers, applications @@ -141,6 +161,15 @@ BuildArch: noarch This package documents the tools that are needed to build EFI executables and ROMs using the GNU tools.
+%package qosb +Summary: Tool to enroll secureboot +Group: Development/Tools +Buildarch: noarch +%description qosb +This package contains QOSB (QEMU OVMF Secure Boot), which can enroll OVMF +variable files to enforce Secure Boot. + + %if 0%{?build_ovmf_x64:1} %package ovmf Summary: Open Virtual Machine Firmware @@ -200,6 +229,11 @@ cp -a -- %{SOURCE2} . (cd .. && tar -xvf %{SOURCE1}) cp CryptoPkg/Library/OpensslLib/openssl/LICENSE LICENSE.openssl
+# Extract QOSB +tar -xvf %{SOURCE3} +mv qemu-ovmf-secureboot-%{qosb_version}/README.md README.qosb +mv qemu-ovmf-secureboot-%{qosb_version}/LICENSE LICENSE.qosb + %autopatch -p1 base64 --decode < MdeModulePkg/Logo/Logo-OpenSSL.bmp.b64 > MdeModulePkg/Logo/Logo-OpenSSL.bmp
@@ -264,6 +298,15 @@ cp Build/Ovmf3264/*/FV/OVMF_CODE.fd ovmf/OVMF_CODE.secboot.fd cp Build/Ovmf3264/*/X64/Shell.efi ovmf/ cp Build/Ovmf3264/*/X64/EnrollDefaultKeys.efi ovmf sh %{_sourcedir}/build-iso.sh ovmf/ + +# Build enrolled VARS file +python3 qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator \ + --qemu-binary /usr/bin/qemu-system-x86_64 \ + --skip-testing \ + --ovmf-binary ovmf/OVMF_CODE.secboot.fd \ + --ovmf-template-vars ovmf/OVMF_VARS.fd \ + --uefi-shell-iso ovmf/UefiShell.iso \ + ovmf/OVMF_VARS.secboot.fd %endif
@@ -306,6 +349,23 @@ dd of="arm/QEMU_EFI-pflash.raw" if="arm/QEMU_EFI.fd" conv=notrunc dd of="arm/vars-template-pflash.raw" if="/dev/zero" bs=1M count=64 %endif
+%check +%if 0%{?build_ovmf_x64:1} +%if 0%{?qosb_testing} +# Verify enrolled VARS file +python3 qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator \ + --qemu-binary /usr/bin/qemu-system-x86_64 \ + --skip-enrollment \ + --print-output \ + --ovmf-binary ovmf/OVMF_CODE.secboot.fd \ + --ovmf-template-vars ovmf/OVMF_VARS.fd \ + --uefi-shell-iso ovmf/UefiShell.iso \ + --no-download \ + --kernel-path `rpm -ql kernel-core | grep "/vmlinuz$" -m 1` \ + ovmf/OVMF_VARS.secboot.fd +%endif +%endif + %install mkdir -p %{buildroot}%{_bindir} \ %{buildroot}%{_datadir}/%{name}/Conf \ @@ -337,6 +397,7 @@ mkdir %{buildroot}/usr/share/OVMF ln -sf ../%{name}/ovmf/OVMF_CODE.fd %{buildroot}/usr/share/OVMF ln -sf ../%{name}/ovmf/OVMF_CODE.secboot.fd %{buildroot}/usr/share/OVMF ln -sf ../%{name}/ovmf/OVMF_VARS.fd %{buildroot}/usr/share/OVMF +ln -sf ../%{name}/ovmf/OVMF_VARS.secboot.fd %{buildroot}/usr/share/OVMF ln -sf ../%{name}/ovmf/UefiShell.iso %{buildroot}/usr/share/OVMF %endif %if 0%{?build_ovmf_ia32:1} @@ -354,6 +415,8 @@ cp -a arm %{buildroot}/usr/share/%{name} ln -sf ../%{name}/arm/QEMU_EFI-pflash.raw %{buildroot}/usr/share/AAVMF/AAVMF32_CODE.fd %endif
+install qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator %{buildroot}%{_bindir} +
%files tools %license License.txt @@ -397,6 +460,11 @@ ln -sf ../%{name}/arm/QEMU_EFI-pflash.raw %{buildroot}/usr/share/AAVMF/ %files tools-doc %doc BaseTools/UserManuals/*.rtf
+%files qosb +%license LICENSE.qosb +%doc README.qosb +%{_bindir}/ovmf-vars-generator + %if 0%{?build_ovmf_x64:1} %files ovmf %license OvmfPkg/License.txt @@ -448,6 +516,10 @@ ln -sf ../%{name}/arm/QEMU_EFI-pflash.raw %{buildroot}/usr/share/AAVMF/
%changelog +* Fri Mar 30 2018 Patrick Uiterwijk puiterwijk@redhat.com - 20171011git92d07e4-6 +- Add qemu-ovmf-secureboot (qosb) +- Generate pre-enrolled Secure Boot OVMF VARS files + * Wed Mar 07 2018 Paolo Bonzini pbonzini@redhat.com - 20171011git92d07e4-5 - Fix GCC 8 compilation - Replace dosfstools and mtools with qemu-img vvfat
commit d173a3b48a1d6c072eb7f05598d387da902e3f48 Author: Peter Robinson pbrobinson@gmail.com Date: Fri Mar 30 14:04:15 2018 +0100
add gcc/gcc-c++ build deps
diff --git a/edk2.spec b/edk2.spec index 828dd69..ecf952d 100644 --- a/edk2.spec +++ b/edk2.spec @@ -97,6 +97,7 @@ ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ExclusiveArch: x86_64 aarch64 %endif
+BuildRequires: gcc gcc-c++ BuildRequires: python BuildRequires: libuuid-devel %if 0%{?cross:1}
arch-excludes@lists.fedoraproject.org