The package rpms/edk2.git has added or updated architecture specific content in its
spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s):
https://src.fedoraproject.org/cgit/rpms/edk2.git/commit/?id=07922022858a2....
Change:
+%ifarch x86_64
Thanks.
Full change:
============
commit 48f745a9ce8f55ca544321b404cab5b065aa054a
Author: Cole Robinson <crobinso(a)redhat.com>
Date: Mon Apr 30 11:43:54 2018 -0400
Add qemu-ovmf-secureboot sources, tweak qemu dep
diff --git a/.gitignore b/.gitignore
index 67b5ada..66866b8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,4 @@
/edk2-20170209-296153c5.tar.xz
/edk2-20171011-92d07e4.tar.xz
/openssl-1.1.0e-hobbled.tar.xz
+/qemu-ovmf-secureboot-1.1.2.tar.gz
diff --git a/edk2.spec b/edk2.spec
index e753e65..0139c63 100644
--- a/edk2.spec
+++ b/edk2.spec
@@ -119,7 +119,7 @@ BuildRequires: genisoimage
# These are for QOSB
BuildRequires: python3-requests
-BuildRequires: qemu
+BuildRequires: qemu-system-x86
%if %{?qosb_testing}
# This is used for testing the enrollment: builds are run in a chroot, lacking
# a kernel. The testing is only performed on x86_64 for now, but we can't make
diff --git a/sources b/sources
index 71f06bb..0bf4ee0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,3 @@
SHA512 (edk2-20171011-92d07e4.tar.xz) =
b7afcefd21470df730648c32455d19e0e31caf15d6a9aedc36a1c390fccddd18719d2710cdd01cf6156bb7551c67fce2a3073bf640b756c32184d889a8d40d46
SHA512 (openssl-1.1.0e-hobbled.tar.xz) =
25e7d5bddd28501de3f1488c91f4effb0e271986c836302680ea3754d73dceb1d34dd7460096bc28d3c0bced7dd5736dda15ccf5936d9313f4587f68a256efbc
+SHA512 (qemu-ovmf-secureboot-1.1.2.tar.gz) =
4dd7e06663bde90cea99849d47d4c94c48d573ac0454e56eab9174ade999b4dcef73fea63a9bc64d2bccecf8f69c9df2945b237a2f95a08c83d42d744e76d687
commit 07922022858a2979f54961f2b82526227752eead
Author: Patrick Uiterwijk <puiterwijk(a)redhat.com>
Date: Mon Apr 30 11:57:51 2018 +0000
Add qosb to generate pre-enrolled Secure Boot VARS files
Signed-off-by: Patrick Uiterwijk <puiterwijk(a)redhat.com>
Reviewed-by: Laszlo Ersek <lersek(a)redhat.com>
diff --git a/edk2.spec b/edk2.spec
index ecf952d..e753e65 100644
--- a/edk2.spec
+++ b/edk2.spec
@@ -1,7 +1,13 @@
%global edk2_date 20171011
%global edk2_githash 92d07e4
%global openssl_version 1.1.0e
+%global qosb_version 1.1.2
+%define qosb_testing 0
+
+%ifarch x86_64
+%define qosb_testing 1
+%endif
%if 0%{?fedora:1}
%define cross 1
%endif
@@ -29,7 +35,7 @@
Name: edk2
Version: %{edk2_date}git%{edk2_githash}
-Release: 5%{dist}
+Release: 6%{dist}
Summary: EFI Development Kit II
Group: Applications/Emulators
@@ -38,6 +44,7 @@ URL:
http://www.tianocore.org/edk2/
Source0: edk2-%{edk2_date}-%{edk2_githash}.tar.xz
Source1: openssl-%{openssl_version}-hobbled.tar.xz
Source2: ovmf-whitepaper-c770f8c.txt
+Source3:
https://github.com/puiterwijk/qemu-ovmf-secureboot/archive/v%{qosb_versio...
Source10: hobble-openssl
Source11: build-iso.sh
Source12: update-tarball.sh
@@ -110,6 +117,19 @@ BuildRequires: nasm
BuildRequires: qemu-img
BuildRequires: genisoimage
+# These are for QOSB
+BuildRequires: python3-requests
+BuildRequires: qemu
+%if %{?qosb_testing}
+# This is used for testing the enrollment: builds are run in a chroot, lacking
+# a kernel. The testing is only performed on x86_64 for now, but we can't make
+# the BuildRequires only on a specific arch, as that'd come through in the SRPM
+# NOTE: The actual enrollment needs to happen in all builds for all architectures,
+# because OVMF is built as noarch, which means that koji enforces that the build
+# results don't actually differ per arch, and then it picks a random arches'
build
+# for the actual RPM.
+BuildRequires: kernel-core
+%endif
%description
EDK II is a development code base for creating UEFI drivers, applications
@@ -141,6 +161,15 @@ BuildArch: noarch
This package documents the tools that are needed to
build EFI executables and ROMs using the GNU tools.
+%package qosb
+Summary: Tool to enroll secureboot
+Group: Development/Tools
+Buildarch: noarch
+%description qosb
+This package contains QOSB (QEMU OVMF Secure Boot), which can enroll OVMF
+variable files to enforce Secure Boot.
+
+
%if 0%{?build_ovmf_x64:1}
%package ovmf
Summary: Open Virtual Machine Firmware
@@ -200,6 +229,11 @@ cp -a -- %{SOURCE2} .
(cd .. && tar -xvf %{SOURCE1})
cp CryptoPkg/Library/OpensslLib/openssl/LICENSE LICENSE.openssl
+# Extract QOSB
+tar -xvf %{SOURCE3}
+mv qemu-ovmf-secureboot-%{qosb_version}/README.md README.qosb
+mv qemu-ovmf-secureboot-%{qosb_version}/LICENSE LICENSE.qosb
+
%autopatch -p1
base64 --decode < MdeModulePkg/Logo/Logo-OpenSSL.bmp.b64 >
MdeModulePkg/Logo/Logo-OpenSSL.bmp
@@ -264,6 +298,15 @@ cp Build/Ovmf3264/*/FV/OVMF_CODE.fd ovmf/OVMF_CODE.secboot.fd
cp Build/Ovmf3264/*/X64/Shell.efi ovmf/
cp Build/Ovmf3264/*/X64/EnrollDefaultKeys.efi ovmf
sh %{_sourcedir}/build-iso.sh ovmf/
+
+# Build enrolled VARS file
+python3 qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator \
+ --qemu-binary /usr/bin/qemu-system-x86_64 \
+ --skip-testing \
+ --ovmf-binary ovmf/OVMF_CODE.secboot.fd \
+ --ovmf-template-vars ovmf/OVMF_VARS.fd \
+ --uefi-shell-iso ovmf/UefiShell.iso \
+ ovmf/OVMF_VARS.secboot.fd
%endif
@@ -306,6 +349,23 @@ dd of="arm/QEMU_EFI-pflash.raw"
if="arm/QEMU_EFI.fd" conv=notrunc
dd of="arm/vars-template-pflash.raw" if="/dev/zero" bs=1M count=64
%endif
+%check
+%if 0%{?build_ovmf_x64:1}
+%if 0%{?qosb_testing}
+# Verify enrolled VARS file
+python3 qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator \
+ --qemu-binary /usr/bin/qemu-system-x86_64 \
+ --skip-enrollment \
+ --print-output \
+ --ovmf-binary ovmf/OVMF_CODE.secboot.fd \
+ --ovmf-template-vars ovmf/OVMF_VARS.fd \
+ --uefi-shell-iso ovmf/UefiShell.iso \
+ --no-download \
+ --kernel-path `rpm -ql kernel-core | grep "\/vmlinuz$" -m 1` \
+ ovmf/OVMF_VARS.secboot.fd
+%endif
+%endif
+
%install
mkdir -p %{buildroot}%{_bindir} \
%{buildroot}%{_datadir}/%{name}/Conf \
@@ -337,6 +397,7 @@ mkdir %{buildroot}/usr/share/OVMF
ln -sf ../%{name}/ovmf/OVMF_CODE.fd %{buildroot}/usr/share/OVMF
ln -sf ../%{name}/ovmf/OVMF_CODE.secboot.fd %{buildroot}/usr/share/OVMF
ln -sf ../%{name}/ovmf/OVMF_VARS.fd %{buildroot}/usr/share/OVMF
+ln -sf ../%{name}/ovmf/OVMF_VARS.secboot.fd %{buildroot}/usr/share/OVMF
ln -sf ../%{name}/ovmf/UefiShell.iso %{buildroot}/usr/share/OVMF
%endif
%if 0%{?build_ovmf_ia32:1}
@@ -354,6 +415,8 @@ cp -a arm %{buildroot}/usr/share/%{name}
ln -sf ../%{name}/arm/QEMU_EFI-pflash.raw
%{buildroot}/usr/share/AAVMF/AAVMF32_CODE.fd
%endif
+install qemu-ovmf-secureboot-%{qosb_version}/ovmf-vars-generator %{buildroot}%{_bindir}
+
%files tools
%license License.txt
@@ -397,6 +460,11 @@ ln -sf ../%{name}/arm/QEMU_EFI-pflash.raw
%{buildroot}/usr/share/AAVMF/
%files tools-doc
%doc BaseTools/UserManuals/*.rtf
+%files qosb
+%license LICENSE.qosb
+%doc README.qosb
+%{_bindir}/ovmf-vars-generator
+
%if 0%{?build_ovmf_x64:1}
%files ovmf
%license OvmfPkg/License.txt
@@ -448,6 +516,10 @@ ln -sf ../%{name}/arm/QEMU_EFI-pflash.raw
%{buildroot}/usr/share/AAVMF/
%changelog
+* Fri Mar 30 2018 Patrick Uiterwijk <puiterwijk(a)redhat.com> - 20171011git92d07e4-6
+- Add qemu-ovmf-secureboot (qosb)
+- Generate pre-enrolled Secure Boot OVMF VARS files
+
* Wed Mar 07 2018 Paolo Bonzini <pbonzini(a)redhat.com> - 20171011git92d07e4-5
- Fix GCC 8 compilation
- Replace dosfstools and mtools with qemu-img vvfat