Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package sdbootutil for openSUSE:Factory checked in at 2026-07-06 13:11:38 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/sdbootutil (Old) and /work/SRC/openSUSE:Factory/.sdbootutil.new.1982 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "sdbootutil" Mon Jul 6 13:11:38 2026 rev:103 rq:1363998 version:1+git20260706.f9f4faf Changes: -------- --- /work/SRC/openSUSE:Factory/sdbootutil/sdbootutil.changes 2026-05-08 16:42:13.449333083 +0200 +++ /work/SRC/openSUSE:Factory/.sdbootutil.new.1982/sdbootutil.changes 2026-07-06 13:11:43.437500293 +0200 @@ -1,0 +2,27 @@ +Mon Jul 06 08:55:10 UTC 2026 - Alberto Planas Dominguez <[email protected]> + +- Update to version 1+git20260706.f9f4faf: + * After reboot the shutdown service is not active + * Disable the shutdown service after main service + * Update uhmac dependencies (bsc#1270192, CVE-2026-41676) + * Add systemd transient service to update predictions + * Install extra EFI binaries + +------------------------------------------------------------------- +Thu Jun 25 11:59:20 UTC 2026 - Alberto Planas Dominguez <[email protected]> + +- Update to version 1+git20260625.7fa275e: + * Remove duplicate code and parametrize timers + * Check boot entry before kernel installation + * Re-install an old kernel if initrd cannot be reused + * Skip installation for already installed kernel + * Add configurable devicetree entry support + * Set explicit kernel and initrd paths + * Remove the full tmpdir in the service + * Fix /run/sdbootutil permissions + * Execute predictions in the background + * Add --disable-predictions parameter + * Fix comparison operator + * Add print-loader-path command + +------------------------------------------------------------------- Old: ---- sdbootutil-1+git20260506.25d47bf.obscpio New: ---- sdbootutil-1+git20260706.f9f4faf.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sdbootutil.spec ++++++ --- /var/tmp/diff_new_pack.pW9gQ5/_old 2026-07-06 13:11:44.825548245 +0200 +++ /var/tmp/diff_new_pack.pW9gQ5/_new 2026-07-06 13:11:44.825548245 +0200 @@ -18,7 +18,7 @@ %global rustflags '-Clink-arg=-Wl,-z,relro,-z,now' Name: sdbootutil -Version: 1+git20260506.25d47bf +Version: 1+git20260706.f9f4faf Release: 0 Summary: Bootctl wrapper for BLS boot loaders License: MIT ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.pW9gQ5/_old 2026-07-06 13:11:44.877550042 +0200 +++ /var/tmp/diff_new_pack.pW9gQ5/_new 2026-07-06 13:11:44.881550181 +0200 @@ -1,6 +1,6 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/openSUSE/sdbootutil.git</param> - <param name="changesrevision">25d47bf10ddc4b8b8c6061e82670e8f82fe8916b</param></service></servicedata> + <param name="changesrevision">f9f4faf9ccf726e6a2943f6b94e5b087ede5f49c</param></service></servicedata> (No newline at EOF) ++++++ sdbootutil-1+git20260506.25d47bf.obscpio -> sdbootutil-1+git20260706.f9f4faf.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sdbootutil-1+git20260506.25d47bf/10-sdbootutil.snapper new/sdbootutil-1+git20260706.f9f4faf/10-sdbootutil.snapper --- old/sdbootutil-1+git20260506.25d47bf/10-sdbootutil.snapper 2026-05-06 20:45:00.000000000 +0200 +++ new/sdbootutil-1+git20260706.f9f4faf/10-sdbootutil.snapper 2026-07-06 10:53:28.000000000 +0200 @@ -9,6 +9,71 @@ findmnt --fstab / -O ro >/dev/null } +# Decoupling the calls for update-predictions from the plugin is +# tricky. Those are the basic requirements: +# +# * The plugin launch a detached process with `nohup` that will +# trigger the update +# +# * The call to update-predictions is done by a transient timer +# +# * Because in Tumbleweed the create-snapshot event is received two +# times (pre / post snapshots), to avoid triggering two times the +# update-predictions, we set a large timeout for the +# `create_snapshot` event +# +# * The marker file `/run/sdbootutil/update-predictions` is used to +# mark when there is a pending update-predictions +# +# * If the timer is up, this means that the service has not been +# executed, we reset the timer shutting it down and re-creating it +# +# * Inside the service we remove the marker file, update the +# predictions, and if the file is there again we update the +# predictions again. This guarantee that the predictions are also +# updated for the latest point that is still required (even if this +# means that it is executed multiple times) +# +# * In case that a reboot or shutdown is commanded when the service is +# running, it will not accept the SIGTERM signal, and will require 2 +# minutes before forcing it down +# +# * Finally, if the reboot or shutdown command is launched before the +# timer triggers, a transient service will be executed to run the +# update-predictions. This is done in the ExecStop, because systemd +# will stop this service before the reboot +# +# * The same marker file is used to detect that there is a pending +# update-predictions + +set_update_predictions_timer() +{ + local to="${1:-2}" + # Reset transient timer to `to` seconds (find a better + # estimator than a random number) + mkdir -p /run/sdbootutil; chmod 700 /run/sdbootutil; touch /run/sdbootutil/update-predictions + systemctl --quiet is-active sdbootutil-update-predictions.timer && \ + systemctl stop sdbootutil-update-predictions.timer + echo "Resetting sdbootutil-update-predictions timer to $to seconds" + systemd-run --on-active="$to" --unit sdbootutil-update-predictions.service + + # Set the transient service that will guarantee updating the + # prediction before the shutdown + if ! systemctl --quiet is-active sdbootutil-update-predictions-shutdown.service; then + systemd-run --unit=sdbootutil-update-predictions-shutdown.service \ + --property=Description="Update TPM predictions before shutdown" \ + --property=ConditionSecurity=tpm2 \ + --property=RemainAfterExit=yes \ + --property=DefaultDependencies=no \ + --property=Conflicts=umount.target \ + --property=Before=umount.target \ + --property=RequiresMountsFor="/ /var /run /tmp /boot/efi" \ + --property=TimeoutStopSec=120 \ + --property=ExecStop='/bin/bash -c "[ $(systemctl is-system-running) = stopping ] && [ -f /run/sdbootutil/update-predictions ] && /usr/bin/sdbootutil -v update-predictions || true"' \ + /bin/true + fi +} + # When creating a snapshot we fetch all bls configs from previous # snapshot dir, mangle them to contain current snapshot number, then # install to efi partition. @@ -21,18 +86,26 @@ [ "$path" = "/" ] || return 0 [ "$fs" = btrfs ] || return 1 - /usr/bin/sdbootutil update --sync "$num" || : + nohup bash -c "( + $(declare -f is_transactional) + $(declare -f set_update_predictions_timer) + + /usr/bin/sdbootutil update --disable-predictions \"$num\" + + # If we are in a transactional system we abort here. The + # kernel entries are added later via set_default_snapshot, + # when tukit set via snapper the new snapshot as complete + is_transactional && return 0 + + # The entries are added here only for Tumbleweed + # (non-transactional systems) + /usr/bin/sdbootutil add-all-kernels --disable-predictions \"$num\" + # In Tumbleweed clean the default snapshot, not the new + # created + /usr/bin/sdbootutil cleanup --disable-predictions - # If we are in a transactional system we abort here. The - # kernel entries are added later via set_default_snapshot, - # when tukit set via snapper the new snapshot as complete - is_transactional && return 0 - - # The entries are added here only for Tumbleweed - # (non-transactional systems) - /usr/bin/sdbootutil add-all-kernels "$num" || : - # In Tumbleweed clean the default snapshot, not the new created - /usr/bin/sdbootutil cleanup || : + set_update_predictions_timer 30 + )" 2>&1 | logger & } delete_snapshot() @@ -44,8 +117,14 @@ [ "$path" = "/" ] || return 0 [ "$fs" = btrfs ] || return 1 - /usr/bin/sdbootutil remove-all-kernels "$num" || : - /usr/bin/sdbootutil cleanup "$num" || : + nohup bash -c "( + $(declare -f set_update_predictions_timer) + + /usr/bin/sdbootutil remove-all-kernels --disable-predictions \"$num\" + /usr/bin/sdbootutil cleanup --disable-predictions \"$num\" + + set_update_predictions_timer + )" 2>&1 | logger & } set_default_snapshot() @@ -57,19 +136,26 @@ [ "$path" = "/" ] || return 0 [ "$fs" = btrfs ] || return 1 - if is_transactional; then - # In transactional systems the boot entries are added - # here, once the transaction is complete and tukit - # decides to keep it - /usr/bin/sdbootutil add-all-kernels "$num" || : - - if [ -e /usr/lib/module-init-tools/regenerate-initrd-posttrans ]; then - /usr/lib/module-init-tools/regenerate-initrd-posttrans - fi - fi + nohup bash -c "( + $(declare -f is_transactional) + $(declare -f set_update_predictions_timer) + + if is_transactional; then + # In transactional systems the boot entries are added + # here, once the transaction is complete and tukit + # decides to keep it + /usr/bin/sdbootutil add-all-kernels --disable-predictions \"$num\" + + if [ -e /usr/lib/module-init-tools/regenerate-initrd-posttrans ]; then + /usr/lib/module-init-tools/regenerate-initrd-posttrans + fi + fi + + /usr/bin/sdbootutil set-default-snapshot --disable-predictions \"$num\" + /usr/bin/sdbootutil update --disable-predictions --sync \"$num\" - /usr/bin/sdbootutil set-default-snapshot "$num" || : - /usr/bin/sdbootutil update --sync "$num" || : + set_update_predictions_timer + )" 2>&1 | logger & } h() @@ -78,6 +164,34 @@ echo "${!commands[@]}" } +# In Tumbleweed (non-transactional btrfs) the ordering of events are +# (for last snapshot n): +# * create-snapshot-pre / btrfs n+1 # "pre" snapshot +# * create-snapshot / btrfs n+1 # "pre" snapshot +# * create-snapshot-post / btrfs n+1 # "pre" snapshot +# * modify-snapshot-pre / btrfs n+1 +# * modify-snapshot / btrfs n+1 +# * modify-snapshot-post / btrfs n+1 +# * create-snapshot-pre / btrfs n+2 # "post" snapshot +# * create-snapshot / btrfs n+2 # "post" snapshot +# * create-snapshot-post / btrfs n+2 # "post" snapshot +# +# In MicroOS (transactional btrfs) the ordering is: +# * create-snapshot-pre / btrfs n+1 +# * create-snapshot / btrfs n+1 +# * create-snapshot-post / btrfs n+1 +# * modify-snapshot-pre / btrfs n+1 +# * modify-snapshot / btrfs n+1 +# * modify-snapshot-post / btrfs n+1 +# * set-read-only-pre / btrfs n+1 +# * set-read-only-post / btrfs n+1 +# * set-default-snapshot-pre / btrfs n+1 # Not is snapperd.logs +# * set-default-snapshot / btrfs n+1 # Not is snapperd.logs +# * set-default-snapshot-post / btrfs n+1 # Not is snapperd.logs + +# For "timeline" snapshots only the create-snapshot-* events are +# emitted + declare -A commands commands['create-snapshot-post']=create_snapshot diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sdbootutil-1+git20260506.25d47bf/completions/bash_sdbootutil new/sdbootutil-1+git20260706.f9f4faf/completions/bash_sdbootutil --- old/sdbootutil-1+git20260506.25d47bf/completions/bash_sdbootutil 2026-05-06 20:45:00.000000000 +0200 +++ new/sdbootutil-1+git20260706.f9f4faf/completions/bash_sdbootutil 2026-07-06 10:53:28.000000000 +0200 @@ -113,6 +113,9 @@ elif [ "$opt_arg_fun" == "_path" ]; then # shellcheck disable=SC2207 COMPREPLY=($(compgen -d -- "$cur")) + elif [ "$opt_arg_fun" == "_file" ]; then + # shellcheck disable=SC2207 + COMPREPLY=($(compgen -f -- "$cur")) elif [ "$opt_arg_fun" ]; then eval "$opt_arg_fun" # shellcheck disable=SC2207 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sdbootutil-1+git20260506.25d47bf/sdbootutil new/sdbootutil-1+git20260706.f9f4faf/sdbootutil --- old/sdbootutil-1+git20260506.25d47bf/sdbootutil 2026-05-06 20:45:00.000000000 +0200 +++ new/sdbootutil-1+git20260706.f9f4faf/sdbootutil 2026-07-06 10:53:28.000000000 +0200 @@ -45,7 +45,9 @@ arg_rootfs= arg_rootfs_data= arg_esp_free_space= +arg_devicetree_source= arg_force= +arg_disable_predictions= have_snapshots= in_buildroot= # Possible values: vmlinuz image vmlinux linux bzImage uImage Image zImage @@ -145,7 +147,17 @@ (uuid, partuuid, label, partlabel, device) --rootfs-data Extra data when --rootfs is used --esp-free-space Percentage of free space in the ESP + --devicetree-source Absolute source path of a device tree blob to copy + into the boot partition and reference from generated + BLS entries. The source path is resolved in the + target rootfs/snapshot. %K expands to the full + kernel version and %V to the kernel package version + without the flavor suffix. If configured, the + resolved file must exist and be readable, and + must be usable without Secure Boot, or kernel + installation is aborted. --force Force certain operations inside a transaction + --disable-predictions Disable automatic update predictions -v, --verbose More verbose output --start-trace-code Create /var/log/sdbootutil.log to trace the code. (verbose output is enabled) @@ -235,6 +247,9 @@ get-timeout Get the menu timeout in seconds + print-loader-path + Print path to currently booted boot loader binary + enroll Enroll a TPM2 (+PIN), a FIDO2 key or a password for all devices @@ -351,6 +366,7 @@ ROOTFS="${arg_rootfs:-$ROOTFS}" ESP_FREE_SPACE="${arg_esp_free_space:-10}" + DEVICETREE_SOURCE="${arg_devicetree_source:-}" } create_default_config_file() @@ -371,6 +387,15 @@ # Percentage (%) of free space in the ESP that sdbootutil should guarantee # Default values is 10% ESP_FREE_SPACE="$ESP_FREE_SPACE" + + # Optional absolute path to a device tree blob. If set, it is copied to the + # boot partition and a devicetree field is added to generated BLS entries. + # The source path is resolved in the target rootfs/snapshot. %K expands to + # the full kernel version, %V to the kernel package version without the + # flavor suffix. If set, the resolved file must exist and be readable, + # otherwise kernel installation aborts. Currently supported only with + # Secure Boot disabled. + DEVICETREE_SOURCE="$DEVICETREE_SOURCE" EOF } @@ -405,6 +430,7 @@ FDE_SEAL_PCR_LIST="${arg_pcr:-$FDE_SEAL_PCR_LIST}" ROOTFS="${arg_rootfs:-$ROOTFS}" ESP_FREE_SPACE="${arg_esp_free_space:-$ESP_FREE_SPACE}" + DEVICETREE_SOURCE="${arg_devicetree_source:-$DEVICETREE_SOURCE}" } is_secure_boot() @@ -678,6 +704,11 @@ update_entries jq "[.[]|select(has(\"options\"))|select(.options|test(\"root=(?:$root)\"))]" } +update_entries_for_extra() +{ + update_entries jq "[.[]|select((.linux//.efi//\"\")|startswith(\"/EFI/extra\"))]" +} + entry_conf_file() { local kernel_version="${1:?}" @@ -823,7 +854,7 @@ fi rollback+=("$old") install -p -m 0644 "$src" "$dst" || return "$?" - chown root:root "$dst" 2> /dev/null || : + chown root:root "$dst" 2> /dev/null || true info "Installed $dst" } @@ -906,9 +937,9 @@ local conf [ -z "$arg_no_reuse_initrd" ] || return 1 - settle_entry_token "${snapshot}" + settle_entry_token "$snapshot" - conf="$(find_conf_file "$kernel_version" "${snapshot}")" + conf="$(find_conf_file "$kernel_version" "$snapshot")" local find_conf_status=$? if [ $find_conf_status -ne 0 ]; then @@ -1023,6 +1054,16 @@ echo $((size / 1024 + 1)) } +pending_devicetree_size() +{ + local devicetree="$1" + [ -n "$devicetree" ] || { + echo 0 + return 0 + } + echo $(($(stat -L -c %s "$devicetree") / 1024 + 1)) +} + boot_space() { echo $(($(findmnt --noheadings --bytes -o SIZE --target "${boot_root}" | head -n 1) / 1024)) @@ -1171,15 +1212,37 @@ make_free_space_for_kernel() { local snapshot="$1" + local kernel="$2" + local initrds="$3" + local devicetree="${4:-}" # Calculate the free space and the required size. All sizes # are in Kb to avoid big numbers local free_space total_size - total_size=$(($(pending_kernel_size "$src") + $(pending_initrds_size "$tmpdir"))) + total_size=$(($(pending_kernel_size "$kernel") + $(pending_initrds_size "$initrds") + $(pending_devicetree_size "$devicetree"))) make_free_space "$snapshot" "$total_size" } +resolve_devicetree_source() +{ + local subvol="$1" + local kernel_version="$2" + local kernel_package_version="${kernel_version%-*}" + local devicetree_source="${DEVICETREE_SOURCE:-}" + + [ -n "$devicetree_source" ] || return 0 + devicetree_source="${devicetree_source//%K/$kernel_version}" + devicetree_source="${devicetree_source//%V/$kernel_package_version}" + [[ "$devicetree_source" == '/'* ]] || err "DEVICETREE_SOURCE must be an absolute path" + + local snapshot_prefix="${subvol#"${subvol_prefix}"}" + devicetree_source="$snapshot_prefix$devicetree_source" + [ -f "$devicetree_source" ] || err "Can't find device tree blob $devicetree_source" + [ -r "$devicetree_source" ] || err "Device tree blob is not readable: $devicetree_source" + echo "$devicetree_source" +} + create_boot_options() { local subvol="$1" local cmdline @@ -1239,10 +1302,32 @@ calc_chksum "$src" settle_entry_token "${snapshot}" local dst="/$entry_token/$kernel_version/linux-$chksum" + local devicetree_src= + local devicetree_dst= + + # Because nullglob, the second condition can be false + # shellcheck disable=SC2144 disable=SC2157 + [ -z "${boot_root}${dst}" ] \ + || [ -z "${boot_root}/$entry_token/$kernel_version/initrd-"* ] \ + || ! find_conf_file "$kernel_version" "$snapshot" > /dev/null \ + || [ -n "$arg_no_reuse_initrd" ] \ + || [ -n "$arg_force" ] \ + || { + info "Kernel $kernel_version already in the ESP" + return 0 + } local initrd="${src%/*}/initrd" - mkdir -p "${boot_root}${dst%/*}" + # Resolve the device tree before creating any ESP directory, so a + # missing (but configured) blob aborts without leaving an empty + # "$entry_token/$kernel_version" directory behind + devicetree_src="$(resolve_devicetree_source "$subvol" "$kernel_version")" || err "Failed to resolve DEVICETREE_SOURCE" + if [ -n "$devicetree_src" ]; then + ! is_secure_boot || err "External devicetree files are not supported when Secure Boot is enabled" + calc_chksum "$devicetree_src" + devicetree_dst="${dst%/*}/devicetree-$chksum.dtb" + fi if [ -e "$initrd" ]; then ln -s "$initrd" "$tmpdir/initrd-0" @@ -1273,7 +1358,7 @@ fi fi - make_free_space_for_kernel "$snapshot" || err "No free space in ${boot_root} for new kernel" + make_free_space_for_kernel "$snapshot" "$src" "$tmpdir" "$devicetree_src" || err "No free space in ${boot_root} for new kernel" local boot_options [ -z "$in_buildroot" ] || subvol="${subvol_prefix}/.snapshots/${snapshot}/snapshot" @@ -1305,7 +1390,7 @@ title $title version ${snapshot:+$snapshot@}$kernel_version${entry_machine_id:+${nl}machine-id $entry_machine_id}${sort_key:+${nl}sort-key $sort_key} options $boot_options - linux $dst + linux $dst${devicetree_dst:+${nl}devicetree ${devicetree_dst}} EOF for i in "${dstinitrd[@]}"; do echo "initrd $i" >> "$tmpdir/entry.conf" @@ -1313,12 +1398,21 @@ dbg "Generated new boot entry" dbg_cat "$tmpdir/entry.conf" + mkdir -p "${boot_root}${dst%/*}" + local failed= if [ ! -e "${boot_root}$dst" ]; then install_with_rollback "$src" "${boot_root}$dst" || failed=kernel else info "Reusing ${boot_root}$dst" fi + if [ -z "$failed" ] && [ -n "$devicetree_src" ]; then + if [ ! -e "${boot_root}${devicetree_dst}" ]; then + install_with_rollback "$devicetree_src" "${boot_root}${devicetree_dst}" || failed=devicetree + else + info "Reusing ${boot_root}${devicetree_dst}" + fi + fi if [ -z "$failed" ] && [ -e "$tmpdir/initrd-0" ]; then i=0 while [ -e "$tmpdir/initrd-$i" ]; do @@ -1483,7 +1577,7 @@ local k local v while read -r k v; do - if [ "$k" = 'linux' ] || [ "$k" = 'initrd' ]; then + if [ "$k" = 'linux' ] || [ "$k" = 'initrd' ] || [ "$k" = 'devicetree' ]; then if [ ! -e "$root$v" ]; then errors+=("$root/$v does not exist") fi @@ -1523,7 +1617,7 @@ local v while read -r k v; do case "$k" in - title|version|sort-key|options|linux|initrd) ;; + title|version|sort-key|options|linux|initrd|devicetree) ;; *) continue ;; esac @@ -1892,6 +1986,106 @@ ' < "$devicefile" } +extra_entry_needs_update() +{ + local entry="$1" + + # If we do not have a version in the entry file (or the entry + # file is missing), then we assume that an update is required + [ -n "$entry" ] || return 0 + read -r _ nv < <(grep -ao '^version .*$' "$entry") + [ -n "$nv" ] || return 0 + + entry="${boot_root}/loader/entries/$(basename "$entry")" + [ -f "$entry" ] || return 0 + read -r _ v < <(grep -ao '^version .*$' "$entry") + [ -n "$v" ] || return 0 + + systemd-analyze compare-versions "$v" "<" "$nv" 2> /dev/null +} + +install_extra_entry() +{ + local subvol="$1" + local entry="$2" + + local -A e + local -a l + while read -r line; do + [[ "$line" == '#'* ]] && continue + IFS="=" read -r -a l <<<"$line" + [ "${#l[@]}" -eq 2 ] || err "Cannot parse line $line" + e["${l[0]}"]="${l[1]}" + done < "$entry" + + [ -n "${e[EFI]}" ] || return 0 + [ -f "${subvol:1}${e[EFI]}" ] || err "Missing extra entry file ${e[EFI]}" + [ -z "${e[ENTRY]}" ] || [ -f "${subvol:1}${e[ENTRY]}" ] || err "Missing extra entry file ${e[ENTRY]}" + + # If the file can be installed, echo the name so it can be + # registered as installed (even if does not needs to be + # updated) + echo "/EFI/extra/$(basename "${e[EFI]}")" + + extra_entry_needs_update "${subvol:1}${e[ENTRY]}" || return 0 + + mkdir -p "${esp_root}/EFI/extra" + install -p -D "${subvol:1}${e[EFI]}" "${esp_root}/EFI/extra" + [ -z "${e[ENTRY]}" ] || install -p -D "${subvol:1}${e[ENTRY]}" "${boot_root}/loader/entries" +} + +install_extra_entries() +{ + local snapshot="$1" + + local subvol="" + [ -z "$have_snapshots" ] || subvol="${subvol_prefix}/.snapshots/${snapshot}/snapshot" + + update_entries_for_extra + + local efi install_extra_entry_status + local -A entries + for i in "${subvol:1}"/usr/lib/sdbootutil/entries.d/*.conf; do + [ -e "${subvol:1}/etc/sdbootutil/entries.d/$(basename "$i")" ] && continue + dbg_cat "$i" + efi="$(install_extra_entry "$subvol" "$i")" + install_extra_entry_status=$? + [ "$install_extra_entry_status" -eq 0 ] || { + warn "Error installing extra entry $(basename "$i")" + } + [ -z "$efi" ] || entries["$efi"]=1 + done + + for i in "${subvol:1}"/etc/sdbootutil/entries.d/*.conf; do + dbg_cat "$i" + efi="$(install_extra_entry "$subvol" "$i")" + install_extra_entry_status=$? + [ "$install_extra_entry_status" -eq 0 ] || { + warn "Error installing extra entry $(basename "$i")" + } + [ -z "$efi" ] || entries["$efi"]=1 + done + + # Remove the entry + efi pairs not installed + local entry + while read -r efi; do + read -r entry + [ -n "${entries[$efi]}" ] || { + rm -f "${esp_root}/EFI${efi}" + rm -f "$entry" + } + done < <(jq -r '.[] | .linux // .efi, .path' < "$entryfile") + + # Finally, remove the single efi files not installed + for i in "${esp_root}"/EFI/extra/*; do + efi="${i#"${esp_root}"}" + [ "${entries[$efi]:-0}" -eq 1 ] || rm -f "${esp_root}${efi}" + done + + # This action will require to update the PCR predictions + update_predictions=1 +} + install_bootloader() { local snapshot="" @@ -2009,6 +2203,8 @@ info "The bootloader will be downgraded" install_bootloader "${1:-$root_snapshot}" fi + + install_extra_entries "${1:-$root_snapshot}" } hex_to_binary() @@ -2334,6 +2530,28 @@ fi } +print_loader_path() +{ + local loader_path + loader_path="$(bootctl --print-loader-path 2> /dev/null)" && { + echo "${loader_path}" + return 0 + } || true + + # Simple approach: try the different options + local bootloader + bootloader=$(find_bootloader "$snapshot") + for i in "grub.efi" "${bootloader##*/}" "BOOT${firmware_arch^^}.EFI"; do + if [ -e "${esp_root}${esp_dst}/$i" ]; then + echo "${esp_root}${esp_dst}/$i" + return 0 + fi + done + + echo "No loader EFI binary path found" + return 1 +} + set_default_snapshot() { [ -n "$have_snapshots" ] || { @@ -2613,10 +2831,12 @@ { local linux="$1" local initrd="$2" - local cmdline="$3" - local suffix="$4" + local devicetree="$3" + local cmdline="$4" + local suffix="$5" local elements=("$linux" "$initrd") + [ -z "$devicetree" ] || elements+=("$devicetree") local locks=() local n=0 for element in "${elements[@]}"; do @@ -2671,8 +2891,10 @@ local linux="$1" local cmdline="$2" local initrd="$3" - local suffix="$4" + local devicetree="$4" + local suffix="$5" local lines=("$linux" "$cmdline" "$initrd") + [ -z "$devicetree" ] || lines+=("$devicetree") local locks=() local n=0 @@ -2836,6 +3058,7 @@ while read -r options; do read -r linux read -r initrd + read -r devicetree [ -f "${esp_root}$linux" ] || { info "Missing ${esp_root}$linux, ignoring entry for prediction" continue @@ -2844,6 +3067,10 @@ info "Missing ${esp_root}$initrd, ignoring entry for prediction" continue } + if [ -n "$devicetree" ] && [ ! -f "${esp_root}$devicetree" ]; then + info "Missing ${esp_root}$devicetree, ignoring entry for prediction" + continue + fi n=$((n+1)) [ "$n" -le 8 ] || { info "More than 8 variations for 650-grub2-bls-entry-cmdline" @@ -2851,8 +3078,10 @@ } pcrlock_grub2_bls_cmdline "linux ${grub2_bls_drive}$linux $options" \ "${grub2_bls_drive}$linux $options" \ - "initrd ${grub2_bls_drive}$initrd" "$n" - done < <(jq --raw-output 'sort_by(.priority, (.kernel | map(-.))) | .[] | .options, .linux, .initrd[0]' "$entryfile") + "initrd ${grub2_bls_drive}$initrd" \ + "${devicetree:+devicetree ${grub2_bls_drive}$devicetree}" \ + "$n" + done < <(jq --raw-output 'sort_by(.priority, (.kernel | map(-.))) | .[] | .options, .linux, .initrd[0], (.devicetree // "")' "$entryfile") # Generate variation for 650-grub2-bls-entry-cmdline component # that contains the current cmdline and the current initrd, @@ -2865,11 +3094,14 @@ while read -r options; do read -r linux read -r initrd + read -r devicetree n=$((n+1)) pcrlock_grub2_bls_cmdline "linux ${grub2_bls_drive}$linux $options" \ "${grub2_bls_drive}$linux $options" \ - "initrd ${grub2_bls_drive}$initrd" "0-$n" - done < <(jq --raw-output '.[] | .options, .linux, .initrd[0]' "$initialentryfile") + "initrd ${grub2_bls_drive}$initrd" \ + "${devicetree:+devicetree ${grub2_bls_drive}$devicetree}" \ + "0-$n" + done < <(jq --raw-output '.[] | .options, .linux, .initrd[0], (.devicetree // "")' "$initialentryfile") fi # If shim is installed, grub2-bls invokes shim to extend PCR4 @@ -2949,6 +3181,7 @@ while read -r cmdline; do read -r linux read -r initrd + read -r devicetree [ -f "${esp_root}$linux" ] || { info "Missing ${esp_root}$linux, ignoring entry for prediction" continue @@ -2957,13 +3190,21 @@ info "Missing ${esp_root}$initrd, ignoring entry for prediction" continue } + if [ -n "$devicetree" ] && [ ! -f "${esp_root}$devicetree" ]; then + info "Missing ${esp_root}$devicetree, ignoring entry for prediction" + continue + fi n=$((n+1)) [ "$n" -le 4 ] || { info "More than 4 variations for 710-grub2-bls-kernel-initrd-entry" continue } - pcrlock_grub2_bls_kernel_initrd_cmdline_initrd "${esp_root}$linux" "${esp_root}$initrd" "BOOT_IMAGE=${grub2_bls_drive}$linux $cmdline" "$n" - done < <(jq --raw-output 'sort_by(.priority, (.kernel | map(-.))) | .[] | .options, .linux, .initrd[0]' "$entryfile") + pcrlock_grub2_bls_kernel_initrd_cmdline_initrd \ + "${esp_root}$linux" "${esp_root}$initrd" \ + "${devicetree:+${esp_root}$devicetree}" \ + "BOOT_IMAGE=${grub2_bls_drive}$linux $cmdline" \ + "$n" + done < <(jq --raw-output 'sort_by(.priority, (.kernel | map(-.))) | .[] | .options, .linux, .initrd[0], (.devicetree // "")' "$entryfile") # Generate variation for # 710-grub2-bls-kernel-initrd-kernel-cmdline-initrd-entry for @@ -2973,9 +3214,14 @@ while read -r cmdline; do read -r linux read -r initrd + read -r devicetree n=$((n+1)) - pcrlock_grub2_bls_kernel_initrd_cmdline_initrd "${tmpdir}$linux" "${tmpdir}$initrd" "BOOT_IMAGE=${grub2_bls_drive}$linux $cmdline" "0-$n" - done < <(jq --raw-output '.[] | .options, .linux, .initrd[0]' "$initialentryfile") + pcrlock_grub2_bls_kernel_initrd_cmdline_initrd \ + "${tmpdir}$linux" "${tmpdir}$initrd" \ + "${devicetree:+${tmpdir}$devicetree}" \ + "BOOT_IMAGE=${grub2_bls_drive}$linux $cmdline" \ + "0-$n" + done < <(jq --raw-output '.[] | .options, .linux, .initrd[0], (.devicetree // "")' "$initialentryfile") fi } @@ -3032,7 +3278,7 @@ # If no PCRs are included, we are starting from a very # misaligned event log (initial installation, for example) - [ ! "$output" = "{}" ] || { + [ "$output" != "{}" ] || { echo "$pcrs" return 0 } @@ -3429,6 +3675,10 @@ return 0 } + [ -z "${DEVICETREE_SOURCE:-}" ] || ! is_sdboot || { + warn "TPM2 predictions with systemd-boot devicetree entries are not validated. Use --disable-predictions if this affects boot." + } + ! is_pcr_oracle || { warn "System enrolled with pcr-oracle. Re-enroll to use systemd-pcrlock" return 0 @@ -4124,6 +4374,7 @@ [get-default]="" [set-timeout]="seconds" [get-timeout]="" + [print-loader-path]="" [enroll]="" [unenroll]="" [update-predictions]="" @@ -4163,7 +4414,9 @@ [rootfs]="_rootfs" [rootfs-data]="_rootfs_data" [esp-free-space]="_esp_free_space" + [devicetree-source]="_file" [force]="" + [disable-predictions]="" ) opts_long="" for opt in "${!options_with_arg[@]}"; do @@ -4220,7 +4473,9 @@ --rootfs) arg_rootfs="$2"; shift 2 ;; --rootfs-data) arg_rootfs_data="$2"; shift 2 ;; --esp-free-space) arg_esp_free_space="$2"; shift 2 ;; + --devicetree-source) arg_devicetree_source="$2"; shift 2 ;; --force) arg_force=1; shift ;; + --disable-predictions) arg_disable_predictions=1; shift ;; --) shift ; break ;; *) echo "Internal error!" ; exit 1 ;; esac @@ -4275,7 +4530,7 @@ fi if [ -n "$arg_esp_path" ] && [ "$esp_root" != "$arg_esp_path" ]; then - err "mismatch of esp path" + err "Mismatch of ESP path" fi [ -n "$arg_arch" ] && firmware_arch="$arg_arch" @@ -4360,6 +4615,7 @@ case "$1" in install) install_bootloader "${2:-$root_snapshot}" + install_extra_entries "${2:-$root_snapshot}" create_default_config_file ;; needs-update) bootloader_needs_update "${2:-$root_snapshot}" ;; @@ -4420,6 +4676,8 @@ set_timeout "$2" ;; get-timeout) get_timeout "$2" ;; + print-loader-path) + print_loader_path ;; enroll) enroll ;; unenroll) @@ -4430,4 +4688,4 @@ helpandquit ;; esac -[ -z "$update_predictions" ] || generate_tpm2_predictions +[ -z "$update_predictions" ] || [ -n "$arg_disable_predictions" ] || generate_tpm2_predictions diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sdbootutil-1+git20260506.25d47bf/sdbootutil-update-predictions.service new/sdbootutil-1+git20260706.f9f4faf/sdbootutil-update-predictions.service --- old/sdbootutil-1+git20260506.25d47bf/sdbootutil-update-predictions.service 2026-05-06 20:45:00.000000000 +0200 +++ new/sdbootutil-1+git20260706.f9f4faf/sdbootutil-update-predictions.service 2026-07-06 10:53:28.000000000 +0200 @@ -4,19 +4,29 @@ [Service] Type=oneshot -RemainAfterExit=yes KeyringMode=shared PrivateTmp=yes ExecStartPre=/usr/bin/sh -c 'mkdir "/tmp/$INVOCATION_ID"; cp -a /var/lib/pcrlock.d /tmp/$INVOCATION_ID/pcrlock.d' -ExecStart=/usr/bin/sdbootutil -v update-predictions +ExecStart=/usr/bin/sh -c '\ + while true; do \ + rm -f /run/sdbootutil/update-predictions; \ + /usr/bin/sdbootutil -v update-predictions || exit $?; \ + [ -f /run/sdbootutil/update-predictions ] || break; \ + done' ExecStopPost=/usr/bin/sh -c '\ + systemctl --quiet is-active sdbootutil-update-predictions-shutdown.service && systemctl stop sdbootutil-update-predictions-shutdown.service; \ if [ "$SERVICE_RESULT" != "success" ]; then \ echo "Command failed. Reason: $SERVICE_RESULT (Status: $EXIT_STATUS). Restoring backup..."; \ rm -rf /var/lib/pcrlock.d/*; \ cp -a "/tmp/$INVOCATION_ID/pcrlock.d/." /var/lib/pcrlock.d/; \ fi; \ - rm -rf "/tmp/$INVOCATION_ID/pcrlock.d"' + rm -rf "/tmp/$INVOCATION_ID"' ImportCredential=sdbootutil-update-predictions.* +# The service can be triggered by a timer (snapper plugin), this +# prevents systemd from killing the script mid-run during a reboot, +# and gives 2 minutes to complete +KillSignal=SIGCONT +TimeoutStopSec=120 [Install] WantedBy=default.target diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sdbootutil-1+git20260506.25d47bf/uhmac/Cargo.lock new/sdbootutil-1+git20260706.f9f4faf/uhmac/Cargo.lock --- old/sdbootutil-1+git20260506.25d47bf/uhmac/Cargo.lock 2026-05-06 20:45:00.000000000 +0200 +++ new/sdbootutil-1+git20260706.f9f4faf/uhmac/Cargo.lock 2026-07-06 10:53:28.000000000 +0200 @@ -4,9 +4,9 @@ [[package]] name = "anstream" -version = "0.6.19" +version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "301af1932e46185686725e0fad2f8f2aa7da69dd70bf6ecc44d6b703844a3933" +checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d" dependencies = [ "anstyle", "anstyle-parse", @@ -19,33 +19,33 @@ [[package]] name = "anstyle" -version = "1.0.11" +version = "1.0.14" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "862ed96ca487e809f1c8e5a8447f6ee2cf102f846893800b20cebdf541fc6bbd" +checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000" [[package]] name = "anstyle-parse" -version = "0.2.7" +version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2" +checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e" dependencies = [ "utf8parse", ] [[package]] name = "anstyle-query" -version = "1.1.3" +version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "6c8bdeb6047d8983be085bab0ba1472e6dc604e7041dbf6fcd5e71523014fae9" +checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ "windows-sys", ] [[package]] name = "anstyle-wincon" -version = "3.0.9" +version = "3.0.11" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "403f75924867bb1033c59fbf0797484329750cfbe3c4325cd33127941fabc882" +checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", @@ -54,30 +54,31 @@ [[package]] name = "bitflags" -version = "2.9.1" +version = "2.13.0" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "1b8e56985ec62d17e9c1001dc89c88ecd7dc08e47eba5ec7c29c7b5eeecde967" +checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8" [[package]] name = "cc" -version = "1.2.26" +version = "1.2.65" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "956a5e21988b87f372569b66183b78babf23ebc2e744b733e4350a752c4dafac" +checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96" dependencies = [ + "find-msvc-tools", "shlex", ] [[package]] name = "cfg-if" -version = "1.0.1" +version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "9555578bc9e57714c812a1f84e4fc5b4d21fcb063490c624de019f7464c91268" +checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" [[package]] name = "clap" -version = "4.5.40" +version = "4.6.1" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "40b6887a1d8685cebccf115538db5c0efe625ccac9696ad45c409d96566e910f" +checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51" dependencies = [ "clap_builder", "clap_derive", @@ -85,9 +86,9 @@ [[package]] name = "clap_builder" -version = "4.5.40" +version = "4.6.0" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "e0c66c08ce9f0c698cbce5c0279d0bb6ac936d8674174fe48f736533b964f59e" +checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f" dependencies = [ "anstream", "anstyle", @@ -97,9 +98,9 @@ [[package]] name = "clap_derive" -version = "4.5.40" +version = "4.6.1" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "d2c7947ae4cc3d851207c1adb5b5e260ff0cca11446b1d6d1423788e442257ce" +checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9" dependencies = [ "heck", "proc-macro2", @@ -109,15 +110,21 @@ [[package]] name = "clap_lex" -version = "0.7.5" +version = "1.1.0" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "b94f61472cee1439c0b966b47e3aca9ae07e45d070759512cd390ea2bebc6675" +checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9" [[package]] name = "colorchoice" -version = "1.0.4" +version = "1.0.5" +source = "registry+https://github.com/rust-lang/crates.io-index"; +checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570" + +[[package]] +name = "find-msvc-tools" +version = "0.1.9" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75" +checksum = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582" [[package]] name = "foreign-types" @@ -148,39 +155,32 @@ [[package]] name = "is_terminal_polyfill" -version = "1.70.1" +version = "1.70.2" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf" +checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695" [[package]] name = "libc" -version = "0.2.172" +version = "0.2.186" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa" - -[[package]] -name = "once_cell" -version = "1.21.3" -source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d" +checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66" [[package]] name = "once_cell_polyfill" -version = "1.70.1" +version = "1.70.2" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "a4895175b425cb1f87721b59f0f286c2092bd4af812243672510e1ac53e2e0ad" +checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe" [[package]] name = "openssl" -version = "0.10.73" +version = "0.10.81" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8" +checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45" dependencies = [ "bitflags", "cfg-if", "foreign-types", "libc", - "once_cell", "openssl-macros", "openssl-sys", ] @@ -198,9 +198,9 @@ [[package]] name = "openssl-sys" -version = "0.9.109" +version = "0.9.117" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571" +checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695" dependencies = [ "cc", "libc", @@ -210,33 +210,33 @@ [[package]] name = "pkg-config" -version = "0.3.32" +version = "0.3.33" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c" +checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e" [[package]] name = "proc-macro2" -version = "1.0.95" +version = "1.0.106" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778" +checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934" dependencies = [ "unicode-ident", ] [[package]] name = "quote" -version = "1.0.40" +version = "1.0.46" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d" +checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368" dependencies = [ "proc-macro2", ] [[package]] name = "shlex" -version = "1.3.0" +version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64" +checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba" [[package]] name = "strsim" @@ -246,9 +246,9 @@ [[package]] name = "syn" -version = "2.0.103" +version = "2.0.118" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "e4307e30089d6fd6aff212f2da3a1f9e32f3223b1f010fb09b7c95f90f3ca1e8" +checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422" dependencies = [ "proc-macro2", "quote", @@ -266,9 +266,9 @@ [[package]] name = "unicode-ident" -version = "1.0.18" +version = "1.0.24" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512" +checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" [[package]] name = "utf8parse" @@ -283,74 +283,16 @@ checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426" [[package]] -name = "windows-sys" -version = "0.59.0" +name = "windows-link" +version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b" -dependencies = [ - "windows-targets", -] +checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5" [[package]] -name = "windows-targets" -version = "0.52.6" +name = "windows-sys" +version = "0.61.2" source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973" +checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc" dependencies = [ - "windows_aarch64_gnullvm", - "windows_aarch64_msvc", - "windows_i686_gnu", - "windows_i686_gnullvm", - "windows_i686_msvc", - "windows_x86_64_gnu", - "windows_x86_64_gnullvm", - "windows_x86_64_msvc", + "windows-link", ] - -[[package]] -name = "windows_aarch64_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3" - -[[package]] -name = "windows_aarch64_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469" - -[[package]] -name = "windows_i686_gnu" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b" - -[[package]] -name = "windows_i686_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66" - -[[package]] -name = "windows_i686_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66" - -[[package]] -name = "windows_x86_64_gnu" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78" - -[[package]] -name = "windows_x86_64_gnullvm" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d" - -[[package]] -name = "windows_x86_64_msvc" -version = "0.52.6" -source = "registry+https://github.com/rust-lang/crates.io-index"; -checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec" diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sdbootutil-1+git20260506.25d47bf/uhmac/Cargo.toml new/sdbootutil-1+git20260706.f9f4faf/uhmac/Cargo.toml --- old/sdbootutil-1+git20260506.25d47bf/uhmac/Cargo.toml 2026-05-06 20:45:00.000000000 +0200 +++ new/sdbootutil-1+git20260706.f9f4faf/uhmac/Cargo.toml 2026-07-06 10:53:28.000000000 +0200 @@ -4,6 +4,6 @@ edition = "2024" [dependencies] -clap = { version = "4.5.38", features = ["derive"] } +clap = { version = "4.6.1", features = ["derive"] } hex = "0.4.3" -openssl = "0.10.72" +openssl = "0.10.81" ++++++ sdbootutil.obsinfo ++++++ --- /var/tmp/diff_new_pack.pW9gQ5/_old 2026-07-06 13:11:45.141559162 +0200 +++ /var/tmp/diff_new_pack.pW9gQ5/_new 2026-07-06 13:11:45.145559301 +0200 @@ -1,5 +1,5 @@ name: sdbootutil -version: 1+git20260506.25d47bf -mtime: 1778093100 -commit: 25d47bf10ddc4b8b8c6061e82670e8f82fe8916b +version: 1+git20260706.f9f4faf +mtime: 1783328008 +commit: f9f4faf9ccf726e6a2943f6b94e5b087ede5f49c ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/sdbootutil/vendor.tar.zst /work/SRC/openSUSE:Factory/.sdbootutil.new.1982/vendor.tar.zst differ: char 7, line 1
