Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package pesign-obs-integration for
openSUSE:Factory checked in at 2026-08-04 21:30:08
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/pesign-obs-integration (Old)
and /work/SRC/openSUSE:Factory/.pesign-obs-integration.new.16738 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "pesign-obs-integration"
Tue Aug 4 21:30:08 2026 rev:66 rq:1369298 version:10.2+git20260731.2d86941
Changes:
--------
---
/work/SRC/openSUSE:Factory/pesign-obs-integration/pesign-obs-integration.changes
2026-05-08 16:42:01.948856512 +0200
+++
/work/SRC/openSUSE:Factory/.pesign-obs-integration.new.16738/pesign-obs-integration.changes
2026-08-04 21:30:19.191561774 +0200
@@ -1,0 +2,7 @@
+Fri Jul 31 08:03:46 UTC 2026 - [email protected]
+
+- Update to version 10.2+git20260731.2d86941:
+ * README: Add document for signing a EFI_SIGNATURE_LIST as a auth file on OBS
+ * pesign-repackage.spec.in: Attache timestamp to auth file
+
+-------------------------------------------------------------------
Old:
----
pesign-obs-integration-10.2+git20260506.67eda76.obscpio
New:
----
pesign-obs-integration-10.2+git20260731.2d86941.obscpio
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ pesign-obs-integration.spec ++++++
--- /var/tmp/diff_new_pack.fA0Js7/_old 2026-08-04 21:30:20.203596887 +0200
+++ /var/tmp/diff_new_pack.fA0Js7/_new 2026-08-04 21:30:20.207597025 +0200
@@ -1,7 +1,7 @@
#
# spec file for package pesign-obs-integration
#
-# Copyright (c) 2026 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -22,7 +22,7 @@
%endif
Name: pesign-obs-integration
-Version: 10.2+git20260506.67eda76
+Version: 10.2+git20260731.2d86941
Release: 0
Summary: Macros and scripts to sign the kernel and bootloader
License: GPL-2.0-or-later
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.fA0Js7/_old 2026-08-04 21:30:20.283599662 +0200
+++ /var/tmp/diff_new_pack.fA0Js7/_new 2026-08-04 21:30:20.291599940 +0200
@@ -1,6 +1,6 @@
<servicedata>
<service name="tar_scm">
<param
name="url">https://github.com/openSUSE/pesign-obs-integration.git</param>
- <param
name="changesrevision">626534cdcd41806bee2fa31c551b9221ea983df0</param></service></servicedata>
+ <param
name="changesrevision">2d86941ad1a5d530fc53a689c3c8cc20b117a481</param></service></servicedata>
(No newline at EOF)
++++++ pesign-obs-integration-10.2+git20260506.67eda76.obscpio ->
pesign-obs-integration-10.2+git20260731.2d86941.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/pesign-obs-integration-10.2+git20260506.67eda76/README.md
new/pesign-obs-integration-10.2+git20260731.2d86941/README.md
--- old/pesign-obs-integration-10.2+git20260506.67eda76/README.md
2026-05-06 08:31:23.000000000 +0200
+++ new/pesign-obs-integration-10.2+git20260731.2d86941/README.md
2026-07-31 09:57:07.000000000 +0200
@@ -33,10 +33,13 @@
builds new RPMs with signed files. The supported file types are:
- *.ko
- - Signature appended to the module
+ - Signature appended to the module
- efi binaries
- - Signature embedded in a header. If a HMAC checksum named
- .$file.hmac exists, it is regenerated
+ - Signature embedded in a header. If a HMAC checksum named
+ .$file.hmac exists, it is regenerated
+- db, KEK and PK auth files
+ - The pkcs#7 SignedData signature embedded in the
EFI_VARIABLE_AUTHENTICATION_2
+ header of the final auth file.
Debian packages can use the dh-signobs debhelper to automate signing and
repacking. Build-depend on dh-signobs and add --with signobs to the dh line
@@ -72,3 +75,57 @@
my-find-supplements
pci_ids-%{version}
```
+## Examples
+
+### signing db, KEK and PK auth files
+
+Here is an example for signing a ESL (EFI_SIGNATURE_LIST) through open build
service. It will produce a auth file. e.g. a KEK.auth.
+
+```
+%build
+# https://github.com/microsoft/secureboot_objects/issues/157
+export TIMESTAMP="2010-03-06 19:17:21"
+
+# Generate signable binary file as the source file for signing
+# Set timestamp and EFI_VARIABLE_APPEND_WRITE attribute
+sign-efi-sig-list -t "$TIMESTAMP" -a -o KEK
MicrosoftAndThirdParty/Firmware/KEK.bin KEK.auth
+
+%install
+export BRP_PESIGN_FILES='%{_sysconfdir}/uefi/certs/KEK.auth'
+```
+
+In the above case, the KEK.bin is ESL file a which is from Microsoft's
secureboot object repo:
+```
+URL: https://github.com/microsoft/secureboot_objects/releases
+# x64, sha256:624c8629f4aab631064fde7d098ad60204288267b6e6edaab50a852ba7dd382b
+Source0:
https://github.com/microsoft/secureboot_objects/releases/download/v%{version}/edk2-x64-secureboot-binaries.tar.gz
+# aarch64,
sha256:bf5a51e79815698013b9a062d489235cd042d0b1f9370a0a7c27a05367c95ed3
+Source1:
https://github.com/microsoft/secureboot_objects/releases/download/v%{version}/edk2-aarch64-secureboot-binaries.tar.gz
+```
+
+The first 'sign-efi-sig-list -o' command will produce a signable binary file
as the source file for signing to signing server:
+```
+man sign-efi-sig-list
+ -o Do not sign, but output a file of the exact bundle to be signed
+```
+Please note that the timestamp is a fixed '2010-03-06 19:17:21' value. The
reason for Microsoft using it is in the issue#157 of Microsoft's
secureboot_objects repo as the above URL.
+
+The format of signable binary file (intput source):
+```
+KEK.signable.bin
+[ Variable Name ][ Vendor GUID ][ Attributes ][ EFI_TIME ][
Payload (ESL) ]
+|<-- N bytes -->||<-- 16 bytes -->||<-- 4 bytes -->||<-- 16 bytes -->||<-- N
bytes -->|
+ |<------------------- Fixed 36 bytes -------------->|
+```
+We named the KEK.signable.bin as KEK.auth in our example because
pesign-repackage.spec.in will attach PKCS#7 SignedData signature back to the
same file. So we direct named the source file as the target file.
+
+The format of target file (output):
+```
+KEK.auth
+[ EFI_TIME ][WIN_CERTIFICATE][ CertType ][ Signature (PKCS#7
SignedData) ][ Payload (ESL) ]
+|<-- 16 bytes -->||<-- 8 bytes -->||<-- 16 bytes -->||<---------- N bytes
---------->||<----- N bytes ----->|
+|<------------- Fixed 40 bytes header ------------->||<-------------------
Variable size ------------------>|
+ |<------------------ WIN_CERTIFICATE_UEFI_GUID
------------------->|
+|<-------------------------- EFI_VARIABLE_AUTHENTICATION_2
------------------------->|
+```
+For more detail, please check the latest UEFI spec.
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/pesign-obs-integration-10.2+git20260506.67eda76/pesign-repackage.spec.in
new/pesign-obs-integration-10.2+git20260731.2d86941/pesign-repackage.spec.in
---
old/pesign-obs-integration-10.2+git20260506.67eda76/pesign-repackage.spec.in
2026-05-06 08:31:23.000000000 +0200
+++
new/pesign-obs-integration-10.2+git20260731.2d86941/pesign-repackage.spec.in
2026-07-31 09:57:07.000000000 +0200
@@ -205,12 +205,27 @@
/usr/lib/rpm/pesign/kernel-sign-file -i pkcs7 -s "$sig" sha256
"$cert" "$f"
;;
*.auth.sig)
+ # The f file is a signable binary format which is the source
file for signing
+ # a ESL (EFI_SIGNATURE_LIST). e.g. KEK.signable.bin
+ # [ Variable Name ][ Vendor GUID ][ Attributes ][
EFI_TIME ][ Payload (ESL) ]
+ # |<-- N bytes -->||<-- 16 bytes -->||<-- 4 bytes -->||<-- 16
bytes -->||<-- N bytes -->|
/usr/lib/rpm/pesign/kernel-sign-file -N -P -d -C "$cert" -i
pkcs7 -s "$sig" sha256 "$cert" "$f"
fbase="${f##*/}"
fbase="${fbase%.auth}"
fbase="${fbase%%-*}"
+ # Extract the timestamp from the signable binary file. It will
be attached to auth file
+ EFI_TIMESTAMP=$(perl -0777 -ne '
+ my $l =
/^(\x4b\x00\x45\x00\x4b\x00|\x64\x00\x62\x00\x78\x00)/ ? 6 : 4;
+ printf "%04d-%02d-%02d %02d:%02d:%02d\n", unpack("v C C C C
C", substr($_, $l + 20, 16));
+ ' "$f")
+ echo "Extracted Timestamp: ${EFI_TIMESTAMP}"
+ # Extract the EFI_SIGNATURE_LIST from the f signable binary file
perl -0777 -npe 's/\A(?:[\040-\176]\0)+.{18}\0\0.{14}\0\0//s' <
"$f" > "$f.orig"
- sign-efi-sig-list -i "$f.p7sd" "$fbase" "$f.orig" "$f.tmp"
+ # Attaching timestamp and signature (PKCS#7 SignedData) to
EFI_VARIABLE_AUTHENTICATION_2
+ # as the header of the signed auth file. e.g. KEK.auth
+ # [ EFI_TIME ][WIN_CERTIFICATE][ CertType ][
Signature (PKCS#7 SignedData) ][ Payload (ESL) ]
+ # |<-- 16 bytes -->||<-- 8 bytes -->||<-- 16 bytes
-->||<---------- N bytes ---------->||<----- N bytes ----->|
+ sign-efi-sig-list -t "${EFI_TIMESTAMP}" -i "$f.p7sd" "$fbase"
"$f.orig" "$f.tmp"
mv "$f.tmp" "$f"
rm -f "$f.p7s" "$f.p7sd" "$f.orig"
;;
++++++ pesign-obs-integration.obsinfo ++++++
--- /var/tmp/diff_new_pack.fA0Js7/_old 2026-08-04 21:30:20.555609100 +0200
+++ /var/tmp/diff_new_pack.fA0Js7/_new 2026-08-04 21:30:20.563609377 +0200
@@ -1,5 +1,5 @@
name: pesign-obs-integration
-version: 10.2+git20260506.67eda76
-mtime: 1778049083
-commit: 67eda7615f9903cca356e00ea92bd533f7eb8833
+version: 10.2+git20260731.2d86941
+mtime: 1785484627
+commit: 2d86941ad1a5d530fc53a689c3c8cc20b117a481
