Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package shim for openSUSE:Factory checked in at 2026-09-15 17:09:24 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/shim (Old) and /work/SRC/openSUSE:Factory/.shim.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "shim" Tue Sep 15 17:09:24 2026 rev:140 rq:1377824 version:16.1 Changes: -------- --- /work/SRC/openSUSE:Factory/shim/shim.changes 2026-09-08 16:53:02.531259058 +0200 +++ /work/SRC/openSUSE:Factory/.shim.new.383539/shim.changes 2026-09-15 17:10:00.176312176 +0200 @@ -1,0 +2,14 @@ +Fri Sep 11 01:35:16 UTC 2026 - Joey Lee <[email protected]> + +- Add more comment in shim.spec for + 99bbbdf6fd3e shim-leap.spec: Always put openSUSE Secure Boot CA + to target array (bsc#1254679) +- Moved the following shim-install patches from + https://github.com/SUSE/shim-resources.git + - 6e49d8d8bd63 Use efi_hints to optimize target probing + - 8805129321f5 Restrict root device discovery to unlocked cryptodisks + - 5ce8f5a14979 Add TPM2 PCR cap if grub2 supports + - 0da391abf9ec Add GRUB_CRYPTO_HWACCEL to enable hardware acceleration + - c09d3485e9d2 Fix the path to grub2 command.lst + +------------------------------------------------------------------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ shim.spec ++++++ --- /var/tmp/diff_new_pack.Uxlvcg/_old 2026-09-15 17:10:02.932427523 +0200 +++ /var/tmp/diff_new_pack.Uxlvcg/_new 2026-09-15 17:10:02.934427606 +0200 @@ -417,6 +417,10 @@ -- Certificate #2, Microsoft UEFI CA 2023 "%{microsoft_ca_2023_hex}", %if "%{prjissuer_hash}" == "%{opensusesubject_hash}" + -- Repacking project of shim (e.g. shim-leap or non-SLE15-SP3 shim) + -- always put openSUSE or SLE Secure Boot CA to target db cert array + -- because repacking project does not have needssslcertforbuild + -- 99bbbdf6fd3e shim-leap.spec: Always put openSUSE Secure Boot CA to target array (bsc1254679) -- Certificate #3, openSUSE Secure Boot CA 2013 "%{opensuse_ca_hex}", %endif ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.Uxlvcg/_old 2026-09-15 17:10:03.209439116 +0200 +++ /var/tmp/diff_new_pack.Uxlvcg/_new 2026-09-15 17:10:03.215439367 +0200 @@ -1,6 +1,7 @@ -mtime: 1785818081 -commit: 661ad2944d2a9cf78011f27ba7f04b8be07a6a75253fec440cc884c42fc242ff +mtime: 1789094115 +commit: 8efb90950cb408e918c447ee8f5485f274ab3bf7c8ecdfa2988f9b5ca915f58c url: https://src.opensuse.org/devel-factory/shim -revision: 661ad2944d2a9cf78011f27ba7f04b8be07a6a75253fec440cc884c42fc242ff +revision: 8efb90950cb408e918c447ee8f5485f274ab3bf7c8ecdfa2988f9b5ca915f58c +trackingbranch: main projectscmsync: https://src.opensuse.org/devel-factory/_ObsPrj.git ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-09-11 04:35:15.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ shim-install ++++++ --- /var/tmp/diff_new_pack.Uxlvcg/_old 2026-09-15 17:10:04.305484987 +0200 +++ /var/tmp/diff_new_pack.Uxlvcg/_new 2026-09-15 17:10:04.313485321 +0200 @@ -444,18 +444,26 @@ prepare_cryptodisk () { uuid="$1" + local cryptomount_base="cryptomount -u $uuid" + if [ "x$GRUB_CRYPTO_HWACCEL" = "xtrue" ]; then + echo "if [ x\$feature_gcry_hw_accel = xy ]; then" + echo " set cryptomount_hw_accel_args=-A" + echo "fi" + cryptomount_base="$cryptomount_base \$cryptomount_hw_accel_args" + fi if [ "x$GRUB_CRYPTODISK_PASSWORD" != x ]; then - echo "cryptomount -u $uuid -p \"$GRUB_CRYPTODISK_PASSWORD\"" + echo "$cryptomount_base -p \"$GRUB_CRYPTODISK_PASSWORD\"" return fi if [ "x$GRUB_TPM2_SEALED_KEY" = x ]; then - echo "cryptomount -u $uuid" + echo "$cryptomount_base" return fi tpm_sealed_key="${GRUB_TPM2_SEALED_KEY}" + tpm_cap_pcr="${GRUB_TPM2_CAP_PCR:-9}" declare -g TPM_PCR_SNAPSHOT_TAKEN @@ -464,7 +472,7 @@ # Check if tpm_record_pcrs is available and set the command to # grub.cfg. - if grep -q "tpm_record_pcrs" ${datadir}/grub2/${arch}-efi/command.lst ; then + if grep -q "tpm_record_pcrs" ${datadir}/grub2/${grub_install_target}/command.lst ; then echo "tpm_record_pcrs 0-9" fi fi @@ -476,9 +484,13 @@ fi cat <<EOF -tpm2_key_protector_init -a $tpm_srk_alg -T \$prefix/$tpm_sealed_key -if ! cryptomount -u $uuid --protector tpm2; then - cryptomount -u $uuid +if [ x\$feature_tpm2_cap_pcrs = xy ]; then + tpm2_key_protector_init -a $tpm_srk_alg -T \$prefix/$tpm_sealed_key -c $tpm_cap_pcr +else + tpm2_key_protector_init -a $tpm_srk_alg -T \$prefix/$tpm_sealed_key +fi +if ! $cryptomount_base --protector tpm2; then + $cryptomount_base fi EOF } @@ -507,19 +519,40 @@ if [ x$GRUB_ENABLE_CRYPTODISK = xy ]; then for uuid in `"${grub_probe}" --target=cryptodisk_uuid --device-map= "${grub_cfg_dirname}"`; do prepare_cryptodisk "$uuid" + IS_CRYPTO_ROOT=y done fi -hints="`"${grub_probe}" --target=hints_string "${grub_cfg_dirname}" 2> /dev/null`" +for hint in `"${grub_probe}" --target=efi_hints "${grub_cfg_dirname}" 2> /dev/null`; do + hints="${hints:+$hints }--hint='$hint'" +done if [ "x$hints" != x ]; then - echo "if [ x\$feature_platform_search_hint = xy ]; then" - echo " search --no-floppy --fs-uuid --set=root ${hints} ${cfg_fs_uuid}" - echo "else" - echo " search --no-floppy --fs-uuid --set=root ${cfg_fs_uuid}" - echo "fi" + if [ "x$IS_CRYPTO_ROOT" = xy ]; then + echo "if [ x\$feature_search_cryptodisk_only = xy ]; then" + echo " search --no-floppy --cryptodisk-only --fs-uuid --set=root ${hints} ${cfg_fs_uuid}" + echo "elif [ x\$feature_platform_search_hint = xy ]; then" + echo " search --no-floppy --fs-uuid --set=root ${hints} ${cfg_fs_uuid}" + echo "else" + echo " search --no-floppy --fs-uuid --set=root ${cfg_fs_uuid}" + echo "fi" + else + echo "if [ x\$feature_platform_search_hint = xy ]; then" + echo " search --no-floppy --fs-uuid --set=root ${hints} ${cfg_fs_uuid}" + echo "else" + echo " search --no-floppy --fs-uuid --set=root ${cfg_fs_uuid}" + echo "fi" + fi else - echo "search --no-floppy --fs-uuid --set=root ${cfg_fs_uuid}" + if [ "x$IS_CRYPTO_ROOT" = xy ]; then + echo "if [ x\$feature_search_cryptodisk_only = xy ]; then" + echo "search --no-floppy --cryptodisk-only --fs-uuid --set=root ${cfg_fs_uuid}" + echo "else" + echo "search --no-floppy --fs-uuid --set=root ${cfg_fs_uuid}" + echo "fi" + else + echo "search --no-floppy --fs-uuid --set=root ${cfg_fs_uuid}" + fi fi cat <<EOF
