From: Emanuele Giuseppe Esposito <[email protected]> redhat: add downstream SBAT for UKI addons
Even though UKI addons are not binaries, it is always better to have a SBAT version that tracks the downstream build, just in case we figure there are bugs in the kernel command line. Signed-off-by: Emanuele Giuseppe Esposito <[email protected]> diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template index blahblah..blahblah 100644 --- a/redhat/kernel.spec.template +++ b/redhat/kernel.spec.template @@ -2732,6 +2732,12 @@ BuildKernel() { EOF ) + ADDONS_SBAT=$(cat <<- EOF + sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md + kernel-uki-virt-addons.$SBATsuffix,1,Red Hat,kernel-uki-virt-addons,$KernelVer,mailto:[email protected] + EOF + ) + KernelUnifiedImageDir="$RPM_BUILD_ROOT/lib/modules/$KernelVer" KernelUnifiedImage="$KernelUnifiedImageDir/$InstallName-virt.efi" @@ -2753,7 +2759,7 @@ BuildKernel() { KernelAddonsDirOut="$KernelUnifiedImage.extra.d" mkdir -p $KernelAddonsDirOut - python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu} + python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu} "$ADDONS_SBAT" %if %{signkernel} %{log_msg "Sign the EFI UKI kernel"} -- https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3875 -- _______________________________________________ kernel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
