From: Emanuele Giuseppe Esposito <eesposit@xxxxxxxxxx>
redhat: add downstream SBAT for UKI addons
Even though UKI addons are not binaries, it is always better to have a
SBAT version that tracks the downstream build, just in case we figure
there are bugs in the kernel command line.
Signed-off-by: Emanuele Giuseppe Esposito <eesposit@xxxxxxxxxx>
diff --git a/redhat/kernel.spec.template b/redhat/kernel.spec.template
index blahblah..blahblah 100644
--- a/redhat/kernel.spec.template
+++ b/redhat/kernel.spec.template
@@ -2732,6 +2732,12 @@ BuildKernel() {
EOF
)
+ ADDONS_SBAT=$(cat <<- EOF
+ sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
+ kernel-uki-virt-addons.$SBATsuffix,1,Red Hat,kernel-uki-virt-addons,$KernelVer,mailto:secalert@xxxxxxxxxx
+ EOF
+ )
+
KernelUnifiedImageDir="$RPM_BUILD_ROOT/lib/modules/$KernelVer"
KernelUnifiedImage="$KernelUnifiedImageDir/$InstallName-virt.efi"
@@ -2753,7 +2759,7 @@ BuildKernel() {
KernelAddonsDirOut="$KernelUnifiedImage.extra.d"
mkdir -p $KernelAddonsDirOut
- python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu}
+ python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu} "$ADDONS_SBAT"
%if %{signkernel}
%{log_msg "Sign the EFI UKI kernel"}
--
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3875
--
_______________________________________________
kernel mailing list -- kernel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to kernel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/kernel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
