debian/changelog

   1 shim (15.4-1) unstable; urgency=medium
   2
   3   * New upstream release fixing more bugs: SBAT and arm64 support.
   4   * Print sha256 checksums of the EFI binaries when the build is done,
   5     for easier comparison between builds.
   6   * Override dh_auto_build setting INSTALL, cut down on build noise.
   7
   8  -- Steve McIntyre <93sam@debian.org>  Wed, 31 Mar 2021 18:25:00 +0100
   9
  10 shim (15.3-3) unstable; urgency=medium
  11
  12   * Update the timestamp for the 15.3-2 upload.
  13   * Only include the upstream version in the Debian SBAT metadata, so
  14     we don't break reproducibility on every minor packaging change.
  15
  16  -- Steve McIntyre <93sam@debian.org>  Wed, 24 Mar 2021 13:21:05 +0000
  17
  18 shim (15.3-2) unstable; urgency=medium
  19
  20   * Add missing build-dep on xxd for build-time unit tests
  21
  22  -- Steve McIntyre <93sam@debian.org>  Wed, 24 Mar 2021 02:21:53 +0000
  23
  24 shim (15.3-1) unstable; urgency=medium
  25
  26   [ Steve McIntyre ]
  27   * Switch to much-newer release with many fixes
  28     + Particularly pulling in SBAT changes for better revocation support
  29     + Remove all our old patches, no longer needed:
  30       - avoid_null_vsprint.patch
  31       - check_null_sn_ln.patch
  32       - fixup_git.patch
  33       - uname.patch
  34       - use_compare_mem_gcc9.patch
  35     + Now includes a vendor copy of gnu-efi with quite a few extra
  36       fixes needed.
  37     + Update copyright file to cover these changes
  38   * Switch to using gcc-10 rather than gcc-9. Closes: #978521
  39   * Add dbx entries for all our existing grub binaries
  40     + They're insecure, let's break the chainloading hole.
  41   * Add Debian SBAT data
  42     + Add a Debian SBAT template, and rules to use it
  43     + Adds a build-dep on dos2unix
  44
  45  -- Steve McIntyre <93sam@debian.org>  Tue, 23 Mar 2021 23:39:48 +0000
  46
  47 shim (15+1533136590.3beb971-10) unstable; urgency=medium
  48
  49   [ Debian Janitor ]
  50   * Trim trailing whitespace.
  51   * Use secure copyright file specification URI.
  52   * debian/copyright: use spaces rather than tabs to start continuation
  53     lines.
  54   * Bump debhelper from old 11 to 12.
  55   * Set debhelper-compat version in Build-Depends.
  56   * Set upstream metadata fields: Bug-Database, Bug-Submit.
  57   * Update standards version to 4.4.1, no changes needed.
  58
  59   [ Steve McIntyre ]
  60   * Trivial changes to generating the inbuilt dbx if we're using it.
  61   * Upload to pick up rotated Debian signing keys
  62
  63  -- Steve McIntyre <93sam@debian.org>  Fri, 24 Jul 2020 01:22:46 +0100
  64
  65 shim (15+1533136590.3beb971-9) unstable; urgency=medium
  66
  67   [ Steve McIntyre ]
  68   * In the -helpers-ARCH-signed packages, change the version
  69     dependency on shim-unsigned to be >= and not =. This will allow
  70     for installation to still work in the window while we wait for the
  71     template package to do its second trip through the
  72     archive. Closes: #955356
  73
  74  -- Steve McIntyre <93sam@debian.org>  Mon, 30 Mar 2020 15:19:08 +0100
  75
  76 shim (15+1533136590.3beb971-8) unstable; urgency=medium
  77
  78   [ Steve McIntyre ]
  79   * Use --padding when calling pesign to generate hashes for the dbx
  80     list, as recommended by Peter Jones. No actual changes needed in
  81     our list of hashes at this point - they work out the same either
  82     way.
  83   * Switch to using gcc-9 for builds, tweaking a patch from upstream
  84     to fix a FTBFS. Closes: #925816
  85   * Update debhelper compat level to 11 for shim and the
  86     signing-template
  87
  88  -- Steve McIntyre <93sam@debian.org>  Tue, 24 Mar 2020 16:51:10 +0000
  89
  90 shim (15+1533136590.3beb971-7) unstable; urgency=medium
  91
  92   [ Ansgar Burchardt ]
  93   * debian/control: Update Vcs-* fields
  94
  95   [ Steve McIntyre ]
  96   * Backport needed crash fixes:
  97     + VLogError(): Avoid NULL pointer dereferences in (V)Sprint calls
  98     + Fix OBJ_create() to tolerate a NULL sn and ln
  99   * Build using gcc-7 to get better control of reproducibility during the
 100     lifetime of Buster.
 101   * Build in a dbx list to blacklist binaries that we know to not be
 102     secure. Build-depend on a new (bug-fixed) version of pesign to
 103     generate that list at build time, using a list of known bad hashes.
 104   * Initial list of known bad hashes is just my personal test binary.
 105
 106  -- Steve McIntyre <93sam@debian.org>  Wed, 08 May 2019 02:05:01 +0100
 107
 108 shim (15+1533136590.3beb971-6) unstable; urgency=medium
 109
 110   [ Steve McIntyre ]
 111   * Add Provides: and Breaks: to shim-helpers-$arch-signed to fix
 112     clashes with the old shim-signed package for fbx64.efi.signed and
 113     mmx64.efi.signed. Closes: #924619
 114
 115   [ Helmut Grohne ]
 116   * Fix FTCBFS: Set CROSS_COMPILE. (Closes: #922152)
 117
 118  -- Steve McIntyre <93sam@debian.org>  Sat, 23 Mar 2019 18:19:13 +0000
 119
 120 shim (15+1533136590.3beb971-5) unstable; urgency=medium
 121
 122   [ Ansgar Burchardt ]
 123   * Correct maintainer address in signing template
 124
 125   [ Steve McIntyre ]
 126   * Remove Rules-Requires-Root in the signing template. We manually install
 127     things owned by root. There might be better ways to do this, but this
 128     will do for now.
 129
 130  -- Steve McIntyre <93sam@debian.org>  Tue, 12 Mar 2019 01:38:19 +0000
 131
 132 shim (15+1533136590.3beb971-4) unstable; urgency=medium
 133
 134   [ Steve McIntyre ]
 135   * No-change sourceful upload to get rebuilds (and hence build logs) from
 136     the buildds. Hoping to get this version signed by Microsoft, so let's
 137     make our setup as clean as possible.
 138
 139  -- Steve McIntyre <93sam@debian.org>  Sat, 09 Mar 2019 22:24:23 +0000
 140
 141 shim (15+1533136590.3beb971-3) unstable; urgency=medium
 142
 143   [ Philipp Hahn ]
 144   * debian/rules: fixing permissions no longer required
 145   * debian/rules: Disable ephemeral key on Debian.
 146   * Rename binary package to 'shim-unsigned'
 147   * Add template for signing {mm,fb}$ARCH.efi. (Closes: #922228)
 148
 149   [ Luca Boccassi ]
 150   * Override lintian error about template rules file.
 151   * Include /usr/share/dpkg/architecture.mk instead of shelling out.
 152   * Add uname.patch to avoid embedding the kernel architecture in the
 153     binary and to use a fixed string instead.
 154
 155   [ Steve McIntyre ]
 156   * Change maintenance address to be the EFI team
 157   * Add me and vorlon to the Uploaders list
 158   * Rename the helper binary packages to shim-helpers-$arch.
 159   * Update the signing-template JSON metadata to match new practice:
 160     + Move all the data under a new top-level "packages" key
 161     + Add an empty "trusted_certs" key - the helper binaries do not do any
 162       further verification with an embedded key.
 163
 164  -- Steve McIntyre <93sam@debian.org>  Fri, 08 Mar 2019 21:59:43 +0000
 165
 166 shim (15+1533136590.3beb971-2) unstable; urgency=medium
 167
 168   * Update debian/watch.
 169   * Update VCS to point to salsa.
 170   * Fix debian/rules syntax for arm64 build.
 171   * Enable build for i386.
 172   * Ensure DEB_HOST_ARCH is set even if not present in the environment.
 173   * Update Standards-Version.
 174   * Update debian/copyright (drop reference to file no longer in source)
 175
 176  -- Steve Langasek <vorlon@debian.org>  Mon, 11 Feb 2019 05:18:18 +0000
 177
 178 shim (15+1533136590.3beb971-1) unstable; urgency=medium
 179
 180   * New upstream release.
 181     - debian/patches/second-stage-path: dropped; the default loader path now
 182       includes an arch suffix.
 183     - debian/patches/sbsigntool-no-pesign: dropped; no longer needed.
 184   * Drop remaining patches that were not being applied.
 185   * Sync packaging from Ubuntu:
 186     - debian/copyright: Update upstream source location.
 187     - debian/control: add a Build-Depends on libelf-dev.
 188     - Enable arm64 build.
 189     - debian/patches/fixup_git.patch: don't run git in clean; we're not
 190       really in a git tree.
 191     - debian/rules, debian/shim.install: use the upstream install target as
 192       intended, and move files to the target directory using dh_install.
 193     - define RELEASE and COMMIT_ID for the snapshot.
 194     - Set ENABLE_HTTPBOOT to enable the HTTP Boot feature.
 195     - Update dh_auto_build/dh_auto_clean/dh_auto_install for new upstream
 196       options: set MAKELEVEL.
 197     - Define an EFI_ARCH variable, and use that for paths to shim. This
 198       makes it possible to build a shim for other architectures than amd64.
 199     - Set EFIDIR=$distro for dh_auto_install; that will let files be installed
 200       in the "right" final directories, and makes boot.csv for us.
 201     - Set ENABLE_SHIM_CERT, to keep using ephemeral self-signed certs built
 202       at compile-time for MokManager and fallback.
 203     - Set ENABLE_SBSIGN, to use sbsign instead of pesign for signing fallback
 204       and MokManager.
 205
 206  -- Steve Langasek <vorlon@debian.org>  Sat, 09 Feb 2019 07:23:19 +0000
 207
 208 shim (0.9+1474479173.6c180c6-1) unstable; urgency=medium
 209
 210   [ Steve Langasek ]
 211   * Initial Debian upload.  Closes: #820052.
 212   * Update Standards-Version.
 213   * Embed the newly-minted Debian CA certificate.
 214   * Vendorize debian/rules so that the same package can be used in both
 215     Debian and Ubuntu without modification.
 216   * Fix debian/copyright to match the spec (last match wins, not first)
 217   * Fix shim.efi to not be executable.
 218   * Add watchfile.
 219   * Support parallel builds, because eh why not
 220   * Update Vcs-Bzr.
 221   * Resync with Ubuntu, including patch to fix debian/copyright.
 222
 223   [ Julien Cristau ]
 224   * Add some missing copyright holders in d/copyright, update
 225     Upstream-Contact.  Thanks to Helen Koike for the help.
 226
 227  -- Julien Cristau <jcristau@debian.org>  Sat, 15 Oct 2016 15:17:34 +0200
 228
 229 shim (0.9+1474479173.6c180c6-0ubuntu1) UNRELEASED; urgency=medium
 230
 231   [ Helen Koike ]
 232   * debian/copyright: add OpenSSL license
 233
 234   [ Mathieu Trudel-Lapierre ]
 235   * New upstream release.
 236   * debian/copyright: patches should be BSD, like the rest of the upstream
 237     code.
 238   * debian/patches/unused-variable: dropped; applied upstream.
 239   * debian/patches/binutils-version-matching: dropped, fixed upstream.
 240   * debian/shim.install: built EFI binaries were renamed; update our install
 241     file to properly pick up shim (shim$arch), MokManager (mm$arch), and
 242     fallback (fb$arch).
 243
 244  -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Wed, 21 Sep 2016 20:29:44 -0400
 245
 246 shim (0.9+1465500757.14a5905-0ubuntu1) yakkety; urgency=medium
 247
 248   * New upstream release.
 249     - Better handle LoadOptions. (LP: #1581299)
 250     - Measure state and second stage in TPM.
 251     - Mirror MokSBState in runtime as MokSBStateRT.
 252     - Fix failure to build with GCC 5. (LP: #1429978)
 253     - Various bug fixes and other improvements.
 254   * Refreshed patches.
 255     - Remaining patches:
 256       + second-stage-path
 257       + sbsigntool-not-pesign
 258   * debian/patches/unused-variable: remove unused variable size.
 259   * debian/patches/binutils-version-matching: revert d9a4c912 to correctly
 260     match objcopy's version on Ubuntu.
 261   * debian/copyright: update copyright for patches.
 262
 263  -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Tue, 26 Jul 2016 16:48:32 -0400
 264
 265 shim (0.8-0ubuntu2) wily; urgency=medium
 266
 267   * No-change rebuild against gnu-efi 3.0v-5ubuntu1.
 268
 269  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 12 May 2015 17:48:30 +0000
 270
 271 shim (0.8-0ubuntu1) wily; urgency=medium
 272
 273   * New upstream release.
 274     - Clarify meaning of insecure_mode. (LP: #1384973)
 275   * debian/patches/CVE-2014-3675.patch, debian/patches/CVE-2014-3677.patch,
 276     debian/patches/0001-Update-openssl-to-0.9.8za.patch: dropped, included
 277     in the upstream release.
 278   * debian/patches/sbsigntool-not-pesign,debian/patches/second-stage-path:
 279     refreshed.
 280
 281  -- Mathieu Trudel-Lapierre <mathieu-tl@ubuntu.com>  Mon, 11 May 2015 19:50:49 -0400
 282
 283 shim (0.7-0ubuntu4) utopic; urgency=medium
 284
 285   * SECURITY UPDATE: heap overflow and out-of-bounds read access when
 286     parsing DHCPv6 information
 287     - debian/patches/CVE-2014-3675.patch: apply proper bounds checking
 288       when parsing data provided in DHCPv6 packets.
 289     - CVE-2014-3675
 290     - CVE-2014-3676
 291   * SECURITY UPDATE: memory corruption when processing user-provided key
 292     lists
 293     - debian/patches/CVE-2014-3677.patch: detect malformed machine owner
 294       key (MOK) lists and ignore them, avoiding possible memory corruption.
 295     - CVE-2014-3677
 296
 297  -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 08 Oct 2014 06:40:40 +0000
 298
 299 shim (0.7-0ubuntu2) utopic; urgency=medium
 300
 301   * Restore debian/patches/prototypes, which still is needed on shim 0.7
 302     but only detected on the buildds.
 303   * Update debian/patches/prototypes with some new declarations needed for
 304     openssl 0.9.8za update.
 305
 306  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 07 Oct 2014 16:20:08 -0700
 307
 308 shim (0.7-0ubuntu1) utopic; urgency=medium
 309
 310   * New upstream release.
 311     - fix spurious error message when fallback.efi is not present, as will
 312       always be the case for removable media.  LP: #1297069.
 313     - drop most patches, included upstream.
 314   * debian/patches/0001-Update-openssl-to-0.9.8za.patch: cherry-pick
 315     openssl 0.9.8za in via upstream.
 316
 317  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 07 Oct 2014 05:40:41 +0000
 318
 319 shim (0.4-0ubuntu5) utopic; urgency=low
 320
 321   * Install fallback.efi.signed as well, to lay the groundwork for fallback
 322     handling (wanted when we have to move a drive between machines, or when
 323     the firmware loses its marbles^W nvram).
 324
 325  -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Aug 2014 12:11:13 +0200
 326
 327 shim (0.4-0ubuntu4) saucy; urgency=low
 328
 329   * debian/patches/fix-tftp-prototype: pass the right arguments to
 330     EFI_PXE_BASE_CODE_TFTP_READ_FILE.
 331   * debian/patches/build-with-Werror: Build with -Werror to catch future
 332     prototype mismatches.
 333   * debian/patches/fix-compiler-warnings: Fix remaining compiler
 334     warnings in netboot.c.
 335   * debian/patches/tftp-proper-nul-termination: fix nul termination
 336     errors in filenames passed to tftp.
 337   * debian/patches/netboot-cleanup: roll-up of miscellaneous fixes to
 338     the netboot code.
 339
 340  -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 23 Sep 2013 00:30:00 -0700
 341
 342 shim (0.4-0ubuntu3) saucy; urgency=low
 343
 344   [ Steve Langasek ]
 345   * Install MokManager.efi.signed in the package.
 346   * debian/patches/no-output-by-default.patch: Don't print any
 347     informational messages.  Closes LP: #1074302.
 348
 349   [ Stéphane Graber ]
 350   * debian/patches/no-print-on-unsigned: Don't print an error message when
 351     validating an unsigned binary as that tends to hang Lenovo machines.
 352     (LP: #1087501)
 353
 354  -- Stéphane Graber <stgraber@ubuntu.com>  Thu, 08 Aug 2013 17:12:12 +0200
 355
 356 shim (0.4-0ubuntu2) saucy; urgency=low
 357
 358   * Add missing build-dependency on openssl.
 359
 360  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 02 Jul 2013 20:30:43 +0000
 361
 362 shim (0.4-0ubuntu1) saucy; urgency=low
 363
 364   * New upstream release.
 365   * Drop debian/patches/shim-before-loadimage; upstream has changed this to
 366     not call loadimage at all.
 367   * debian/patches/sbsigntool-not-pesign: Sign MokManager with
 368     sbsigntool instead of pesign.
 369   * Add a versioned build-dependency on gnu-efi.
 370
 371  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 02 Jul 2013 12:53:24 -0700
 372
 373 shim (0~20120906.bcd0a4e8-0ubuntu4) quantal-proposed; urgency=low
 374
 375   * debian/patches/shim-before-loadimage: Use direct verification first
 376     before LoadImage.  Addresses an issue where Lenovo's SecureBoot
 377     implementation pops an error message on any verification failure - avoid
 378     calling LoadImage at all unless we have to.
 379
 380  -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 10 Oct 2012 15:28:40 -0700
 381
 382 shim (0~20120906.bcd0a4e8-0ubuntu3) quantal; urgency=low
 383
 384   * debian/patches/second-stage-path: Chainload grubx64.efi, not
 385     grub.efi.
 386
 387  -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 05 Oct 2012 11:20:58 -0700
 388
 389 shim (0~20120906.bcd0a4e8-0ubuntu2) quantal; urgency=low
 390
 391   * debian/patches/prototypes: Include missing prototypes, and disable
 392     use of BIO_new_file.
 393   * Only build the package for amd64; we're not signing an i386 shim at this
 394     stage so there's no point in building it.
 395
 396  -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 04 Oct 2012 17:47:04 +0000
 397
 398 shim (0~20120906.bcd0a4e8-0ubuntu1) quantal; urgency=low
 399
 400   * Initial release.
 401   * Include the Canonical Secure Boot master CA.
 402
 403  -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 04 Oct 2012 00:01:06 -0700