debian/changelog

   1 shim (15.4-2) unstable; urgency=medium
   2
   3   * Add two further patches from upstream:
   4     + fix import_one_mok_state() after split
   5     + Don't call QueryVariableInfo() on EFI 1.10 machines (e.g. older
   6       Intel Mac machines)
   7
   8  -- Steve McIntyre <93sam@debian.org>  Wed, 21 Apr 2021 00:23:02 +0100
   9
  10 shim (15.4-1) unstable; urgency=medium
  11
  12   * New upstream release fixing more bugs: SBAT and arm64 support
  13   * Print sha256 checksums of the EFI binaries when the build is done
  14   * Add two patches from upstream:
  15     + fix i386 binary relocations
  16     + allocate MOK config table as BootServicesData
  17
  18  -- Steve McIntyre <93sam@debian.org>  Wed, 31 Mar 2021 18:25:00 +0100
  19
  20 shim (15.3-3) unstable; urgency=medium
  21
  22   * Update the timestamp for the 15.3-2 upload.
  23   * Only include the upstream version in the Debian SBAT metadata, so
  24     we don't break reproducibility on every minor packaging change.
  25
  26  -- Steve McIntyre <93sam@debian.org>  Wed, 24 Mar 2021 13:21:05 +0000
  27
  28 shim (15.3-2) unstable; urgency=medium
  29
  30   * Add missing build-dep on xxd for build-time unit tests
  31
  32  -- Steve McIntyre <93sam@debian.org>  Wed, 24 Mar 2021 02:21:53 +0000
  33
  34 shim (15.3-1) unstable; urgency=medium
  35
  36   [ Steve McIntyre ]
  37   * Switch to much-newer release with many fixes
  38     + Particularly pulling in SBAT changes for better revocation support
  39     + Remove all our old patches, no longer needed:
  40       - avoid_null_vsprint.patch
  41       - check_null_sn_ln.patch
  42       - fixup_git.patch
  43       - uname.patch
  44       - use_compare_mem_gcc9.patch
  45     + Now includes a vendor copy of gnu-efi with quite a few extra
  46       fixes needed.
  47     + Update copyright file to cover these changes
  48   * Switch to using gcc-10 rather than gcc-9. Closes: #978521
  49   * Add dbx entries for all our existing grub binaries
  50     + They're insecure, let's break the chainloading hole.
  51   * Add Debian SBAT data
  52     + Add a Debian SBAT template, and rules to use it
  53     + Adds a build-dep on dos2unix
  54
  55  -- Steve McIntyre <93sam@debian.org>  Tue, 23 Mar 2021 23:39:48 +0000
  56
  57 shim (15+1533136590.3beb971-10) unstable; urgency=medium
  58
  59   [ Debian Janitor ]
  60   * Trim trailing whitespace.
  61   * Use secure copyright file specification URI.
  62   * debian/copyright: use spaces rather than tabs to start continuation
  63     lines.
  64   * Bump debhelper from old 11 to 12.
  65   * Set debhelper-compat version in Build-Depends.
  66   * Set upstream metadata fields: Bug-Database, Bug-Submit.
  67   * Update standards version to 4.4.1, no changes needed.
  68
  69   [ Steve McIntyre ]
  70   * Trivial changes to generating the inbuilt dbx if we're using it.
  71   * Upload to pick up rotated Debian signing keys
  72
  73  -- Steve McIntyre <93sam@debian.org>  Fri, 24 Jul 2020 01:22:46 +0100
  74
  75 shim (15+1533136590.3beb971-9) unstable; urgency=medium
  76
  77   [ Steve McIntyre ]
  78   * In the -helpers-ARCH-signed packages, change the version
  79     dependency on shim-unsigned to be >= and not =. This will allow
  80     for installation to still work in the window while we wait for the
  81     template package to do its second trip through the
  82     archive. Closes: #955356
  83
  84  -- Steve McIntyre <93sam@debian.org>  Mon, 30 Mar 2020 15:19:08 +0100
  85
  86 shim (15+1533136590.3beb971-8) unstable; urgency=medium
  87
  88   [ Steve McIntyre ]
  89   * Use --padding when calling pesign to generate hashes for the dbx
  90     list, as recommended by Peter Jones. No actual changes needed in
  91     our list of hashes at this point - they work out the same either
  92     way.
  93   * Switch to using gcc-9 for builds, tweaking a patch from upstream
  94     to fix a FTBFS. Closes: #925816
  95   * Update debhelper compat level to 11 for shim and the
  96     signing-template
  97
  98  -- Steve McIntyre <93sam@debian.org>  Tue, 24 Mar 2020 16:51:10 +0000
  99
 100 shim (15+1533136590.3beb971-7) unstable; urgency=medium
 101
 102   [ Ansgar Burchardt ]
 103   * debian/control: Update Vcs-* fields
 104
 105   [ Steve McIntyre ]
 106   * Backport needed crash fixes:
 107     + VLogError(): Avoid NULL pointer dereferences in (V)Sprint calls
 108     + Fix OBJ_create() to tolerate a NULL sn and ln
 109   * Build using gcc-7 to get better control of reproducibility during the
 110     lifetime of Buster.
 111   * Build in a dbx list to blacklist binaries that we know to not be
 112     secure. Build-depend on a new (bug-fixed) version of pesign to
 113     generate that list at build time, using a list of known bad hashes.
 114   * Initial list of known bad hashes is just my personal test binary.
 115
 116  -- Steve McIntyre <93sam@debian.org>  Wed, 08 May 2019 02:05:01 +0100
 117
 118 shim (15+1533136590.3beb971-6) unstable; urgency=medium
 119
 120   [ Steve McIntyre ]
 121   * Add Provides: and Breaks: to shim-helpers-$arch-signed to fix
 122     clashes with the old shim-signed package for fbx64.efi.signed and
 123     mmx64.efi.signed. Closes: #924619
 124
 125   [ Helmut Grohne ]
 126   * Fix FTCBFS: Set CROSS_COMPILE. (Closes: #922152)
 127
 128  -- Steve McIntyre <93sam@debian.org>  Sat, 23 Mar 2019 18:19:13 +0000
 129
 130 shim (15+1533136590.3beb971-5) unstable; urgency=medium
 131
 132   [ Ansgar Burchardt ]
 133   * Correct maintainer address in signing template
 134
 135   [ Steve McIntyre ]
 136   * Remove Rules-Requires-Root in the signing template. We manually install
 137     things owned by root. There might be better ways to do this, but this
 138     will do for now.
 139
 140  -- Steve McIntyre <93sam@debian.org>  Tue, 12 Mar 2019 01:38:19 +0000
 141
 142 shim (15+1533136590.3beb971-4) unstable; urgency=medium
 143
 144   [ Steve McIntyre ]
 145   * No-change sourceful upload to get rebuilds (and hence build logs) from
 146     the buildds. Hoping to get this version signed by Microsoft, so let's
 147     make our setup as clean as possible.
 148
 149  -- Steve McIntyre <93sam@debian.org>  Sat, 09 Mar 2019 22:24:23 +0000
 150
 151 shim (15+1533136590.3beb971-3) unstable; urgency=medium
 152
 153   [ Philipp Hahn ]
 154   * debian/rules: fixing permissions no longer required
 155   * debian/rules: Disable ephemeral key on Debian.
 156   * Rename binary package to 'shim-unsigned'
 157   * Add template for signing {mm,fb}$ARCH.efi. (Closes: #922228)
 158
 159   [ Luca Boccassi ]
 160   * Override lintian error about template rules file.
 161   * Include /usr/share/dpkg/architecture.mk instead of shelling out.
 162   * Add uname.patch to avoid embedding the kernel architecture in the
 163     binary and to use a fixed string instead.
 164
 165   [ Steve McIntyre ]
 166   * Change maintenance address to be the EFI team
 167   * Add me and vorlon to the Uploaders list
 168   * Rename the helper binary packages to shim-helpers-$arch.
 169   * Update the signing-template JSON metadata to match new practice:
 170     + Move all the data under a new top-level "packages" key
 171     + Add an empty "trusted_certs" key - the helper binaries do not do any
 172       further verification with an embedded key.
 173
 174  -- Steve McIntyre <93sam@debian.org>  Fri, 08 Mar 2019 21:59:43 +0000
 175
 176 shim (15+1533136590.3beb971-2) unstable; urgency=medium
 177
 178   * Update debian/watch.
 179   * Update VCS to point to salsa.
 180   * Fix debian/rules syntax for arm64 build.
 181   * Enable build for i386.
 182   * Ensure DEB_HOST_ARCH is set even if not present in the environment.
 183   * Update Standards-Version.
 184   * Update debian/copyright (drop reference to file no longer in source)
 185
 186  -- Steve Langasek <vorlon@debian.org>  Mon, 11 Feb 2019 05:18:18 +0000
 187
 188 shim (15+1533136590.3beb971-1) unstable; urgency=medium
 189
 190   * New upstream release.
 191     - debian/patches/second-stage-path: dropped; the default loader path now
 192       includes an arch suffix.
 193     - debian/patches/sbsigntool-no-pesign: dropped; no longer needed.
 194   * Drop remaining patches that were not being applied.
 195   * Sync packaging from Ubuntu:
 196     - debian/copyright: Update upstream source location.
 197     - debian/control: add a Build-Depends on libelf-dev.
 198     - Enable arm64 build.
 199     - debian/patches/fixup_git.patch: don't run git in clean; we're not
 200       really in a git tree.
 201     - debian/rules, debian/shim.install: use the upstream install target as
 202       intended, and move files to the target directory using dh_install.
 203     - define RELEASE and COMMIT_ID for the snapshot.
 204     - Set ENABLE_HTTPBOOT to enable the HTTP Boot feature.
 205     - Update dh_auto_build/dh_auto_clean/dh_auto_install for new upstream
 206       options: set MAKELEVEL.
 207     - Define an EFI_ARCH variable, and use that for paths to shim. This
 208       makes it possible to build a shim for other architectures than amd64.
 209     - Set EFIDIR=$distro for dh_auto_install; that will let files be installed
 210       in the "right" final directories, and makes boot.csv for us.
 211     - Set ENABLE_SHIM_CERT, to keep using ephemeral self-signed certs built
 212       at compile-time for MokManager and fallback.
 213     - Set ENABLE_SBSIGN, to use sbsign instead of pesign for signing fallback
 214       and MokManager.
 215
 216  -- Steve Langasek <vorlon@debian.org>  Sat, 09 Feb 2019 07:23:19 +0000
 217
 218 shim (0.9+1474479173.6c180c6-1) unstable; urgency=medium
 219
 220   [ Steve Langasek ]
 221   * Initial Debian upload.  Closes: #820052.
 222   * Update Standards-Version.
 223   * Embed the newly-minted Debian CA certificate.
 224   * Vendorize debian/rules so that the same package can be used in both
 225     Debian and Ubuntu without modification.
 226   * Fix debian/copyright to match the spec (last match wins, not first)
 227   * Fix shim.efi to not be executable.
 228   * Add watchfile.
 229   * Support parallel builds, because eh why not
 230   * Update Vcs-Bzr.
 231   * Resync with Ubuntu, including patch to fix debian/copyright.
 232
 233   [ Julien Cristau ]
 234   * Add some missing copyright holders in d/copyright, update
 235     Upstream-Contact.  Thanks to Helen Koike for the help.
 236
 237  -- Julien Cristau <jcristau@debian.org>  Sat, 15 Oct 2016 15:17:34 +0200
 238
 239 shim (0.9+1474479173.6c180c6-0ubuntu1) UNRELEASED; urgency=medium
 240
 241   [ Helen Koike ]
 242   * debian/copyright: add OpenSSL license
 243
 244   [ Mathieu Trudel-Lapierre ]
 245   * New upstream release.
 246   * debian/copyright: patches should be BSD, like the rest of the upstream
 247     code.
 248   * debian/patches/unused-variable: dropped; applied upstream.
 249   * debian/patches/binutils-version-matching: dropped, fixed upstream.
 250   * debian/shim.install: built EFI binaries were renamed; update our install
 251     file to properly pick up shim (shim$arch), MokManager (mm$arch), and
 252     fallback (fb$arch).
 253
 254  -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Wed, 21 Sep 2016 20:29:44 -0400
 255
 256 shim (0.9+1465500757.14a5905-0ubuntu1) yakkety; urgency=medium
 257
 258   * New upstream release.
 259     - Better handle LoadOptions. (LP: #1581299)
 260     - Measure state and second stage in TPM.
 261     - Mirror MokSBState in runtime as MokSBStateRT.
 262     - Fix failure to build with GCC 5. (LP: #1429978)
 263     - Various bug fixes and other improvements.
 264   * Refreshed patches.
 265     - Remaining patches:
 266       + second-stage-path
 267       + sbsigntool-not-pesign
 268   * debian/patches/unused-variable: remove unused variable size.
 269   * debian/patches/binutils-version-matching: revert d9a4c912 to correctly
 270     match objcopy's version on Ubuntu.
 271   * debian/copyright: update copyright for patches.
 272
 273  -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Tue, 26 Jul 2016 16:48:32 -0400
 274
 275 shim (0.8-0ubuntu2) wily; urgency=medium
 276
 277   * No-change rebuild against gnu-efi 3.0v-5ubuntu1.
 278
 279  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 12 May 2015 17:48:30 +0000
 280
 281 shim (0.8-0ubuntu1) wily; urgency=medium
 282
 283   * New upstream release.
 284     - Clarify meaning of insecure_mode. (LP: #1384973)
 285   * debian/patches/CVE-2014-3675.patch, debian/patches/CVE-2014-3677.patch,
 286     debian/patches/0001-Update-openssl-to-0.9.8za.patch: dropped, included
 287     in the upstream release.
 288   * debian/patches/sbsigntool-not-pesign,debian/patches/second-stage-path:
 289     refreshed.
 290
 291  -- Mathieu Trudel-Lapierre <mathieu-tl@ubuntu.com>  Mon, 11 May 2015 19:50:49 -0400
 292
 293 shim (0.7-0ubuntu4) utopic; urgency=medium
 294
 295   * SECURITY UPDATE: heap overflow and out-of-bounds read access when
 296     parsing DHCPv6 information
 297     - debian/patches/CVE-2014-3675.patch: apply proper bounds checking
 298       when parsing data provided in DHCPv6 packets.
 299     - CVE-2014-3675
 300     - CVE-2014-3676
 301   * SECURITY UPDATE: memory corruption when processing user-provided key
 302     lists
 303     - debian/patches/CVE-2014-3677.patch: detect malformed machine owner
 304       key (MOK) lists and ignore them, avoiding possible memory corruption.
 305     - CVE-2014-3677
 306
 307  -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 08 Oct 2014 06:40:40 +0000
 308
 309 shim (0.7-0ubuntu2) utopic; urgency=medium
 310
 311   * Restore debian/patches/prototypes, which still is needed on shim 0.7
 312     but only detected on the buildds.
 313   * Update debian/patches/prototypes with some new declarations needed for
 314     openssl 0.9.8za update.
 315
 316  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 07 Oct 2014 16:20:08 -0700
 317
 318 shim (0.7-0ubuntu1) utopic; urgency=medium
 319
 320   * New upstream release.
 321     - fix spurious error message when fallback.efi is not present, as will
 322       always be the case for removable media.  LP: #1297069.
 323     - drop most patches, included upstream.
 324   * debian/patches/0001-Update-openssl-to-0.9.8za.patch: cherry-pick
 325     openssl 0.9.8za in via upstream.
 326
 327  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 07 Oct 2014 05:40:41 +0000
 328
 329 shim (0.4-0ubuntu5) utopic; urgency=low
 330
 331   * Install fallback.efi.signed as well, to lay the groundwork for fallback
 332     handling (wanted when we have to move a drive between machines, or when
 333     the firmware loses its marbles^W nvram).
 334
 335  -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Aug 2014 12:11:13 +0200
 336
 337 shim (0.4-0ubuntu4) saucy; urgency=low
 338
 339   * debian/patches/fix-tftp-prototype: pass the right arguments to
 340     EFI_PXE_BASE_CODE_TFTP_READ_FILE.
 341   * debian/patches/build-with-Werror: Build with -Werror to catch future
 342     prototype mismatches.
 343   * debian/patches/fix-compiler-warnings: Fix remaining compiler
 344     warnings in netboot.c.
 345   * debian/patches/tftp-proper-nul-termination: fix nul termination
 346     errors in filenames passed to tftp.
 347   * debian/patches/netboot-cleanup: roll-up of miscellaneous fixes to
 348     the netboot code.
 349
 350  -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 23 Sep 2013 00:30:00 -0700
 351
 352 shim (0.4-0ubuntu3) saucy; urgency=low
 353
 354   [ Steve Langasek ]
 355   * Install MokManager.efi.signed in the package.
 356   * debian/patches/no-output-by-default.patch: Don't print any
 357     informational messages.  Closes LP: #1074302.
 358
 359   [ Stéphane Graber ]
 360   * debian/patches/no-print-on-unsigned: Don't print an error message when
 361     validating an unsigned binary as that tends to hang Lenovo machines.
 362     (LP: #1087501)
 363
 364  -- Stéphane Graber <stgraber@ubuntu.com>  Thu, 08 Aug 2013 17:12:12 +0200
 365
 366 shim (0.4-0ubuntu2) saucy; urgency=low
 367
 368   * Add missing build-dependency on openssl.
 369
 370  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 02 Jul 2013 20:30:43 +0000
 371
 372 shim (0.4-0ubuntu1) saucy; urgency=low
 373
 374   * New upstream release.
 375   * Drop debian/patches/shim-before-loadimage; upstream has changed this to
 376     not call loadimage at all.
 377   * debian/patches/sbsigntool-not-pesign: Sign MokManager with
 378     sbsigntool instead of pesign.
 379   * Add a versioned build-dependency on gnu-efi.
 380
 381  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 02 Jul 2013 12:53:24 -0700
 382
 383 shim (0~20120906.bcd0a4e8-0ubuntu4) quantal-proposed; urgency=low
 384
 385   * debian/patches/shim-before-loadimage: Use direct verification first
 386     before LoadImage.  Addresses an issue where Lenovo's SecureBoot
 387     implementation pops an error message on any verification failure - avoid
 388     calling LoadImage at all unless we have to.
 389
 390  -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 10 Oct 2012 15:28:40 -0700
 391
 392 shim (0~20120906.bcd0a4e8-0ubuntu3) quantal; urgency=low
 393
 394   * debian/patches/second-stage-path: Chainload grubx64.efi, not
 395     grub.efi.
 396
 397  -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 05 Oct 2012 11:20:58 -0700
 398
 399 shim (0~20120906.bcd0a4e8-0ubuntu2) quantal; urgency=low
 400
 401   * debian/patches/prototypes: Include missing prototypes, and disable
 402     use of BIO_new_file.
 403   * Only build the package for amd64; we're not signing an i386 shim at this
 404     stage so there's no point in building it.
 405
 406  -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 04 Oct 2012 17:47:04 +0000
 407
 408 shim (0~20120906.bcd0a4e8-0ubuntu1) quantal; urgency=low
 409
 410   * Initial release.
 411   * Include the Canonical Secure Boot master CA.
 412
 413  -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 04 Oct 2012 00:01:06 -0700