debian/changelog

   1 shim (15+1533136590.3beb971-2) UNRELEASED; urgency=medium
   2
   3   * Update debian/watch.
   4   * Update VCS to point to salsa.
   5   * Fix debian/rules syntax for arm64 build.
   6   * Enable build for i386.
   7   * Ensure DEB_HOST_ARCH is set even if not present in the environment.
   8   * Update Standards-Version.
   9
  10  -- Steve Langasek <vorlon@debian.org>  Sun, 10 Feb 2019 00:15:19 -0800
  11
  12 shim (15+1533136590.3beb971-1) unstable; urgency=medium
  13
  14   * New upstream release.
  15     - debian/patches/second-stage-path: dropped; the default loader path now
  16       includes an arch suffix.
  17     - debian/patches/sbsigntool-no-pesign: dropped; no longer needed.
  18   * Drop remaining patches that were not being applied.
  19   * Sync packaging from Ubuntu:
  20     - debian/copyright: Update upstream source location.
  21     - debian/control: add a Build-Depends on libelf-dev.
  22     - Enable arm64 build.
  23     - debian/patches/fixup_git.patch: don't run git in clean; we're not
  24       really in a git tree.
  25     - debian/rules, debian/shim.install: use the upstream install target as
  26       intended, and move files to the target directory using dh_install.
  27     - define RELEASE and COMMIT_ID for the snapshot.
  28     - Set ENABLE_HTTPBOOT to enable the HTTP Boot feature.
  29     - Update dh_auto_build/dh_auto_clean/dh_auto_install for new upstream
  30       options: set MAKELEVEL.
  31     - Define an EFI_ARCH variable, and use that for paths to shim. This
  32       makes it possible to build a shim for other architectures than amd64.
  33     - Set EFIDIR=$distro for dh_auto_install; that will let files be installed
  34       in the "right" final directories, and makes boot.csv for us.
  35     - Set ENABLE_SHIM_CERT, to keep using ephemeral self-signed certs built
  36       at compile-time for MokManager and fallback.
  37     - Set ENABLE_SBSIGN, to use sbsign instead of pesign for signing fallback
  38       and MokManager.
  39
  40  -- Steve Langasek <vorlon@debian.org>  Sat, 09 Feb 2019 07:23:19 +0000
  41
  42 shim (0.9+1474479173.6c180c6-1) unstable; urgency=medium
  43
  44   [ Steve Langasek ]
  45   * Initial Debian upload.  Closes: #820052.
  46   * Update Standards-Version.
  47   * Embed the newly-minted Debian CA certificate.
  48   * Vendorize debian/rules so that the same package can be used in both
  49     Debian and Ubuntu without modification.
  50   * Fix debian/copyright to match the spec (last match wins, not first)
  51   * Fix shim.efi to not be executable.
  52   * Add watchfile.
  53   * Support parallel builds, because eh why not
  54   * Update Vcs-Bzr.
  55   * Resync with Ubuntu, including patch to fix debian/copyright.
  56
  57   [ Julien Cristau ]
  58   * Add some missing copyright holders in d/copyright, update
  59     Upstream-Contact.  Thanks to Helen Koike for the help.
  60
  61  -- Julien Cristau <jcristau@debian.org>  Sat, 15 Oct 2016 15:17:34 +0200
  62
  63 shim (0.9+1474479173.6c180c6-0ubuntu1) UNRELEASED; urgency=medium
  64
  65   [ Helen Koike ]
  66   * debian/copyright: add OpenSSL license
  67
  68   [ Mathieu Trudel-Lapierre ]
  69   * New upstream release.
  70   * debian/copyright: patches should be BSD, like the rest of the upstream
  71     code.
  72   * debian/patches/unused-variable: dropped; applied upstream.
  73   * debian/patches/binutils-version-matching: dropped, fixed upstream.
  74   * debian/shim.install: built EFI binaries were renamed; update our install
  75     file to properly pick up shim (shim$arch), MokManager (mm$arch), and
  76     fallback (fb$arch).
  77
  78  -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Wed, 21 Sep 2016 20:29:44 -0400
  79
  80 shim (0.9+1465500757.14a5905-0ubuntu1) yakkety; urgency=medium
  81
  82   * New upstream release.
  83     - Better handle LoadOptions. (LP: #1581299)
  84     - Measure state and second stage in TPM.
  85     - Mirror MokSBState in runtime as MokSBStateRT.
  86     - Fix failure to build with GCC 5. (LP: #1429978)
  87     - Various bug fixes and other improvements.
  88   * Refreshed patches.
  89     - Remaining patches:
  90       + second-stage-path
  91       + sbsigntool-not-pesign
  92   * debian/patches/unused-variable: remove unused variable size.
  93   * debian/patches/binutils-version-matching: revert d9a4c912 to correctly
  94     match objcopy's version on Ubuntu.
  95   * debian/copyright: update copyright for patches.
  96
  97  -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Tue, 26 Jul 2016 16:48:32 -0400
  98
  99 shim (0.8-0ubuntu2) wily; urgency=medium
 100
 101   * No-change rebuild against gnu-efi 3.0v-5ubuntu1.
 102
 103  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 12 May 2015 17:48:30 +0000
 104
 105 shim (0.8-0ubuntu1) wily; urgency=medium
 106
 107   * New upstream release.
 108     - Clarify meaning of insecure_mode. (LP: #1384973)
 109   * debian/patches/CVE-2014-3675.patch, debian/patches/CVE-2014-3677.patch,
 110     debian/patches/0001-Update-openssl-to-0.9.8za.patch: dropped, included
 111     in the upstream release.
 112   * debian/patches/sbsigntool-not-pesign,debian/patches/second-stage-path:
 113     refreshed.
 114
 115  -- Mathieu Trudel-Lapierre <mathieu-tl@ubuntu.com>  Mon, 11 May 2015 19:50:49 -0400
 116
 117 shim (0.7-0ubuntu4) utopic; urgency=medium
 118
 119   * SECURITY UPDATE: heap overflow and out-of-bounds read access when
 120     parsing DHCPv6 information
 121     - debian/patches/CVE-2014-3675.patch: apply proper bounds checking
 122       when parsing data provided in DHCPv6 packets.
 123     - CVE-2014-3675
 124     - CVE-2014-3676
 125   * SECURITY UPDATE: memory corruption when processing user-provided key
 126     lists
 127     - debian/patches/CVE-2014-3677.patch: detect malformed machine owner
 128       key (MOK) lists and ignore them, avoiding possible memory corruption.
 129     - CVE-2014-3677
 130
 131  -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 08 Oct 2014 06:40:40 +0000
 132
 133 shim (0.7-0ubuntu2) utopic; urgency=medium
 134
 135   * Restore debian/patches/prototypes, which still is needed on shim 0.7
 136     but only detected on the buildds.
 137   * Update debian/patches/prototypes with some new declarations needed for
 138     openssl 0.9.8za update.
 139
 140  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 07 Oct 2014 16:20:08 -0700
 141
 142 shim (0.7-0ubuntu1) utopic; urgency=medium
 143
 144   * New upstream release.
 145     - fix spurious error message when fallback.efi is not present, as will
 146       always be the case for removable media.  LP: #1297069.
 147     - drop most patches, included upstream.
 148   * debian/patches/0001-Update-openssl-to-0.9.8za.patch: cherry-pick
 149     openssl 0.9.8za in via upstream.
 150
 151  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 07 Oct 2014 05:40:41 +0000
 152
 153 shim (0.4-0ubuntu5) utopic; urgency=low
 154
 155   * Install fallback.efi.signed as well, to lay the groundwork for fallback
 156     handling (wanted when we have to move a drive between machines, or when
 157     the firmware loses its marbles^W nvram).
 158
 159  -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Aug 2014 12:11:13 +0200
 160
 161 shim (0.4-0ubuntu4) saucy; urgency=low
 162
 163   * debian/patches/fix-tftp-prototype: pass the right arguments to
 164     EFI_PXE_BASE_CODE_TFTP_READ_FILE.
 165   * debian/patches/build-with-Werror: Build with -Werror to catch future
 166     prototype mismatches.
 167   * debian/patches/fix-compiler-warnings: Fix remaining compiler
 168     warnings in netboot.c.
 169   * debian/patches/tftp-proper-nul-termination: fix nul termination
 170     errors in filenames passed to tftp.
 171   * debian/patches/netboot-cleanup: roll-up of miscellaneous fixes to
 172     the netboot code.
 173
 174  -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 23 Sep 2013 00:30:00 -0700
 175
 176 shim (0.4-0ubuntu3) saucy; urgency=low
 177
 178   [ Steve Langasek ]
 179   * Install MokManager.efi.signed in the package.
 180   * debian/patches/no-output-by-default.patch: Don't print any
 181     informational messages.  Closes LP: #1074302.
 182
 183   [ Stéphane Graber ]
 184   * debian/patches/no-print-on-unsigned: Don't print an error message when
 185     validating an unsigned binary as that tends to hang Lenovo machines.
 186     (LP: #1087501)
 187
 188  -- Stéphane Graber <stgraber@ubuntu.com>  Thu, 08 Aug 2013 17:12:12 +0200
 189
 190 shim (0.4-0ubuntu2) saucy; urgency=low
 191
 192   * Add missing build-dependency on openssl.
 193
 194  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 02 Jul 2013 20:30:43 +0000
 195
 196 shim (0.4-0ubuntu1) saucy; urgency=low
 197
 198   * New upstream release.
 199   * Drop debian/patches/shim-before-loadimage; upstream has changed this to
 200     not call loadimage at all.
 201   * debian/patches/sbsigntool-not-pesign: Sign MokManager with
 202     sbsigntool instead of pesign.
 203   * Add a versioned build-dependency on gnu-efi.
 204
 205  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 02 Jul 2013 12:53:24 -0700
 206
 207 shim (0~20120906.bcd0a4e8-0ubuntu4) quantal-proposed; urgency=low
 208
 209   * debian/patches/shim-before-loadimage: Use direct verification first
 210     before LoadImage.  Addresses an issue where Lenovo's SecureBoot
 211     implementation pops an error message on any verification failure - avoid
 212     calling LoadImage at all unless we have to.
 213
 214  -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 10 Oct 2012 15:28:40 -0700
 215
 216 shim (0~20120906.bcd0a4e8-0ubuntu3) quantal; urgency=low
 217
 218   * debian/patches/second-stage-path: Chainload grubx64.efi, not
 219     grub.efi.
 220
 221  -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 05 Oct 2012 11:20:58 -0700
 222
 223 shim (0~20120906.bcd0a4e8-0ubuntu2) quantal; urgency=low
 224
 225   * debian/patches/prototypes: Include missing prototypes, and disable
 226     use of BIO_new_file.
 227   * Only build the package for amd64; we're not signing an i386 shim at this
 228     stage so there's no point in building it.
 229
 230  -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 04 Oct 2012 17:47:04 +0000
 231
 232 shim (0~20120906.bcd0a4e8-0ubuntu1) quantal; urgency=low
 233
 234   * Initial release.
 235   * Include the Canonical Secure Boot master CA.
 236
 237  -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 04 Oct 2012 00:01:06 -0700