debian/changelog

   1 shim (15.3-4) UNRELEASED; urgency=medium
   2
   3   * Print sha256 checksums of the EFI binaries when the build is done,
   4     for easier comparison between builds.
   5
   6  -- Steve McIntyre <93sam@debian.org>  Wed, 24 Mar 2021 13:21:05 +0000
   7
   8 shim (15.3-3) unstable; urgency=medium
   9
  10   * Update the timestamp for the 15.3-2 upload.
  11   * Only include the upstream version in the Debian SBAT metadata, so
  12     we don't break reproducibility on every minor packaging change.
  13
  14  -- Steve McIntyre <93sam@debian.org>  Wed, 24 Mar 2021 13:21:05 +0000
  15
  16 shim (15.3-2) unstable; urgency=medium
  17
  18   * Add missing build-dep on xxd for build-time unit tests
  19
  20  -- Steve McIntyre <93sam@debian.org>  Wed, 24 Mar 2021 02:21:53 +0000
  21
  22 shim (15.3-1) unstable; urgency=medium
  23
  24   [ Steve McIntyre ]
  25   * Switch to much-newer release with many fixes
  26     + Particularly pulling in SBAT changes for better revocation support
  27     + Remove all our old patches, no longer needed:
  28       - avoid_null_vsprint.patch
  29       - check_null_sn_ln.patch
  30       - fixup_git.patch
  31       - uname.patch
  32       - use_compare_mem_gcc9.patch
  33     + Now includes a vendor copy of gnu-efi with quite a few extra
  34       fixes needed.
  35     + Update copyright file to cover these changes
  36   * Switch to using gcc-10 rather than gcc-9. Closes: #978521
  37   * Add dbx entries for all our existing grub binaries
  38     + They're insecure, let's break the chainloading hole.
  39   * Add Debian SBAT data
  40     + Add a Debian SBAT template, and rules to use it
  41     + Adds a build-dep on dos2unix
  42
  43  -- Steve McIntyre <93sam@debian.org>  Tue, 23 Mar 2021 23:39:48 +0000
  44
  45 shim (15+1533136590.3beb971-10) unstable; urgency=medium
  46
  47   [ Debian Janitor ]
  48   * Trim trailing whitespace.
  49   * Use secure copyright file specification URI.
  50   * debian/copyright: use spaces rather than tabs to start continuation
  51     lines.
  52   * Bump debhelper from old 11 to 12.
  53   * Set debhelper-compat version in Build-Depends.
  54   * Set upstream metadata fields: Bug-Database, Bug-Submit.
  55   * Update standards version to 4.4.1, no changes needed.
  56
  57   [ Steve McIntyre ]
  58   * Trivial changes to generating the inbuilt dbx if we're using it.
  59   * Upload to pick up rotated Debian signing keys
  60
  61  -- Steve McIntyre <93sam@debian.org>  Fri, 24 Jul 2020 01:22:46 +0100
  62
  63 shim (15+1533136590.3beb971-9) unstable; urgency=medium
  64
  65   [ Steve McIntyre ]
  66   * In the -helpers-ARCH-signed packages, change the version
  67     dependency on shim-unsigned to be >= and not =. This will allow
  68     for installation to still work in the window while we wait for the
  69     template package to do its second trip through the
  70     archive. Closes: #955356
  71
  72  -- Steve McIntyre <93sam@debian.org>  Mon, 30 Mar 2020 15:19:08 +0100
  73
  74 shim (15+1533136590.3beb971-8) unstable; urgency=medium
  75
  76   [ Steve McIntyre ]
  77   * Use --padding when calling pesign to generate hashes for the dbx
  78     list, as recommended by Peter Jones. No actual changes needed in
  79     our list of hashes at this point - they work out the same either
  80     way.
  81   * Switch to using gcc-9 for builds, tweaking a patch from upstream
  82     to fix a FTBFS. Closes: #925816
  83   * Update debhelper compat level to 11 for shim and the
  84     signing-template
  85
  86  -- Steve McIntyre <93sam@debian.org>  Tue, 24 Mar 2020 16:51:10 +0000
  87
  88 shim (15+1533136590.3beb971-7) unstable; urgency=medium
  89
  90   [ Ansgar Burchardt ]
  91   * debian/control: Update Vcs-* fields
  92
  93   [ Steve McIntyre ]
  94   * Backport needed crash fixes:
  95     + VLogError(): Avoid NULL pointer dereferences in (V)Sprint calls
  96     + Fix OBJ_create() to tolerate a NULL sn and ln
  97   * Build using gcc-7 to get better control of reproducibility during the
  98     lifetime of Buster.
  99   * Build in a dbx list to blacklist binaries that we know to not be
 100     secure. Build-depend on a new (bug-fixed) version of pesign to
 101     generate that list at build time, using a list of known bad hashes.
 102   * Initial list of known bad hashes is just my personal test binary.
 103
 104  -- Steve McIntyre <93sam@debian.org>  Wed, 08 May 2019 02:05:01 +0100
 105
 106 shim (15+1533136590.3beb971-6) unstable; urgency=medium
 107
 108   [ Steve McIntyre ]
 109   * Add Provides: and Breaks: to shim-helpers-$arch-signed to fix
 110     clashes with the old shim-signed package for fbx64.efi.signed and
 111     mmx64.efi.signed. Closes: #924619
 112
 113   [ Helmut Grohne ]
 114   * Fix FTCBFS: Set CROSS_COMPILE. (Closes: #922152)
 115
 116  -- Steve McIntyre <93sam@debian.org>  Sat, 23 Mar 2019 18:19:13 +0000
 117
 118 shim (15+1533136590.3beb971-5) unstable; urgency=medium
 119
 120   [ Ansgar Burchardt ]
 121   * Correct maintainer address in signing template
 122
 123   [ Steve McIntyre ]
 124   * Remove Rules-Requires-Root in the signing template. We manually install
 125     things owned by root. There might be better ways to do this, but this
 126     will do for now.
 127
 128  -- Steve McIntyre <93sam@debian.org>  Tue, 12 Mar 2019 01:38:19 +0000
 129
 130 shim (15+1533136590.3beb971-4) unstable; urgency=medium
 131
 132   [ Steve McIntyre ]
 133   * No-change sourceful upload to get rebuilds (and hence build logs) from
 134     the buildds. Hoping to get this version signed by Microsoft, so let's
 135     make our setup as clean as possible.
 136
 137  -- Steve McIntyre <93sam@debian.org>  Sat, 09 Mar 2019 22:24:23 +0000
 138
 139 shim (15+1533136590.3beb971-3) unstable; urgency=medium
 140
 141   [ Philipp Hahn ]
 142   * debian/rules: fixing permissions no longer required
 143   * debian/rules: Disable ephemeral key on Debian.
 144   * Rename binary package to 'shim-unsigned'
 145   * Add template for signing {mm,fb}$ARCH.efi. (Closes: #922228)
 146
 147   [ Luca Boccassi ]
 148   * Override lintian error about template rules file.
 149   * Include /usr/share/dpkg/architecture.mk instead of shelling out.
 150   * Add uname.patch to avoid embedding the kernel architecture in the
 151     binary and to use a fixed string instead.
 152
 153   [ Steve McIntyre ]
 154   * Change maintenance address to be the EFI team
 155   * Add me and vorlon to the Uploaders list
 156   * Rename the helper binary packages to shim-helpers-$arch.
 157   * Update the signing-template JSON metadata to match new practice:
 158     + Move all the data under a new top-level "packages" key
 159     + Add an empty "trusted_certs" key - the helper binaries do not do any
 160       further verification with an embedded key.
 161
 162  -- Steve McIntyre <93sam@debian.org>  Fri, 08 Mar 2019 21:59:43 +0000
 163
 164 shim (15+1533136590.3beb971-2) unstable; urgency=medium
 165
 166   * Update debian/watch.
 167   * Update VCS to point to salsa.
 168   * Fix debian/rules syntax for arm64 build.
 169   * Enable build for i386.
 170   * Ensure DEB_HOST_ARCH is set even if not present in the environment.
 171   * Update Standards-Version.
 172   * Update debian/copyright (drop reference to file no longer in source)
 173
 174  -- Steve Langasek <vorlon@debian.org>  Mon, 11 Feb 2019 05:18:18 +0000
 175
 176 shim (15+1533136590.3beb971-1) unstable; urgency=medium
 177
 178   * New upstream release.
 179     - debian/patches/second-stage-path: dropped; the default loader path now
 180       includes an arch suffix.
 181     - debian/patches/sbsigntool-no-pesign: dropped; no longer needed.
 182   * Drop remaining patches that were not being applied.
 183   * Sync packaging from Ubuntu:
 184     - debian/copyright: Update upstream source location.
 185     - debian/control: add a Build-Depends on libelf-dev.
 186     - Enable arm64 build.
 187     - debian/patches/fixup_git.patch: don't run git in clean; we're not
 188       really in a git tree.
 189     - debian/rules, debian/shim.install: use the upstream install target as
 190       intended, and move files to the target directory using dh_install.
 191     - define RELEASE and COMMIT_ID for the snapshot.
 192     - Set ENABLE_HTTPBOOT to enable the HTTP Boot feature.
 193     - Update dh_auto_build/dh_auto_clean/dh_auto_install for new upstream
 194       options: set MAKELEVEL.
 195     - Define an EFI_ARCH variable, and use that for paths to shim. This
 196       makes it possible to build a shim for other architectures than amd64.
 197     - Set EFIDIR=$distro for dh_auto_install; that will let files be installed
 198       in the "right" final directories, and makes boot.csv for us.
 199     - Set ENABLE_SHIM_CERT, to keep using ephemeral self-signed certs built
 200       at compile-time for MokManager and fallback.
 201     - Set ENABLE_SBSIGN, to use sbsign instead of pesign for signing fallback
 202       and MokManager.
 203
 204  -- Steve Langasek <vorlon@debian.org>  Sat, 09 Feb 2019 07:23:19 +0000
 205
 206 shim (0.9+1474479173.6c180c6-1) unstable; urgency=medium
 207
 208   [ Steve Langasek ]
 209   * Initial Debian upload.  Closes: #820052.
 210   * Update Standards-Version.
 211   * Embed the newly-minted Debian CA certificate.
 212   * Vendorize debian/rules so that the same package can be used in both
 213     Debian and Ubuntu without modification.
 214   * Fix debian/copyright to match the spec (last match wins, not first)
 215   * Fix shim.efi to not be executable.
 216   * Add watchfile.
 217   * Support parallel builds, because eh why not
 218   * Update Vcs-Bzr.
 219   * Resync with Ubuntu, including patch to fix debian/copyright.
 220
 221   [ Julien Cristau ]
 222   * Add some missing copyright holders in d/copyright, update
 223     Upstream-Contact.  Thanks to Helen Koike for the help.
 224
 225  -- Julien Cristau <jcristau@debian.org>  Sat, 15 Oct 2016 15:17:34 +0200
 226
 227 shim (0.9+1474479173.6c180c6-0ubuntu1) UNRELEASED; urgency=medium
 228
 229   [ Helen Koike ]
 230   * debian/copyright: add OpenSSL license
 231
 232   [ Mathieu Trudel-Lapierre ]
 233   * New upstream release.
 234   * debian/copyright: patches should be BSD, like the rest of the upstream
 235     code.
 236   * debian/patches/unused-variable: dropped; applied upstream.
 237   * debian/patches/binutils-version-matching: dropped, fixed upstream.
 238   * debian/shim.install: built EFI binaries were renamed; update our install
 239     file to properly pick up shim (shim$arch), MokManager (mm$arch), and
 240     fallback (fb$arch).
 241
 242  -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Wed, 21 Sep 2016 20:29:44 -0400
 243
 244 shim (0.9+1465500757.14a5905-0ubuntu1) yakkety; urgency=medium
 245
 246   * New upstream release.
 247     - Better handle LoadOptions. (LP: #1581299)
 248     - Measure state and second stage in TPM.
 249     - Mirror MokSBState in runtime as MokSBStateRT.
 250     - Fix failure to build with GCC 5. (LP: #1429978)
 251     - Various bug fixes and other improvements.
 252   * Refreshed patches.
 253     - Remaining patches:
 254       + second-stage-path
 255       + sbsigntool-not-pesign
 256   * debian/patches/unused-variable: remove unused variable size.
 257   * debian/patches/binutils-version-matching: revert d9a4c912 to correctly
 258     match objcopy's version on Ubuntu.
 259   * debian/copyright: update copyright for patches.
 260
 261  -- Mathieu Trudel-Lapierre <cyphermox@ubuntu.com>  Tue, 26 Jul 2016 16:48:32 -0400
 262
 263 shim (0.8-0ubuntu2) wily; urgency=medium
 264
 265   * No-change rebuild against gnu-efi 3.0v-5ubuntu1.
 266
 267  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 12 May 2015 17:48:30 +0000
 268
 269 shim (0.8-0ubuntu1) wily; urgency=medium
 270
 271   * New upstream release.
 272     - Clarify meaning of insecure_mode. (LP: #1384973)
 273   * debian/patches/CVE-2014-3675.patch, debian/patches/CVE-2014-3677.patch,
 274     debian/patches/0001-Update-openssl-to-0.9.8za.patch: dropped, included
 275     in the upstream release.
 276   * debian/patches/sbsigntool-not-pesign,debian/patches/second-stage-path:
 277     refreshed.
 278
 279  -- Mathieu Trudel-Lapierre <mathieu-tl@ubuntu.com>  Mon, 11 May 2015 19:50:49 -0400
 280
 281 shim (0.7-0ubuntu4) utopic; urgency=medium
 282
 283   * SECURITY UPDATE: heap overflow and out-of-bounds read access when
 284     parsing DHCPv6 information
 285     - debian/patches/CVE-2014-3675.patch: apply proper bounds checking
 286       when parsing data provided in DHCPv6 packets.
 287     - CVE-2014-3675
 288     - CVE-2014-3676
 289   * SECURITY UPDATE: memory corruption when processing user-provided key
 290     lists
 291     - debian/patches/CVE-2014-3677.patch: detect malformed machine owner
 292       key (MOK) lists and ignore them, avoiding possible memory corruption.
 293     - CVE-2014-3677
 294
 295  -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 08 Oct 2014 06:40:40 +0000
 296
 297 shim (0.7-0ubuntu2) utopic; urgency=medium
 298
 299   * Restore debian/patches/prototypes, which still is needed on shim 0.7
 300     but only detected on the buildds.
 301   * Update debian/patches/prototypes with some new declarations needed for
 302     openssl 0.9.8za update.
 303
 304  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 07 Oct 2014 16:20:08 -0700
 305
 306 shim (0.7-0ubuntu1) utopic; urgency=medium
 307
 308   * New upstream release.
 309     - fix spurious error message when fallback.efi is not present, as will
 310       always be the case for removable media.  LP: #1297069.
 311     - drop most patches, included upstream.
 312   * debian/patches/0001-Update-openssl-to-0.9.8za.patch: cherry-pick
 313     openssl 0.9.8za in via upstream.
 314
 315  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 07 Oct 2014 05:40:41 +0000
 316
 317 shim (0.4-0ubuntu5) utopic; urgency=low
 318
 319   * Install fallback.efi.signed as well, to lay the groundwork for fallback
 320     handling (wanted when we have to move a drive between machines, or when
 321     the firmware loses its marbles^W nvram).
 322
 323  -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 04 Aug 2014 12:11:13 +0200
 324
 325 shim (0.4-0ubuntu4) saucy; urgency=low
 326
 327   * debian/patches/fix-tftp-prototype: pass the right arguments to
 328     EFI_PXE_BASE_CODE_TFTP_READ_FILE.
 329   * debian/patches/build-with-Werror: Build with -Werror to catch future
 330     prototype mismatches.
 331   * debian/patches/fix-compiler-warnings: Fix remaining compiler
 332     warnings in netboot.c.
 333   * debian/patches/tftp-proper-nul-termination: fix nul termination
 334     errors in filenames passed to tftp.
 335   * debian/patches/netboot-cleanup: roll-up of miscellaneous fixes to
 336     the netboot code.
 337
 338  -- Steve Langasek <steve.langasek@ubuntu.com>  Mon, 23 Sep 2013 00:30:00 -0700
 339
 340 shim (0.4-0ubuntu3) saucy; urgency=low
 341
 342   [ Steve Langasek ]
 343   * Install MokManager.efi.signed in the package.
 344   * debian/patches/no-output-by-default.patch: Don't print any
 345     informational messages.  Closes LP: #1074302.
 346
 347   [ Stéphane Graber ]
 348   * debian/patches/no-print-on-unsigned: Don't print an error message when
 349     validating an unsigned binary as that tends to hang Lenovo machines.
 350     (LP: #1087501)
 351
 352  -- Stéphane Graber <stgraber@ubuntu.com>  Thu, 08 Aug 2013 17:12:12 +0200
 353
 354 shim (0.4-0ubuntu2) saucy; urgency=low
 355
 356   * Add missing build-dependency on openssl.
 357
 358  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 02 Jul 2013 20:30:43 +0000
 359
 360 shim (0.4-0ubuntu1) saucy; urgency=low
 361
 362   * New upstream release.
 363   * Drop debian/patches/shim-before-loadimage; upstream has changed this to
 364     not call loadimage at all.
 365   * debian/patches/sbsigntool-not-pesign: Sign MokManager with
 366     sbsigntool instead of pesign.
 367   * Add a versioned build-dependency on gnu-efi.
 368
 369  -- Steve Langasek <steve.langasek@ubuntu.com>  Tue, 02 Jul 2013 12:53:24 -0700
 370
 371 shim (0~20120906.bcd0a4e8-0ubuntu4) quantal-proposed; urgency=low
 372
 373   * debian/patches/shim-before-loadimage: Use direct verification first
 374     before LoadImage.  Addresses an issue where Lenovo's SecureBoot
 375     implementation pops an error message on any verification failure - avoid
 376     calling LoadImage at all unless we have to.
 377
 378  -- Steve Langasek <steve.langasek@ubuntu.com>  Wed, 10 Oct 2012 15:28:40 -0700
 379
 380 shim (0~20120906.bcd0a4e8-0ubuntu3) quantal; urgency=low
 381
 382   * debian/patches/second-stage-path: Chainload grubx64.efi, not
 383     grub.efi.
 384
 385  -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 05 Oct 2012 11:20:58 -0700
 386
 387 shim (0~20120906.bcd0a4e8-0ubuntu2) quantal; urgency=low
 388
 389   * debian/patches/prototypes: Include missing prototypes, and disable
 390     use of BIO_new_file.
 391   * Only build the package for amd64; we're not signing an i386 shim at this
 392     stage so there's no point in building it.
 393
 394  -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 04 Oct 2012 17:47:04 +0000
 395
 396 shim (0~20120906.bcd0a4e8-0ubuntu1) quantal; urgency=low
 397
 398   * Initial release.
 399   * Include the Canonical Secure Boot master CA.
 400
 401  -- Steve Langasek <steve.langasek@ubuntu.com>  Thu, 04 Oct 2012 00:01:06 -0700