add Proxmox file references to packaging

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>

diff --git a/debian/proxmox-dbx.hashes b/debian/proxmox-dbx.hashes
new file mode 100644 (file)
index 0000000..06fe68c
--- /dev/null
+++ b/debian/proxmox-dbx.hashes
@@ -0,0 +1,20 @@
+# proxmox-dbx.hashes
+#
+# This file contains the sha256 sums of the binaries that we want to
+# blacklist directly in our signed shim. Add entries below, with comments
+# to explain each entry (where possible).
+#
+# The data in this file needs should be of the form:
+#
+# <hex-encoded sha256 checksums> <arch>
+#
+# All other lines will be ignored. I'm using shell-style comments just
+# for clarity.
+#
+# The hashes are generated using:
+#
+#     pesign --hash --padding --in <binary>
+#
+# on *either* the signed or unsigned binary, pesign doesn't care
+# which. See the helper script block_signed_deb for an easy way to
+# generate this information.

diff --git a/debian/rules b/debian/rules
index a6e974481a09c46c80b7587d83010964a0bcfe1c..bcb8c557db152b43d406f6231bb1f79821403542 100755 (executable)
--- a/debian/rules
+++ b/debian/rules
@@ -11,8 +11,8 @@ ifeq ($(shell dpkg-vendor --is ubuntu && echo yes),yes)
        distributor=ubuntu
 COMMON_OPTIONS ?= ENABLE_SHIM_CERT=1 ENABLE_SBSIGN=1
 else
-       cert=debian/debian-uefi-ca.der
-       distributor=debian
+       cert=debian/proxmox-uefi-ca.der
+       distributor=proxmox
 endif
 
 deb_version             := $(shell dpkg-parsechangelog | sed -ne "s/^Version: \(.*\)/\1/p")

diff --git a/debian/sbat.proxmox.csv.in b/debian/sbat.proxmox.csv.in
new file mode 100644 (file)
index 0000000..7bd6bf4
--- /dev/null
+++ b/debian/sbat.proxmox.csv.in
@@ -0,0 +1 @@
+shim.proxmox,1,Proxmox,shim,@UPSTREAM_VERSION@,https://git.proxmox.com/?p=efi-boot-shim.git

diff --git a/debian/signing-template/changelog.in b/debian/signing-template/changelog.in
index f2e4ba69db1bca0b6167fbf1e759f271e1b6c503..bb7a7ecd89783880c11cd534c4307b500360fbb3 100644 (file)
--- a/debian/signing-template/changelog.in
+++ b/debian/signing-template/changelog.in
@@ -2,7 +2,7 @@ shim-helpers-@arch@-signed (1+@version_mangled@) @distribution@; urgency=@urgenc
 
   * Update to shim @version_binary@
 
- -- Debian signing service <ftpmaster@debian.org>  @date@
+ -- Proxmox signing service <support@proxmox.com>  @date@
 
 shim-helpers-@arch@-signed (1) unstable; urgency=medium
 

diff --git a/debian/signing-template/control.in b/debian/signing-template/control.in
index 9d75d9259928060ebe22b9b9a732946e26f03508..eb73c6087692a80547c1ff3c37917e43d19dc07a 100644 (file)
--- a/debian/signing-template/control.in
+++ b/debian/signing-template/control.in
@@ -1,7 +1,7 @@
 Source: shim-helpers-@arch@-signed
 Section: admin
 Priority: optional
-Maintainer: Debian EFI team <debian-efi@lists.debian.org>
+Maintainer: Proxmox Support Team <support@proxmox.com>
 Standards-Version: 4.3.0
 Build-Depends: debhelper (>= 10.1~),
  sbsigntool [amd64 arm64 i386],
@@ -14,7 +14,7 @@ Replaces: shim (<< 15+1533136590.3beb971-3~), shim-signed (<< 1.29),
 Breaks: shim-signed (<< 1.29),
 Depends: shim-unsigned (>= @version_binary@), ${misc:Depends},
 Built-Using: shim (= @version_binary@)
-Description: boot loader to chain-load signed boot loaders (signed by Debian)
+Description: boot loader to chain-load signed boot loaders (signed by Proxmox)
  This package provides a minimalist boot loader which allows verifying
  signatures of other UEFI binaries against either the Secure Boot DB/DBX or
  against a built-in signature database.  Its purpose is to allow a small,
@@ -22,4 +22,4 @@ Description: boot loader to chain-load signed boot loaders (signed by Debian)
  an OS distributor to revision their main bootloader independently of the CA.
  .
  This package contains the MOK manager and fall-back manager signed by the
- Debian UEFI CA to be used by shim-signed.
+ Proxmox UEFI CA to be used by shim-signed.

diff --git a/debian/source/include-binaries b/debian/source/include-binaries
index d82be7488939105363511bc130ae938140564d08..686fcd15dbd936f8024e68b5aba630d42ec6f3e3 100644 (file)
--- a/debian/source/include-binaries
+++ b/debian/source/include-binaries
@@ -1,2 +1,3 @@
 debian/canonical-uefi-ca.der
 debian/debian-uefi-ca.der
+debian/proxmox-uefi-ca.der