<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="15">
<package pkgid="88ba510b0447c016b6aca6b2ffb6bc7fdf654ba0208da238502cfe6a4e66cf82" name="shim" arch="aarch64">
  <version epoch="0" ver="16.1" rel="150700.10.9"/>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="glin@suse.com" date="1712059200">- Introduce %shim_use_fde_tpm_helper macro so that the project
  can include the fde-tpm-helper-macros for the build targets
  other than Tumbleweed</changelog>
  <changelog author="dennis.tseng@suse.com" date="1719316800">- Update asc files of shim-15.8 after being signed back from
  Microsoft, including:
  signature-opensuse.x86_64.asc,
  signature-opensuse.aarch64.asc,
  signature-sles.x86_64.asc,
  signature-sles.aarch64.asc.
- Enable aarch64 signature comparison which was disabled temporarily
  before. Now, we got a real one. So it is enabled again.</changelog>
  <changelog author="glin@suse.com" date="1726488000">- Update shim-install to apply the missing fix for openSUSE Leap
  (bsc#1210382)
  * 86b73d1 Fix that bootx64.efi is not updated on Leap
- Update shim-install to use the 'removable' way for SL-Micro
  (bsc#1230316)
  * 433cc4e Always use the removable way for SL-Micro</changelog>
  <changelog author="glin@suse.com" date="1726747200">- Update shim-install to limit the scope of the 'removable'
  SL-Micro to the image booting with TPM2 unsealing (bsc#1210382)
  * 769e41d Limit the removable option to encrypted SL-Micro</changelog>
  <changelog author="mls@suse.de" date="1734696000">- undefine %_enable_debug_packages to fix building with rpm-4.20</changelog>
  <changelog author="dennis.tseng@suse.com" date="1746532800">-- Update to version 16.0
  - remove shim-bsc1177315-verify-eku-codesign.patch
    remove it because shim github upstream has accepted it (PR #664)
  - add revoked-SLES-UEFI-SIGN-Certificate-2022-05.crt to revoked certificates for dbx
    SLES-UEFI-SIGN-Certificate-20220525.crt can be blacklisted,
    and can be added to the vendor dbx.
  - add shim-alloc-one-more-byte-for-sprintf.patch (bsc#1240871)
    The codes already submitted to git upstream (PR #746)
    In generate_sbat_var_defs.c, realloc() should allocate one more byte for
    the end of string '\0' when running sprintf() later.
  - Patches (git log --oneline --reverse 15.8..16.0)
    126a07e Validate that a supplied vendor cert is not in PEM format
    63edf92 sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
    3e1394e sbat: Also bump latest for grub,4 (and to todays date)
    470a8cd undo change that limits certificate files to a single file
    0287c6b shim: don't set second_stage to the empty string
    3685b13 Fix SBAT.md for today's consensus about numbers
    dc07432 Realize the suggestions as part of PR #672
    e064e7d Update Code of Conduct contact address
    e68f4ca make-certs: Handle missing OpenSSL installation
    74a1f29 Update MokVars.txt  - Update documented mirrored variable attributes from RT to BS,RT  - Add missing MokSBStateRT  - Clarify that MokIgnoreDB is a mirror of MokDBState  - Add missing attributes for MokPWStore
    f6674fe export DEFINES for sub makefile
    47bbb5e Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
    338fded Null-terminate 'arguments' in fallback
    3d1dcd4 Fix "Verifiying" typo in error message
    b5d359a CI: use checkout@v4
    1d8365f CI: work around ownership issue on github
    20094ca Update fedora CI targets
    3cf0e09 Force gcc to produce DWARF4 so that gdb can use it
    5f54182 includes: work around CLANG_PREREQ() double-definition
    ab06527 Makefile: don't warn about clang when building compile_commands.json
    0c9249d Suppress some warnings even harder in Cryptlib and OpenSSL.
    fd7e16f Add building compile_commands.json to CI
    314aecf Discard load-options that start with WINDOWS
    ac85ba4 Fix the issue that the gBS-&gt;LoadImage pointer was empty.
    d8c86b7 shim: Allow data after the end of device path node in load options
    d197220 Backport EFI_HTTP_ERROR status code
    6410312 netboot: Convert TFTP error codes to EFI status codes
    ef8e729 httpboot: Convert HTTP status codes to EFI status codes
    2a1cbe6 Update gnu-efi submodule for EFI_HTTP_ERROR
    196cbb9 Increase EFI file alignment
    ad8692e avoid EFIv2 runtime services on Apple x86 machines
    0345331 Improve shortcut performance when comparing two boolean expressions
    27562ea Fix bad reference to PathName in image loading
    1508ece Move is_removable_media_path() to a shared location.
    7864c10 Provide better error message when MokManager is not found
    3e60895 tpm: Boot with a warning if the event log is full
    b560c52 MokManager: remove redundant logical constraints
    9229e7c Make mock_set_variable() correctly account for resource usage.
    f7e1d72 tests: make it possible to use different limits for variable space
    67efdfc test-mok-mirror: refactor the validation of test_mok_mirror_0
    70366a2 test-mok-mirror: add a test case where MokListRT won't fit.
    3caa75e test-mok-mirror: minor bug fix
    dc45aa6 lib/simple_file.c: Allocate zeroed pool for SimpleFS entries
    9415d3c simple_file: Allow to form a volume name from DevicePath
    d6076cb simple_file: Use second variable to create filesystem entries
    f99749a Ignore a minor clang-tidy nit
    98173f0 Fall back to default loader when encountering errors on network boot
    e42c319 test.mk: don't use a temporary random.bin
    c66c157 pe: Enhance debug report for update_mem_attrs
    1125212 Fix leak in error path
    2daf1db Load concatenated EFI_SIGNATURE_LISTs from shim_certificate.efi
    eeca60a Update SbatLevel_Variable.txt with peimage CVE-2024-2312 revocation
    743f3fa Add generate_sbat_var_defs utility program
    5ae408a Generate and use generated_sbat_var_defs.h
    e886fb3 SbatLevel_Variable.txt: clarify where and how revocation data is tracked
    15c1a9a Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
    eb02afc Optionally enabling codesign EKU check in compiling time.
    7ae0ee6 Add docs for ENABLE_CODESIGN_EKU
    38dfa37 Create utils file
    83850cd Add configuration option to boot an alternative 2nd stage
    bb114a3 Implement shim image load protocol
    e7b3598 Move some stuff around
    0322e10 Implement the rest of the loader protocol functions
    e43aea8 Add EFI_LOAD_FILE2_PROTOCOL to gnu-efi
    2bff460 loader-proto: Add support for loading files from disk to LoadImage()
    5d17278 loader-proto: Mark load_image()'s handle_image() call as "in_protocol"
    fe2ad36 Don't print full screen error dialog from handle_image() when called in_protocol
    c57af36 loader-proto: Respect optional DevicePath parameter to load_image()
    2b49dc1 Suppress file open failures for some netboot cases
    3c3295d netboot: process revocations.efi as revocations not shim_certificate
    c66ce2a Allow indepdent SkuSi and SBAT revocation updates
    6b8e40c netboot can try to load shim_certificate_[0..9].efi
    301cf52 Document how revocations can be delivered
    7cde2cc post-process-pe: add tests to validate NX compliance
    1294b47 regression: out of bounds read in CopyMem() in ad8692e
    765f294 compiler.h: minor ALIGN_... fixes
    5c1e6e4 Move error logging decls out of shim.h
    d972515 Save the debug and error logs in mok-variables
    e3f0338 Silence minor nit in load-options parsing debug output
    3d7c057 get_mem_attrs(): ensure an error code is set on failure
    49db3de mok: add MOK_VARIABLE_CONFIG_ONLY
    887c0ed mok variables: add a format callback
    e4857b4 Make test-mok-error failures *slightly* more clear.
    589c3f2 Move memory attribute support to its own file.
    848667d shim: add HSIStatus feature
    e136e64 mock-variables: fix debugging printf format specifier oopsie
    f0958ba test-mock-variables: improve some debug prints
    b216543 Move mok state variable data flag definitions to the header.
    fc0cfac Mirror some more efi variables to mok-variables
    eeda3fa gnu-efi: add some DXE services.
    c41b1f0 Add support for DXE memory attribute updates.
    9269e9b Add DXE Services information to HSI
    c868d54 hexdump: give a different debug log for size==0
    1baf1ef HSI: Add decode_hsi_bits() for easier reading of the debug log
    3bce118 pe: read_header(): allow skipping SecDir content validation
    89e6150 Add shim's current NX_COMPAT status to HSIStatus
    c5c5287 peimage.h: minor whitespace fixes
    5007d83 peimage: add a bunch of comments to read_header()
    489af5e README.tpm: reflect that vendor_db is in fact logged as "vendor_db"
    1958b0f reject message with different values in multiple Content-Length header field
    9c423e0 Some save_logs() improvements.
    81d40e3 Disable log saving for now.
    498b149 fallback: don't add new boot order entries backwards
    06d8dec makefiles: Make GITTAG swizzle tildes to dashes
    f02b2c1 make-archive: some minor housekeeping
    794d237 Update version to 16.0~rc1
    d45c610 SetSecureVariable(): free Cert on failure
    76fab7b generate_sbat_var_defs: run clang-format on readfile()
    6dadb70 generate_sbat_var_defs: Fix memory leak on realloc failure and fd leak.
    f58c77e generate_sbat_var_defs: Ensure revlistentry-&gt;revocations is initialized.
    b427a34 mirror_mok_db(): get rid of an unused variable+allocation
    92630f2 mirror_one_mok_variable(): fix a memory leak on TPM log error.
    38f0a9c mirror_mok_db(): Free our mok variable name correctly
    db04321 shim_load_image(): initialize the buffer fully
    7b75382 simple_dir_filter(): test our 'next' pointer
    db1f1da Make 'make fanalyzer' work again.
    28d8871 README.tpm: Update MokList entry to MokListRT
    8932527 SBAT Level update for February 2025 GRUB CVEs
    18d98bf Update version to 16.0</changelog>
  <changelog author="dennis.tseng@suse.com" date="1748433600">- add revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt into dbx
- build shim with EKU enable flag (ENABLE_CODESIGN_EKU)
  remove EKU enable flag when build MokManager and fallback</changelog>
  <changelog author="dennis.tseng@suse.com" date="1749124800">- rename incorrect certificat name revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt
  to revoked-openSUSE-UEFI-SIGN-Certificate-2022-06.crt, and
  re-arrange its sequence.</changelog>
  <changelog author="jlee@suse.com" date="1751976000">- The old shim-16.0.tar.bz2 is repackaged from a local source which
  includes quilt series files. It causes that we can not direct add
  new patch file through shim.spec. I replaced it by shim-16.0 tarball
  from upstream:
  https://github.com/rhboot/shim/releases/download/16.0/shim-16.0.tar.bz2</changelog>
  <changelog author="jlee@suse.com" date="1753444800">- Add shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - shim: change automatically enable MOK_POLICY_REQUIRE_NX (PR #761)
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753444801">- Building out shim.nx.efi for supporting non-executable
  - Building additional shim with POST_PROCESS_PE_FLAGS=-n to set
    the PE NX-compatibility DLL. (NxCompatible field in DllCharacteristics)
  - Packaging shim.nx.efi to shim-nx RPM.
  - Add MS signatures for shim.nx
  - signature-opensuse-nx.x86_64.asc
    signature-sles-nx.x86_64.asc
    signature-opensuse-nx.aarch64.asc
    signature-sles-nx.aarch64.asc
  - We direc copy signatures of shim for shim.nx before we got
    signatures from Microsoft.
- Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753617600">- Add pre script to shim package for checking UEFI db has valid key for shim.
  It prevents that SUSE shim be installed on a machine which can no verify
  and boot with it when secure boot is enabled.
  User can still install shim success when secure boot is disabled even no
  valid key in UEFI db. User should aware that shim can not be boot when
  secure boot is enabled.
  This checking will useful for changing Microsoft or SUSE CA in the future.
  The shim be signed by new MS/SUSE key will NOT be installed on a machine
  which does not have new key in UEFI db when secure boot is enabled. It
  can prevent booting fail after shim package is updated.</changelog>
  <changelog author="jlee@suse.com" date="1753704000">- Removed pre script in shim package for checking UEFI db has valid key
  for shim because it will interrupt group update of RPMs. It should be
  moved to %pretrans and re-written by lua.</changelog>
  <changelog author="jlee@suse.com" date="1753963200">- Add shim-disable-dxe-get-mem-attrs.patch
  - On old edk2-stable202308 ovmf, running dxe_get_mem_attrs() causes
    get_hsi_mem_info() confusion on hsi_status. It looks that hsi_status
    has a copy after running dxe_get_mem_attrs(). Those elements in
    hsi_nx_is_enforced(), HEAPX|STACKX|ROW can NOT set into hsi_status.
    Let's disabling the approach of DXE get memory attributes until
    we found the root cause.
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754136000">- Using gcc13 for building shim/shim-nx
  - The gcc13 can workaround dxe_get_mem_attrs() hsi_status problem
  - Add the following changes to shim.spec :
    define gcc_version 13
    global cc_compiler /usr/bin/gcc-%{gcc_version}
    BuildRequires  gcc%{gcc_version}
    make CC=%{cc_compiler} RELEASE=0
- Remove shim-disable-dxe-get-mem-attrs.patch
  - This downstream patch can be removed after moving to gcc13
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754481600">- Building with the latest version of gcc in the codebase:
  - We prefer that building shim with the latest version of gcc in codebase.
  - Set the minimum version is gcc-13.
    if gcc_version &lt; 13
    define gcc_version 13
    endif
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1755000000">- SLE shim should includes vendor-dbx-sles.esl instead of
  vendor-dbx-opensuse.esl. Fixed it in shim.spec.
    verify='SUSE Linux Enterprise Secure Boot CA1'
-       vendor_dbx='vendor-dbx-opensuse.esl'
  +       vendor_dbx='vendor-dbx-sles.esl'</changelog>
  <changelog author="jlee@suse.com" date="1755604800">- Update to 16.1
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]</changelog>
  <changelog author="jlee@suse.com" date="1755604801">- Removed the following patches because they are merged to shim 16.1:
  - shim-alloc-one-more-byte-for-sprintf.patch
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch</changelog>
</package>
<package pkgid="11e5af655a5b1a51db8539f1a2b212262973ef00ab16f853806b69cca3e398e7" name="shim" arch="src">
  <version epoch="0" ver="16.1" rel="150700.10.9"/>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="glin@suse.com" date="1712059200">- Introduce %shim_use_fde_tpm_helper macro so that the project
  can include the fde-tpm-helper-macros for the build targets
  other than Tumbleweed</changelog>
  <changelog author="dennis.tseng@suse.com" date="1719316800">- Update asc files of shim-15.8 after being signed back from
  Microsoft, including:
  signature-opensuse.x86_64.asc,
  signature-opensuse.aarch64.asc,
  signature-sles.x86_64.asc,
  signature-sles.aarch64.asc.
- Enable aarch64 signature comparison which was disabled temporarily
  before. Now, we got a real one. So it is enabled again.</changelog>
  <changelog author="glin@suse.com" date="1726488000">- Update shim-install to apply the missing fix for openSUSE Leap
  (bsc#1210382)
  * 86b73d1 Fix that bootx64.efi is not updated on Leap
- Update shim-install to use the 'removable' way for SL-Micro
  (bsc#1230316)
  * 433cc4e Always use the removable way for SL-Micro</changelog>
  <changelog author="glin@suse.com" date="1726747200">- Update shim-install to limit the scope of the 'removable'
  SL-Micro to the image booting with TPM2 unsealing (bsc#1210382)
  * 769e41d Limit the removable option to encrypted SL-Micro</changelog>
  <changelog author="mls@suse.de" date="1734696000">- undefine %_enable_debug_packages to fix building with rpm-4.20</changelog>
  <changelog author="dennis.tseng@suse.com" date="1746532800">-- Update to version 16.0
  - remove shim-bsc1177315-verify-eku-codesign.patch
    remove it because shim github upstream has accepted it (PR #664)
  - add revoked-SLES-UEFI-SIGN-Certificate-2022-05.crt to revoked certificates for dbx
    SLES-UEFI-SIGN-Certificate-20220525.crt can be blacklisted,
    and can be added to the vendor dbx.
  - add shim-alloc-one-more-byte-for-sprintf.patch (bsc#1240871)
    The codes already submitted to git upstream (PR #746)
    In generate_sbat_var_defs.c, realloc() should allocate one more byte for
    the end of string '\0' when running sprintf() later.
  - Patches (git log --oneline --reverse 15.8..16.0)
    126a07e Validate that a supplied vendor cert is not in PEM format
    63edf92 sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
    3e1394e sbat: Also bump latest for grub,4 (and to todays date)
    470a8cd undo change that limits certificate files to a single file
    0287c6b shim: don't set second_stage to the empty string
    3685b13 Fix SBAT.md for today's consensus about numbers
    dc07432 Realize the suggestions as part of PR #672
    e064e7d Update Code of Conduct contact address
    e68f4ca make-certs: Handle missing OpenSSL installation
    74a1f29 Update MokVars.txt  - Update documented mirrored variable attributes from RT to BS,RT  - Add missing MokSBStateRT  - Clarify that MokIgnoreDB is a mirror of MokDBState  - Add missing attributes for MokPWStore
    f6674fe export DEFINES for sub makefile
    47bbb5e Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
    338fded Null-terminate 'arguments' in fallback
    3d1dcd4 Fix "Verifiying" typo in error message
    b5d359a CI: use checkout@v4
    1d8365f CI: work around ownership issue on github
    20094ca Update fedora CI targets
    3cf0e09 Force gcc to produce DWARF4 so that gdb can use it
    5f54182 includes: work around CLANG_PREREQ() double-definition
    ab06527 Makefile: don't warn about clang when building compile_commands.json
    0c9249d Suppress some warnings even harder in Cryptlib and OpenSSL.
    fd7e16f Add building compile_commands.json to CI
    314aecf Discard load-options that start with WINDOWS
    ac85ba4 Fix the issue that the gBS-&gt;LoadImage pointer was empty.
    d8c86b7 shim: Allow data after the end of device path node in load options
    d197220 Backport EFI_HTTP_ERROR status code
    6410312 netboot: Convert TFTP error codes to EFI status codes
    ef8e729 httpboot: Convert HTTP status codes to EFI status codes
    2a1cbe6 Update gnu-efi submodule for EFI_HTTP_ERROR
    196cbb9 Increase EFI file alignment
    ad8692e avoid EFIv2 runtime services on Apple x86 machines
    0345331 Improve shortcut performance when comparing two boolean expressions
    27562ea Fix bad reference to PathName in image loading
    1508ece Move is_removable_media_path() to a shared location.
    7864c10 Provide better error message when MokManager is not found
    3e60895 tpm: Boot with a warning if the event log is full
    b560c52 MokManager: remove redundant logical constraints
    9229e7c Make mock_set_variable() correctly account for resource usage.
    f7e1d72 tests: make it possible to use different limits for variable space
    67efdfc test-mok-mirror: refactor the validation of test_mok_mirror_0
    70366a2 test-mok-mirror: add a test case where MokListRT won't fit.
    3caa75e test-mok-mirror: minor bug fix
    dc45aa6 lib/simple_file.c: Allocate zeroed pool for SimpleFS entries
    9415d3c simple_file: Allow to form a volume name from DevicePath
    d6076cb simple_file: Use second variable to create filesystem entries
    f99749a Ignore a minor clang-tidy nit
    98173f0 Fall back to default loader when encountering errors on network boot
    e42c319 test.mk: don't use a temporary random.bin
    c66c157 pe: Enhance debug report for update_mem_attrs
    1125212 Fix leak in error path
    2daf1db Load concatenated EFI_SIGNATURE_LISTs from shim_certificate.efi
    eeca60a Update SbatLevel_Variable.txt with peimage CVE-2024-2312 revocation
    743f3fa Add generate_sbat_var_defs utility program
    5ae408a Generate and use generated_sbat_var_defs.h
    e886fb3 SbatLevel_Variable.txt: clarify where and how revocation data is tracked
    15c1a9a Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
    eb02afc Optionally enabling codesign EKU check in compiling time.
    7ae0ee6 Add docs for ENABLE_CODESIGN_EKU
    38dfa37 Create utils file
    83850cd Add configuration option to boot an alternative 2nd stage
    bb114a3 Implement shim image load protocol
    e7b3598 Move some stuff around
    0322e10 Implement the rest of the loader protocol functions
    e43aea8 Add EFI_LOAD_FILE2_PROTOCOL to gnu-efi
    2bff460 loader-proto: Add support for loading files from disk to LoadImage()
    5d17278 loader-proto: Mark load_image()'s handle_image() call as "in_protocol"
    fe2ad36 Don't print full screen error dialog from handle_image() when called in_protocol
    c57af36 loader-proto: Respect optional DevicePath parameter to load_image()
    2b49dc1 Suppress file open failures for some netboot cases
    3c3295d netboot: process revocations.efi as revocations not shim_certificate
    c66ce2a Allow indepdent SkuSi and SBAT revocation updates
    6b8e40c netboot can try to load shim_certificate_[0..9].efi
    301cf52 Document how revocations can be delivered
    7cde2cc post-process-pe: add tests to validate NX compliance
    1294b47 regression: out of bounds read in CopyMem() in ad8692e
    765f294 compiler.h: minor ALIGN_... fixes
    5c1e6e4 Move error logging decls out of shim.h
    d972515 Save the debug and error logs in mok-variables
    e3f0338 Silence minor nit in load-options parsing debug output
    3d7c057 get_mem_attrs(): ensure an error code is set on failure
    49db3de mok: add MOK_VARIABLE_CONFIG_ONLY
    887c0ed mok variables: add a format callback
    e4857b4 Make test-mok-error failures *slightly* more clear.
    589c3f2 Move memory attribute support to its own file.
    848667d shim: add HSIStatus feature
    e136e64 mock-variables: fix debugging printf format specifier oopsie
    f0958ba test-mock-variables: improve some debug prints
    b216543 Move mok state variable data flag definitions to the header.
    fc0cfac Mirror some more efi variables to mok-variables
    eeda3fa gnu-efi: add some DXE services.
    c41b1f0 Add support for DXE memory attribute updates.
    9269e9b Add DXE Services information to HSI
    c868d54 hexdump: give a different debug log for size==0
    1baf1ef HSI: Add decode_hsi_bits() for easier reading of the debug log
    3bce118 pe: read_header(): allow skipping SecDir content validation
    89e6150 Add shim's current NX_COMPAT status to HSIStatus
    c5c5287 peimage.h: minor whitespace fixes
    5007d83 peimage: add a bunch of comments to read_header()
    489af5e README.tpm: reflect that vendor_db is in fact logged as "vendor_db"
    1958b0f reject message with different values in multiple Content-Length header field
    9c423e0 Some save_logs() improvements.
    81d40e3 Disable log saving for now.
    498b149 fallback: don't add new boot order entries backwards
    06d8dec makefiles: Make GITTAG swizzle tildes to dashes
    f02b2c1 make-archive: some minor housekeeping
    794d237 Update version to 16.0~rc1
    d45c610 SetSecureVariable(): free Cert on failure
    76fab7b generate_sbat_var_defs: run clang-format on readfile()
    6dadb70 generate_sbat_var_defs: Fix memory leak on realloc failure and fd leak.
    f58c77e generate_sbat_var_defs: Ensure revlistentry-&gt;revocations is initialized.
    b427a34 mirror_mok_db(): get rid of an unused variable+allocation
    92630f2 mirror_one_mok_variable(): fix a memory leak on TPM log error.
    38f0a9c mirror_mok_db(): Free our mok variable name correctly
    db04321 shim_load_image(): initialize the buffer fully
    7b75382 simple_dir_filter(): test our 'next' pointer
    db1f1da Make 'make fanalyzer' work again.
    28d8871 README.tpm: Update MokList entry to MokListRT
    8932527 SBAT Level update for February 2025 GRUB CVEs
    18d98bf Update version to 16.0</changelog>
  <changelog author="dennis.tseng@suse.com" date="1748433600">- add revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt into dbx
- build shim with EKU enable flag (ENABLE_CODESIGN_EKU)
  remove EKU enable flag when build MokManager and fallback</changelog>
  <changelog author="dennis.tseng@suse.com" date="1749124800">- rename incorrect certificat name revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt
  to revoked-openSUSE-UEFI-SIGN-Certificate-2022-06.crt, and
  re-arrange its sequence.</changelog>
  <changelog author="jlee@suse.com" date="1751976000">- The old shim-16.0.tar.bz2 is repackaged from a local source which
  includes quilt series files. It causes that we can not direct add
  new patch file through shim.spec. I replaced it by shim-16.0 tarball
  from upstream:
  https://github.com/rhboot/shim/releases/download/16.0/shim-16.0.tar.bz2</changelog>
  <changelog author="jlee@suse.com" date="1753444800">- Add shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - shim: change automatically enable MOK_POLICY_REQUIRE_NX (PR #761)
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753444801">- Building out shim.nx.efi for supporting non-executable
  - Building additional shim with POST_PROCESS_PE_FLAGS=-n to set
    the PE NX-compatibility DLL. (NxCompatible field in DllCharacteristics)
  - Packaging shim.nx.efi to shim-nx RPM.
  - Add MS signatures for shim.nx
  - signature-opensuse-nx.x86_64.asc
    signature-sles-nx.x86_64.asc
    signature-opensuse-nx.aarch64.asc
    signature-sles-nx.aarch64.asc
  - We direc copy signatures of shim for shim.nx before we got
    signatures from Microsoft.
- Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753617600">- Add pre script to shim package for checking UEFI db has valid key for shim.
  It prevents that SUSE shim be installed on a machine which can no verify
  and boot with it when secure boot is enabled.
  User can still install shim success when secure boot is disabled even no
  valid key in UEFI db. User should aware that shim can not be boot when
  secure boot is enabled.
  This checking will useful for changing Microsoft or SUSE CA in the future.
  The shim be signed by new MS/SUSE key will NOT be installed on a machine
  which does not have new key in UEFI db when secure boot is enabled. It
  can prevent booting fail after shim package is updated.</changelog>
  <changelog author="jlee@suse.com" date="1753704000">- Removed pre script in shim package for checking UEFI db has valid key
  for shim because it will interrupt group update of RPMs. It should be
  moved to %pretrans and re-written by lua.</changelog>
  <changelog author="jlee@suse.com" date="1753963200">- Add shim-disable-dxe-get-mem-attrs.patch
  - On old edk2-stable202308 ovmf, running dxe_get_mem_attrs() causes
    get_hsi_mem_info() confusion on hsi_status. It looks that hsi_status
    has a copy after running dxe_get_mem_attrs(). Those elements in
    hsi_nx_is_enforced(), HEAPX|STACKX|ROW can NOT set into hsi_status.
    Let's disabling the approach of DXE get memory attributes until
    we found the root cause.
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754136000">- Using gcc13 for building shim/shim-nx
  - The gcc13 can workaround dxe_get_mem_attrs() hsi_status problem
  - Add the following changes to shim.spec :
    define gcc_version 13
    global cc_compiler /usr/bin/gcc-%{gcc_version}
    BuildRequires  gcc%{gcc_version}
    make CC=%{cc_compiler} RELEASE=0
- Remove shim-disable-dxe-get-mem-attrs.patch
  - This downstream patch can be removed after moving to gcc13
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754481600">- Building with the latest version of gcc in the codebase:
  - We prefer that building shim with the latest version of gcc in codebase.
  - Set the minimum version is gcc-13.
    if gcc_version &lt; 13
    define gcc_version 13
    endif
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1755000000">- SLE shim should includes vendor-dbx-sles.esl instead of
  vendor-dbx-opensuse.esl. Fixed it in shim.spec.
    verify='SUSE Linux Enterprise Secure Boot CA1'
-       vendor_dbx='vendor-dbx-opensuse.esl'
  +       vendor_dbx='vendor-dbx-sles.esl'</changelog>
  <changelog author="jlee@suse.com" date="1755604800">- Update to 16.1
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]</changelog>
  <changelog author="jlee@suse.com" date="1755604801">- Removed the following patches because they are merged to shim 16.1:
  - shim-alloc-one-more-byte-for-sprintf.patch
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch</changelog>
</package>
<package pkgid="c0d356b17d969da84f5137326b6ff21f443e5c8185cc4c131d8d29be1a952595" name="shim" arch="x86_64">
  <version epoch="0" ver="16.1" rel="150700.10.9"/>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="glin@suse.com" date="1712059200">- Introduce %shim_use_fde_tpm_helper macro so that the project
  can include the fde-tpm-helper-macros for the build targets
  other than Tumbleweed</changelog>
  <changelog author="dennis.tseng@suse.com" date="1719316800">- Update asc files of shim-15.8 after being signed back from
  Microsoft, including:
  signature-opensuse.x86_64.asc,
  signature-opensuse.aarch64.asc,
  signature-sles.x86_64.asc,
  signature-sles.aarch64.asc.
- Enable aarch64 signature comparison which was disabled temporarily
  before. Now, we got a real one. So it is enabled again.</changelog>
  <changelog author="glin@suse.com" date="1726488000">- Update shim-install to apply the missing fix for openSUSE Leap
  (bsc#1210382)
  * 86b73d1 Fix that bootx64.efi is not updated on Leap
- Update shim-install to use the 'removable' way for SL-Micro
  (bsc#1230316)
  * 433cc4e Always use the removable way for SL-Micro</changelog>
  <changelog author="glin@suse.com" date="1726747200">- Update shim-install to limit the scope of the 'removable'
  SL-Micro to the image booting with TPM2 unsealing (bsc#1210382)
  * 769e41d Limit the removable option to encrypted SL-Micro</changelog>
  <changelog author="mls@suse.de" date="1734696000">- undefine %_enable_debug_packages to fix building with rpm-4.20</changelog>
  <changelog author="dennis.tseng@suse.com" date="1746532800">-- Update to version 16.0
  - remove shim-bsc1177315-verify-eku-codesign.patch
    remove it because shim github upstream has accepted it (PR #664)
  - add revoked-SLES-UEFI-SIGN-Certificate-2022-05.crt to revoked certificates for dbx
    SLES-UEFI-SIGN-Certificate-20220525.crt can be blacklisted,
    and can be added to the vendor dbx.
  - add shim-alloc-one-more-byte-for-sprintf.patch (bsc#1240871)
    The codes already submitted to git upstream (PR #746)
    In generate_sbat_var_defs.c, realloc() should allocate one more byte for
    the end of string '\0' when running sprintf() later.
  - Patches (git log --oneline --reverse 15.8..16.0)
    126a07e Validate that a supplied vendor cert is not in PEM format
    63edf92 sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
    3e1394e sbat: Also bump latest for grub,4 (and to todays date)
    470a8cd undo change that limits certificate files to a single file
    0287c6b shim: don't set second_stage to the empty string
    3685b13 Fix SBAT.md for today's consensus about numbers
    dc07432 Realize the suggestions as part of PR #672
    e064e7d Update Code of Conduct contact address
    e68f4ca make-certs: Handle missing OpenSSL installation
    74a1f29 Update MokVars.txt  - Update documented mirrored variable attributes from RT to BS,RT  - Add missing MokSBStateRT  - Clarify that MokIgnoreDB is a mirror of MokDBState  - Add missing attributes for MokPWStore
    f6674fe export DEFINES for sub makefile
    47bbb5e Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
    338fded Null-terminate 'arguments' in fallback
    3d1dcd4 Fix "Verifiying" typo in error message
    b5d359a CI: use checkout@v4
    1d8365f CI: work around ownership issue on github
    20094ca Update fedora CI targets
    3cf0e09 Force gcc to produce DWARF4 so that gdb can use it
    5f54182 includes: work around CLANG_PREREQ() double-definition
    ab06527 Makefile: don't warn about clang when building compile_commands.json
    0c9249d Suppress some warnings even harder in Cryptlib and OpenSSL.
    fd7e16f Add building compile_commands.json to CI
    314aecf Discard load-options that start with WINDOWS
    ac85ba4 Fix the issue that the gBS-&gt;LoadImage pointer was empty.
    d8c86b7 shim: Allow data after the end of device path node in load options
    d197220 Backport EFI_HTTP_ERROR status code
    6410312 netboot: Convert TFTP error codes to EFI status codes
    ef8e729 httpboot: Convert HTTP status codes to EFI status codes
    2a1cbe6 Update gnu-efi submodule for EFI_HTTP_ERROR
    196cbb9 Increase EFI file alignment
    ad8692e avoid EFIv2 runtime services on Apple x86 machines
    0345331 Improve shortcut performance when comparing two boolean expressions
    27562ea Fix bad reference to PathName in image loading
    1508ece Move is_removable_media_path() to a shared location.
    7864c10 Provide better error message when MokManager is not found
    3e60895 tpm: Boot with a warning if the event log is full
    b560c52 MokManager: remove redundant logical constraints
    9229e7c Make mock_set_variable() correctly account for resource usage.
    f7e1d72 tests: make it possible to use different limits for variable space
    67efdfc test-mok-mirror: refactor the validation of test_mok_mirror_0
    70366a2 test-mok-mirror: add a test case where MokListRT won't fit.
    3caa75e test-mok-mirror: minor bug fix
    dc45aa6 lib/simple_file.c: Allocate zeroed pool for SimpleFS entries
    9415d3c simple_file: Allow to form a volume name from DevicePath
    d6076cb simple_file: Use second variable to create filesystem entries
    f99749a Ignore a minor clang-tidy nit
    98173f0 Fall back to default loader when encountering errors on network boot
    e42c319 test.mk: don't use a temporary random.bin
    c66c157 pe: Enhance debug report for update_mem_attrs
    1125212 Fix leak in error path
    2daf1db Load concatenated EFI_SIGNATURE_LISTs from shim_certificate.efi
    eeca60a Update SbatLevel_Variable.txt with peimage CVE-2024-2312 revocation
    743f3fa Add generate_sbat_var_defs utility program
    5ae408a Generate and use generated_sbat_var_defs.h
    e886fb3 SbatLevel_Variable.txt: clarify where and how revocation data is tracked
    15c1a9a Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
    eb02afc Optionally enabling codesign EKU check in compiling time.
    7ae0ee6 Add docs for ENABLE_CODESIGN_EKU
    38dfa37 Create utils file
    83850cd Add configuration option to boot an alternative 2nd stage
    bb114a3 Implement shim image load protocol
    e7b3598 Move some stuff around
    0322e10 Implement the rest of the loader protocol functions
    e43aea8 Add EFI_LOAD_FILE2_PROTOCOL to gnu-efi
    2bff460 loader-proto: Add support for loading files from disk to LoadImage()
    5d17278 loader-proto: Mark load_image()'s handle_image() call as "in_protocol"
    fe2ad36 Don't print full screen error dialog from handle_image() when called in_protocol
    c57af36 loader-proto: Respect optional DevicePath parameter to load_image()
    2b49dc1 Suppress file open failures for some netboot cases
    3c3295d netboot: process revocations.efi as revocations not shim_certificate
    c66ce2a Allow indepdent SkuSi and SBAT revocation updates
    6b8e40c netboot can try to load shim_certificate_[0..9].efi
    301cf52 Document how revocations can be delivered
    7cde2cc post-process-pe: add tests to validate NX compliance
    1294b47 regression: out of bounds read in CopyMem() in ad8692e
    765f294 compiler.h: minor ALIGN_... fixes
    5c1e6e4 Move error logging decls out of shim.h
    d972515 Save the debug and error logs in mok-variables
    e3f0338 Silence minor nit in load-options parsing debug output
    3d7c057 get_mem_attrs(): ensure an error code is set on failure
    49db3de mok: add MOK_VARIABLE_CONFIG_ONLY
    887c0ed mok variables: add a format callback
    e4857b4 Make test-mok-error failures *slightly* more clear.
    589c3f2 Move memory attribute support to its own file.
    848667d shim: add HSIStatus feature
    e136e64 mock-variables: fix debugging printf format specifier oopsie
    f0958ba test-mock-variables: improve some debug prints
    b216543 Move mok state variable data flag definitions to the header.
    fc0cfac Mirror some more efi variables to mok-variables
    eeda3fa gnu-efi: add some DXE services.
    c41b1f0 Add support for DXE memory attribute updates.
    9269e9b Add DXE Services information to HSI
    c868d54 hexdump: give a different debug log for size==0
    1baf1ef HSI: Add decode_hsi_bits() for easier reading of the debug log
    3bce118 pe: read_header(): allow skipping SecDir content validation
    89e6150 Add shim's current NX_COMPAT status to HSIStatus
    c5c5287 peimage.h: minor whitespace fixes
    5007d83 peimage: add a bunch of comments to read_header()
    489af5e README.tpm: reflect that vendor_db is in fact logged as "vendor_db"
    1958b0f reject message with different values in multiple Content-Length header field
    9c423e0 Some save_logs() improvements.
    81d40e3 Disable log saving for now.
    498b149 fallback: don't add new boot order entries backwards
    06d8dec makefiles: Make GITTAG swizzle tildes to dashes
    f02b2c1 make-archive: some minor housekeeping
    794d237 Update version to 16.0~rc1
    d45c610 SetSecureVariable(): free Cert on failure
    76fab7b generate_sbat_var_defs: run clang-format on readfile()
    6dadb70 generate_sbat_var_defs: Fix memory leak on realloc failure and fd leak.
    f58c77e generate_sbat_var_defs: Ensure revlistentry-&gt;revocations is initialized.
    b427a34 mirror_mok_db(): get rid of an unused variable+allocation
    92630f2 mirror_one_mok_variable(): fix a memory leak on TPM log error.
    38f0a9c mirror_mok_db(): Free our mok variable name correctly
    db04321 shim_load_image(): initialize the buffer fully
    7b75382 simple_dir_filter(): test our 'next' pointer
    db1f1da Make 'make fanalyzer' work again.
    28d8871 README.tpm: Update MokList entry to MokListRT
    8932527 SBAT Level update for February 2025 GRUB CVEs
    18d98bf Update version to 16.0</changelog>
  <changelog author="dennis.tseng@suse.com" date="1748433600">- add revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt into dbx
- build shim with EKU enable flag (ENABLE_CODESIGN_EKU)
  remove EKU enable flag when build MokManager and fallback</changelog>
  <changelog author="dennis.tseng@suse.com" date="1749124800">- rename incorrect certificat name revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt
  to revoked-openSUSE-UEFI-SIGN-Certificate-2022-06.crt, and
  re-arrange its sequence.</changelog>
  <changelog author="jlee@suse.com" date="1751976000">- The old shim-16.0.tar.bz2 is repackaged from a local source which
  includes quilt series files. It causes that we can not direct add
  new patch file through shim.spec. I replaced it by shim-16.0 tarball
  from upstream:
  https://github.com/rhboot/shim/releases/download/16.0/shim-16.0.tar.bz2</changelog>
  <changelog author="jlee@suse.com" date="1753444800">- Add shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - shim: change automatically enable MOK_POLICY_REQUIRE_NX (PR #761)
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753444801">- Building out shim.nx.efi for supporting non-executable
  - Building additional shim with POST_PROCESS_PE_FLAGS=-n to set
    the PE NX-compatibility DLL. (NxCompatible field in DllCharacteristics)
  - Packaging shim.nx.efi to shim-nx RPM.
  - Add MS signatures for shim.nx
  - signature-opensuse-nx.x86_64.asc
    signature-sles-nx.x86_64.asc
    signature-opensuse-nx.aarch64.asc
    signature-sles-nx.aarch64.asc
  - We direc copy signatures of shim for shim.nx before we got
    signatures from Microsoft.
- Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753617600">- Add pre script to shim package for checking UEFI db has valid key for shim.
  It prevents that SUSE shim be installed on a machine which can no verify
  and boot with it when secure boot is enabled.
  User can still install shim success when secure boot is disabled even no
  valid key in UEFI db. User should aware that shim can not be boot when
  secure boot is enabled.
  This checking will useful for changing Microsoft or SUSE CA in the future.
  The shim be signed by new MS/SUSE key will NOT be installed on a machine
  which does not have new key in UEFI db when secure boot is enabled. It
  can prevent booting fail after shim package is updated.</changelog>
  <changelog author="jlee@suse.com" date="1753704000">- Removed pre script in shim package for checking UEFI db has valid key
  for shim because it will interrupt group update of RPMs. It should be
  moved to %pretrans and re-written by lua.</changelog>
  <changelog author="jlee@suse.com" date="1753963200">- Add shim-disable-dxe-get-mem-attrs.patch
  - On old edk2-stable202308 ovmf, running dxe_get_mem_attrs() causes
    get_hsi_mem_info() confusion on hsi_status. It looks that hsi_status
    has a copy after running dxe_get_mem_attrs(). Those elements in
    hsi_nx_is_enforced(), HEAPX|STACKX|ROW can NOT set into hsi_status.
    Let's disabling the approach of DXE get memory attributes until
    we found the root cause.
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754136000">- Using gcc13 for building shim/shim-nx
  - The gcc13 can workaround dxe_get_mem_attrs() hsi_status problem
  - Add the following changes to shim.spec :
    define gcc_version 13
    global cc_compiler /usr/bin/gcc-%{gcc_version}
    BuildRequires  gcc%{gcc_version}
    make CC=%{cc_compiler} RELEASE=0
- Remove shim-disable-dxe-get-mem-attrs.patch
  - This downstream patch can be removed after moving to gcc13
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754481600">- Building with the latest version of gcc in the codebase:
  - We prefer that building shim with the latest version of gcc in codebase.
  - Set the minimum version is gcc-13.
    if gcc_version &lt; 13
    define gcc_version 13
    endif
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1755000000">- SLE shim should includes vendor-dbx-sles.esl instead of
  vendor-dbx-opensuse.esl. Fixed it in shim.spec.
    verify='SUSE Linux Enterprise Secure Boot CA1'
-       vendor_dbx='vendor-dbx-opensuse.esl'
  +       vendor_dbx='vendor-dbx-sles.esl'</changelog>
  <changelog author="jlee@suse.com" date="1755604800">- Update to 16.1
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]</changelog>
  <changelog author="jlee@suse.com" date="1755604801">- Removed the following patches because they are merged to shim 16.1:
  - shim-alloc-one-more-byte-for-sprintf.patch
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch</changelog>
</package>
<package pkgid="6d723fe5dc9182c7c285afe0a92344c3ecbe3755e8778e1315e5f598f9677e21" name="shim-certificate" arch="aarch64">
  <version epoch="0" ver="git20240117.c443a5fa7210" rel="150700.11.9"/>
  <changelog author="jlee@suse.com" date="1746705600">- Add certwrapper+git20240117.c443a5fa7210.tar.bz2
  - This is a repackaged tarball from the zip file on certwrapper
    project on github:
    https://github.com/rhboot/certwrapper
  - The latest commit in this tarball is:
    commit c443a5fa7210f2dcd12e2b0825e70fda16592d4e
    Author: Peter Jones &lt;pjones@redhat.com&gt;
    Date:   Wed Jan 17 14:25:32 2024 -0500
    Update github actions to newer versions
- Add gnu-efi-shim-15.6.tar.bz2
  - This tarball is from the gnu-efi project on github:
    https://github.com/rhboot/gnu-efi
  - The reason is that certwrapper is using the shim-15.6
    branch of gnu-efi. The patch commit in certwrapper is:
    commit aa095d682501b1c5e8332f39aa3958f255fb5737
    Author: Peter Jones &lt;pjones@redhat.com&gt;
    Date:   Wed May 25 13:37:25 2022 -0400
    Add gnu-efi as a submodule
- The generated shim-certificate.efi will be copied to /boot/efi/EFI/boot/
  and /boot/efi/EFI/sles/, or /boot/efi/EFI/opensuse/. The shim.efi
  or bootx64.efi will load shim-certificate.efi to update SbatLevel variable
  in NVRAM for blocking old grub2.</changelog>
  <changelog author="jlee@suse.com" date="1747828800">- Add SLES-UEFI-SIGN-Certificate-2048.crt to db.esl</changelog>
  <changelog author="jlee@suse.com" date="1747828801">- Rename certwrapper result file to shim_certificate.efi because
  shim expects this file name.</changelog>
</package>
<package pkgid="4b56489a11e039056667e2bcdfde4267c217d59b3007cd8e2ded8ab1aaea6722" name="shim-certificate" arch="src">
  <version epoch="0" ver="git20240117.c443a5fa7210" rel="150700.11.9"/>
  <changelog author="jlee@suse.com" date="1746705600">- Add certwrapper+git20240117.c443a5fa7210.tar.bz2
  - This is a repackaged tarball from the zip file on certwrapper
    project on github:
    https://github.com/rhboot/certwrapper
  - The latest commit in this tarball is:
    commit c443a5fa7210f2dcd12e2b0825e70fda16592d4e
    Author: Peter Jones &lt;pjones@redhat.com&gt;
    Date:   Wed Jan 17 14:25:32 2024 -0500
    Update github actions to newer versions
- Add gnu-efi-shim-15.6.tar.bz2
  - This tarball is from the gnu-efi project on github:
    https://github.com/rhboot/gnu-efi
  - The reason is that certwrapper is using the shim-15.6
    branch of gnu-efi. The patch commit in certwrapper is:
    commit aa095d682501b1c5e8332f39aa3958f255fb5737
    Author: Peter Jones &lt;pjones@redhat.com&gt;
    Date:   Wed May 25 13:37:25 2022 -0400
    Add gnu-efi as a submodule
- The generated shim-certificate.efi will be copied to /boot/efi/EFI/boot/
  and /boot/efi/EFI/sles/, or /boot/efi/EFI/opensuse/. The shim.efi
  or bootx64.efi will load shim-certificate.efi to update SbatLevel variable
  in NVRAM for blocking old grub2.</changelog>
  <changelog author="jlee@suse.com" date="1747828800">- Add SLES-UEFI-SIGN-Certificate-2048.crt to db.esl</changelog>
  <changelog author="jlee@suse.com" date="1747828801">- Rename certwrapper result file to shim_certificate.efi because
  shim expects this file name.</changelog>
</package>
<package pkgid="5f65064b2a34a66e2e1dccbbfdd911afe8e1dd4ce9ebd5adb52d54068216ba62" name="shim-certificate" arch="x86_64">
  <version epoch="0" ver="git20240117.c443a5fa7210" rel="150700.11.9"/>
  <changelog author="jlee@suse.com" date="1746705600">- Add certwrapper+git20240117.c443a5fa7210.tar.bz2
  - This is a repackaged tarball from the zip file on certwrapper
    project on github:
    https://github.com/rhboot/certwrapper
  - The latest commit in this tarball is:
    commit c443a5fa7210f2dcd12e2b0825e70fda16592d4e
    Author: Peter Jones &lt;pjones@redhat.com&gt;
    Date:   Wed Jan 17 14:25:32 2024 -0500
    Update github actions to newer versions
- Add gnu-efi-shim-15.6.tar.bz2
  - This tarball is from the gnu-efi project on github:
    https://github.com/rhboot/gnu-efi
  - The reason is that certwrapper is using the shim-15.6
    branch of gnu-efi. The patch commit in certwrapper is:
    commit aa095d682501b1c5e8332f39aa3958f255fb5737
    Author: Peter Jones &lt;pjones@redhat.com&gt;
    Date:   Wed May 25 13:37:25 2022 -0400
    Add gnu-efi as a submodule
- The generated shim-certificate.efi will be copied to /boot/efi/EFI/boot/
  and /boot/efi/EFI/sles/, or /boot/efi/EFI/opensuse/. The shim.efi
  or bootx64.efi will load shim-certificate.efi to update SbatLevel variable
  in NVRAM for blocking old grub2.</changelog>
  <changelog author="jlee@suse.com" date="1747828800">- Add SLES-UEFI-SIGN-Certificate-2048.crt to db.esl</changelog>
  <changelog author="jlee@suse.com" date="1747828801">- Rename certwrapper result file to shim_certificate.efi because
  shim expects this file name.</changelog>
</package>
<package pkgid="dbfca221f9452219af066b29e916b547a2a8f85180496b83800fe1434f6aaaeb" name="shim-debuginfo" arch="aarch64">
  <version epoch="0" ver="16.1" rel="150700.10.9"/>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="glin@suse.com" date="1712059200">- Introduce %shim_use_fde_tpm_helper macro so that the project
  can include the fde-tpm-helper-macros for the build targets
  other than Tumbleweed</changelog>
  <changelog author="dennis.tseng@suse.com" date="1719316800">- Update asc files of shim-15.8 after being signed back from
  Microsoft, including:
  signature-opensuse.x86_64.asc,
  signature-opensuse.aarch64.asc,
  signature-sles.x86_64.asc,
  signature-sles.aarch64.asc.
- Enable aarch64 signature comparison which was disabled temporarily
  before. Now, we got a real one. So it is enabled again.</changelog>
  <changelog author="glin@suse.com" date="1726488000">- Update shim-install to apply the missing fix for openSUSE Leap
  (bsc#1210382)
  * 86b73d1 Fix that bootx64.efi is not updated on Leap
- Update shim-install to use the 'removable' way for SL-Micro
  (bsc#1230316)
  * 433cc4e Always use the removable way for SL-Micro</changelog>
  <changelog author="glin@suse.com" date="1726747200">- Update shim-install to limit the scope of the 'removable'
  SL-Micro to the image booting with TPM2 unsealing (bsc#1210382)
  * 769e41d Limit the removable option to encrypted SL-Micro</changelog>
  <changelog author="mls@suse.de" date="1734696000">- undefine %_enable_debug_packages to fix building with rpm-4.20</changelog>
  <changelog author="dennis.tseng@suse.com" date="1746532800">-- Update to version 16.0
  - remove shim-bsc1177315-verify-eku-codesign.patch
    remove it because shim github upstream has accepted it (PR #664)
  - add revoked-SLES-UEFI-SIGN-Certificate-2022-05.crt to revoked certificates for dbx
    SLES-UEFI-SIGN-Certificate-20220525.crt can be blacklisted,
    and can be added to the vendor dbx.
  - add shim-alloc-one-more-byte-for-sprintf.patch (bsc#1240871)
    The codes already submitted to git upstream (PR #746)
    In generate_sbat_var_defs.c, realloc() should allocate one more byte for
    the end of string '\0' when running sprintf() later.
  - Patches (git log --oneline --reverse 15.8..16.0)
    126a07e Validate that a supplied vendor cert is not in PEM format
    63edf92 sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
    3e1394e sbat: Also bump latest for grub,4 (and to todays date)
    470a8cd undo change that limits certificate files to a single file
    0287c6b shim: don't set second_stage to the empty string
    3685b13 Fix SBAT.md for today's consensus about numbers
    dc07432 Realize the suggestions as part of PR #672
    e064e7d Update Code of Conduct contact address
    e68f4ca make-certs: Handle missing OpenSSL installation
    74a1f29 Update MokVars.txt  - Update documented mirrored variable attributes from RT to BS,RT  - Add missing MokSBStateRT  - Clarify that MokIgnoreDB is a mirror of MokDBState  - Add missing attributes for MokPWStore
    f6674fe export DEFINES for sub makefile
    47bbb5e Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
    338fded Null-terminate 'arguments' in fallback
    3d1dcd4 Fix "Verifiying" typo in error message
    b5d359a CI: use checkout@v4
    1d8365f CI: work around ownership issue on github
    20094ca Update fedora CI targets
    3cf0e09 Force gcc to produce DWARF4 so that gdb can use it
    5f54182 includes: work around CLANG_PREREQ() double-definition
    ab06527 Makefile: don't warn about clang when building compile_commands.json
    0c9249d Suppress some warnings even harder in Cryptlib and OpenSSL.
    fd7e16f Add building compile_commands.json to CI
    314aecf Discard load-options that start with WINDOWS
    ac85ba4 Fix the issue that the gBS-&gt;LoadImage pointer was empty.
    d8c86b7 shim: Allow data after the end of device path node in load options
    d197220 Backport EFI_HTTP_ERROR status code
    6410312 netboot: Convert TFTP error codes to EFI status codes
    ef8e729 httpboot: Convert HTTP status codes to EFI status codes
    2a1cbe6 Update gnu-efi submodule for EFI_HTTP_ERROR
    196cbb9 Increase EFI file alignment
    ad8692e avoid EFIv2 runtime services on Apple x86 machines
    0345331 Improve shortcut performance when comparing two boolean expressions
    27562ea Fix bad reference to PathName in image loading
    1508ece Move is_removable_media_path() to a shared location.
    7864c10 Provide better error message when MokManager is not found
    3e60895 tpm: Boot with a warning if the event log is full
    b560c52 MokManager: remove redundant logical constraints
    9229e7c Make mock_set_variable() correctly account for resource usage.
    f7e1d72 tests: make it possible to use different limits for variable space
    67efdfc test-mok-mirror: refactor the validation of test_mok_mirror_0
    70366a2 test-mok-mirror: add a test case where MokListRT won't fit.
    3caa75e test-mok-mirror: minor bug fix
    dc45aa6 lib/simple_file.c: Allocate zeroed pool for SimpleFS entries
    9415d3c simple_file: Allow to form a volume name from DevicePath
    d6076cb simple_file: Use second variable to create filesystem entries
    f99749a Ignore a minor clang-tidy nit
    98173f0 Fall back to default loader when encountering errors on network boot
    e42c319 test.mk: don't use a temporary random.bin
    c66c157 pe: Enhance debug report for update_mem_attrs
    1125212 Fix leak in error path
    2daf1db Load concatenated EFI_SIGNATURE_LISTs from shim_certificate.efi
    eeca60a Update SbatLevel_Variable.txt with peimage CVE-2024-2312 revocation
    743f3fa Add generate_sbat_var_defs utility program
    5ae408a Generate and use generated_sbat_var_defs.h
    e886fb3 SbatLevel_Variable.txt: clarify where and how revocation data is tracked
    15c1a9a Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
    eb02afc Optionally enabling codesign EKU check in compiling time.
    7ae0ee6 Add docs for ENABLE_CODESIGN_EKU
    38dfa37 Create utils file
    83850cd Add configuration option to boot an alternative 2nd stage
    bb114a3 Implement shim image load protocol
    e7b3598 Move some stuff around
    0322e10 Implement the rest of the loader protocol functions
    e43aea8 Add EFI_LOAD_FILE2_PROTOCOL to gnu-efi
    2bff460 loader-proto: Add support for loading files from disk to LoadImage()
    5d17278 loader-proto: Mark load_image()'s handle_image() call as "in_protocol"
    fe2ad36 Don't print full screen error dialog from handle_image() when called in_protocol
    c57af36 loader-proto: Respect optional DevicePath parameter to load_image()
    2b49dc1 Suppress file open failures for some netboot cases
    3c3295d netboot: process revocations.efi as revocations not shim_certificate
    c66ce2a Allow indepdent SkuSi and SBAT revocation updates
    6b8e40c netboot can try to load shim_certificate_[0..9].efi
    301cf52 Document how revocations can be delivered
    7cde2cc post-process-pe: add tests to validate NX compliance
    1294b47 regression: out of bounds read in CopyMem() in ad8692e
    765f294 compiler.h: minor ALIGN_... fixes
    5c1e6e4 Move error logging decls out of shim.h
    d972515 Save the debug and error logs in mok-variables
    e3f0338 Silence minor nit in load-options parsing debug output
    3d7c057 get_mem_attrs(): ensure an error code is set on failure
    49db3de mok: add MOK_VARIABLE_CONFIG_ONLY
    887c0ed mok variables: add a format callback
    e4857b4 Make test-mok-error failures *slightly* more clear.
    589c3f2 Move memory attribute support to its own file.
    848667d shim: add HSIStatus feature
    e136e64 mock-variables: fix debugging printf format specifier oopsie
    f0958ba test-mock-variables: improve some debug prints
    b216543 Move mok state variable data flag definitions to the header.
    fc0cfac Mirror some more efi variables to mok-variables
    eeda3fa gnu-efi: add some DXE services.
    c41b1f0 Add support for DXE memory attribute updates.
    9269e9b Add DXE Services information to HSI
    c868d54 hexdump: give a different debug log for size==0
    1baf1ef HSI: Add decode_hsi_bits() for easier reading of the debug log
    3bce118 pe: read_header(): allow skipping SecDir content validation
    89e6150 Add shim's current NX_COMPAT status to HSIStatus
    c5c5287 peimage.h: minor whitespace fixes
    5007d83 peimage: add a bunch of comments to read_header()
    489af5e README.tpm: reflect that vendor_db is in fact logged as "vendor_db"
    1958b0f reject message with different values in multiple Content-Length header field
    9c423e0 Some save_logs() improvements.
    81d40e3 Disable log saving for now.
    498b149 fallback: don't add new boot order entries backwards
    06d8dec makefiles: Make GITTAG swizzle tildes to dashes
    f02b2c1 make-archive: some minor housekeeping
    794d237 Update version to 16.0~rc1
    d45c610 SetSecureVariable(): free Cert on failure
    76fab7b generate_sbat_var_defs: run clang-format on readfile()
    6dadb70 generate_sbat_var_defs: Fix memory leak on realloc failure and fd leak.
    f58c77e generate_sbat_var_defs: Ensure revlistentry-&gt;revocations is initialized.
    b427a34 mirror_mok_db(): get rid of an unused variable+allocation
    92630f2 mirror_one_mok_variable(): fix a memory leak on TPM log error.
    38f0a9c mirror_mok_db(): Free our mok variable name correctly
    db04321 shim_load_image(): initialize the buffer fully
    7b75382 simple_dir_filter(): test our 'next' pointer
    db1f1da Make 'make fanalyzer' work again.
    28d8871 README.tpm: Update MokList entry to MokListRT
    8932527 SBAT Level update for February 2025 GRUB CVEs
    18d98bf Update version to 16.0</changelog>
  <changelog author="dennis.tseng@suse.com" date="1748433600">- add revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt into dbx
- build shim with EKU enable flag (ENABLE_CODESIGN_EKU)
  remove EKU enable flag when build MokManager and fallback</changelog>
  <changelog author="dennis.tseng@suse.com" date="1749124800">- rename incorrect certificat name revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt
  to revoked-openSUSE-UEFI-SIGN-Certificate-2022-06.crt, and
  re-arrange its sequence.</changelog>
  <changelog author="jlee@suse.com" date="1751976000">- The old shim-16.0.tar.bz2 is repackaged from a local source which
  includes quilt series files. It causes that we can not direct add
  new patch file through shim.spec. I replaced it by shim-16.0 tarball
  from upstream:
  https://github.com/rhboot/shim/releases/download/16.0/shim-16.0.tar.bz2</changelog>
  <changelog author="jlee@suse.com" date="1753444800">- Add shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - shim: change automatically enable MOK_POLICY_REQUIRE_NX (PR #761)
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753444801">- Building out shim.nx.efi for supporting non-executable
  - Building additional shim with POST_PROCESS_PE_FLAGS=-n to set
    the PE NX-compatibility DLL. (NxCompatible field in DllCharacteristics)
  - Packaging shim.nx.efi to shim-nx RPM.
  - Add MS signatures for shim.nx
  - signature-opensuse-nx.x86_64.asc
    signature-sles-nx.x86_64.asc
    signature-opensuse-nx.aarch64.asc
    signature-sles-nx.aarch64.asc
  - We direc copy signatures of shim for shim.nx before we got
    signatures from Microsoft.
- Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753617600">- Add pre script to shim package for checking UEFI db has valid key for shim.
  It prevents that SUSE shim be installed on a machine which can no verify
  and boot with it when secure boot is enabled.
  User can still install shim success when secure boot is disabled even no
  valid key in UEFI db. User should aware that shim can not be boot when
  secure boot is enabled.
  This checking will useful for changing Microsoft or SUSE CA in the future.
  The shim be signed by new MS/SUSE key will NOT be installed on a machine
  which does not have new key in UEFI db when secure boot is enabled. It
  can prevent booting fail after shim package is updated.</changelog>
  <changelog author="jlee@suse.com" date="1753704000">- Removed pre script in shim package for checking UEFI db has valid key
  for shim because it will interrupt group update of RPMs. It should be
  moved to %pretrans and re-written by lua.</changelog>
  <changelog author="jlee@suse.com" date="1753963200">- Add shim-disable-dxe-get-mem-attrs.patch
  - On old edk2-stable202308 ovmf, running dxe_get_mem_attrs() causes
    get_hsi_mem_info() confusion on hsi_status. It looks that hsi_status
    has a copy after running dxe_get_mem_attrs(). Those elements in
    hsi_nx_is_enforced(), HEAPX|STACKX|ROW can NOT set into hsi_status.
    Let's disabling the approach of DXE get memory attributes until
    we found the root cause.
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754136000">- Using gcc13 for building shim/shim-nx
  - The gcc13 can workaround dxe_get_mem_attrs() hsi_status problem
  - Add the following changes to shim.spec :
    define gcc_version 13
    global cc_compiler /usr/bin/gcc-%{gcc_version}
    BuildRequires  gcc%{gcc_version}
    make CC=%{cc_compiler} RELEASE=0
- Remove shim-disable-dxe-get-mem-attrs.patch
  - This downstream patch can be removed after moving to gcc13
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754481600">- Building with the latest version of gcc in the codebase:
  - We prefer that building shim with the latest version of gcc in codebase.
  - Set the minimum version is gcc-13.
    if gcc_version &lt; 13
    define gcc_version 13
    endif
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1755000000">- SLE shim should includes vendor-dbx-sles.esl instead of
  vendor-dbx-opensuse.esl. Fixed it in shim.spec.
    verify='SUSE Linux Enterprise Secure Boot CA1'
-       vendor_dbx='vendor-dbx-opensuse.esl'
  +       vendor_dbx='vendor-dbx-sles.esl'</changelog>
  <changelog author="jlee@suse.com" date="1755604800">- Update to 16.1
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]</changelog>
  <changelog author="jlee@suse.com" date="1755604801">- Removed the following patches because they are merged to shim 16.1:
  - shim-alloc-one-more-byte-for-sprintf.patch
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch</changelog>
</package>
<package pkgid="a7d87d19ac204ec9637bcc171f96ca8a109609249a6c03e4054d66d7a9faf5fe" name="shim-debuginfo" arch="x86_64">
  <version epoch="0" ver="16.1" rel="150700.10.9"/>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="glin@suse.com" date="1712059200">- Introduce %shim_use_fde_tpm_helper macro so that the project
  can include the fde-tpm-helper-macros for the build targets
  other than Tumbleweed</changelog>
  <changelog author="dennis.tseng@suse.com" date="1719316800">- Update asc files of shim-15.8 after being signed back from
  Microsoft, including:
  signature-opensuse.x86_64.asc,
  signature-opensuse.aarch64.asc,
  signature-sles.x86_64.asc,
  signature-sles.aarch64.asc.
- Enable aarch64 signature comparison which was disabled temporarily
  before. Now, we got a real one. So it is enabled again.</changelog>
  <changelog author="glin@suse.com" date="1726488000">- Update shim-install to apply the missing fix for openSUSE Leap
  (bsc#1210382)
  * 86b73d1 Fix that bootx64.efi is not updated on Leap
- Update shim-install to use the 'removable' way for SL-Micro
  (bsc#1230316)
  * 433cc4e Always use the removable way for SL-Micro</changelog>
  <changelog author="glin@suse.com" date="1726747200">- Update shim-install to limit the scope of the 'removable'
  SL-Micro to the image booting with TPM2 unsealing (bsc#1210382)
  * 769e41d Limit the removable option to encrypted SL-Micro</changelog>
  <changelog author="mls@suse.de" date="1734696000">- undefine %_enable_debug_packages to fix building with rpm-4.20</changelog>
  <changelog author="dennis.tseng@suse.com" date="1746532800">-- Update to version 16.0
  - remove shim-bsc1177315-verify-eku-codesign.patch
    remove it because shim github upstream has accepted it (PR #664)
  - add revoked-SLES-UEFI-SIGN-Certificate-2022-05.crt to revoked certificates for dbx
    SLES-UEFI-SIGN-Certificate-20220525.crt can be blacklisted,
    and can be added to the vendor dbx.
  - add shim-alloc-one-more-byte-for-sprintf.patch (bsc#1240871)
    The codes already submitted to git upstream (PR #746)
    In generate_sbat_var_defs.c, realloc() should allocate one more byte for
    the end of string '\0' when running sprintf() later.
  - Patches (git log --oneline --reverse 15.8..16.0)
    126a07e Validate that a supplied vendor cert is not in PEM format
    63edf92 sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
    3e1394e sbat: Also bump latest for grub,4 (and to todays date)
    470a8cd undo change that limits certificate files to a single file
    0287c6b shim: don't set second_stage to the empty string
    3685b13 Fix SBAT.md for today's consensus about numbers
    dc07432 Realize the suggestions as part of PR #672
    e064e7d Update Code of Conduct contact address
    e68f4ca make-certs: Handle missing OpenSSL installation
    74a1f29 Update MokVars.txt  - Update documented mirrored variable attributes from RT to BS,RT  - Add missing MokSBStateRT  - Clarify that MokIgnoreDB is a mirror of MokDBState  - Add missing attributes for MokPWStore
    f6674fe export DEFINES for sub makefile
    47bbb5e Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
    338fded Null-terminate 'arguments' in fallback
    3d1dcd4 Fix "Verifiying" typo in error message
    b5d359a CI: use checkout@v4
    1d8365f CI: work around ownership issue on github
    20094ca Update fedora CI targets
    3cf0e09 Force gcc to produce DWARF4 so that gdb can use it
    5f54182 includes: work around CLANG_PREREQ() double-definition
    ab06527 Makefile: don't warn about clang when building compile_commands.json
    0c9249d Suppress some warnings even harder in Cryptlib and OpenSSL.
    fd7e16f Add building compile_commands.json to CI
    314aecf Discard load-options that start with WINDOWS
    ac85ba4 Fix the issue that the gBS-&gt;LoadImage pointer was empty.
    d8c86b7 shim: Allow data after the end of device path node in load options
    d197220 Backport EFI_HTTP_ERROR status code
    6410312 netboot: Convert TFTP error codes to EFI status codes
    ef8e729 httpboot: Convert HTTP status codes to EFI status codes
    2a1cbe6 Update gnu-efi submodule for EFI_HTTP_ERROR
    196cbb9 Increase EFI file alignment
    ad8692e avoid EFIv2 runtime services on Apple x86 machines
    0345331 Improve shortcut performance when comparing two boolean expressions
    27562ea Fix bad reference to PathName in image loading
    1508ece Move is_removable_media_path() to a shared location.
    7864c10 Provide better error message when MokManager is not found
    3e60895 tpm: Boot with a warning if the event log is full
    b560c52 MokManager: remove redundant logical constraints
    9229e7c Make mock_set_variable() correctly account for resource usage.
    f7e1d72 tests: make it possible to use different limits for variable space
    67efdfc test-mok-mirror: refactor the validation of test_mok_mirror_0
    70366a2 test-mok-mirror: add a test case where MokListRT won't fit.
    3caa75e test-mok-mirror: minor bug fix
    dc45aa6 lib/simple_file.c: Allocate zeroed pool for SimpleFS entries
    9415d3c simple_file: Allow to form a volume name from DevicePath
    d6076cb simple_file: Use second variable to create filesystem entries
    f99749a Ignore a minor clang-tidy nit
    98173f0 Fall back to default loader when encountering errors on network boot
    e42c319 test.mk: don't use a temporary random.bin
    c66c157 pe: Enhance debug report for update_mem_attrs
    1125212 Fix leak in error path
    2daf1db Load concatenated EFI_SIGNATURE_LISTs from shim_certificate.efi
    eeca60a Update SbatLevel_Variable.txt with peimage CVE-2024-2312 revocation
    743f3fa Add generate_sbat_var_defs utility program
    5ae408a Generate and use generated_sbat_var_defs.h
    e886fb3 SbatLevel_Variable.txt: clarify where and how revocation data is tracked
    15c1a9a Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
    eb02afc Optionally enabling codesign EKU check in compiling time.
    7ae0ee6 Add docs for ENABLE_CODESIGN_EKU
    38dfa37 Create utils file
    83850cd Add configuration option to boot an alternative 2nd stage
    bb114a3 Implement shim image load protocol
    e7b3598 Move some stuff around
    0322e10 Implement the rest of the loader protocol functions
    e43aea8 Add EFI_LOAD_FILE2_PROTOCOL to gnu-efi
    2bff460 loader-proto: Add support for loading files from disk to LoadImage()
    5d17278 loader-proto: Mark load_image()'s handle_image() call as "in_protocol"
    fe2ad36 Don't print full screen error dialog from handle_image() when called in_protocol
    c57af36 loader-proto: Respect optional DevicePath parameter to load_image()
    2b49dc1 Suppress file open failures for some netboot cases
    3c3295d netboot: process revocations.efi as revocations not shim_certificate
    c66ce2a Allow indepdent SkuSi and SBAT revocation updates
    6b8e40c netboot can try to load shim_certificate_[0..9].efi
    301cf52 Document how revocations can be delivered
    7cde2cc post-process-pe: add tests to validate NX compliance
    1294b47 regression: out of bounds read in CopyMem() in ad8692e
    765f294 compiler.h: minor ALIGN_... fixes
    5c1e6e4 Move error logging decls out of shim.h
    d972515 Save the debug and error logs in mok-variables
    e3f0338 Silence minor nit in load-options parsing debug output
    3d7c057 get_mem_attrs(): ensure an error code is set on failure
    49db3de mok: add MOK_VARIABLE_CONFIG_ONLY
    887c0ed mok variables: add a format callback
    e4857b4 Make test-mok-error failures *slightly* more clear.
    589c3f2 Move memory attribute support to its own file.
    848667d shim: add HSIStatus feature
    e136e64 mock-variables: fix debugging printf format specifier oopsie
    f0958ba test-mock-variables: improve some debug prints
    b216543 Move mok state variable data flag definitions to the header.
    fc0cfac Mirror some more efi variables to mok-variables
    eeda3fa gnu-efi: add some DXE services.
    c41b1f0 Add support for DXE memory attribute updates.
    9269e9b Add DXE Services information to HSI
    c868d54 hexdump: give a different debug log for size==0
    1baf1ef HSI: Add decode_hsi_bits() for easier reading of the debug log
    3bce118 pe: read_header(): allow skipping SecDir content validation
    89e6150 Add shim's current NX_COMPAT status to HSIStatus
    c5c5287 peimage.h: minor whitespace fixes
    5007d83 peimage: add a bunch of comments to read_header()
    489af5e README.tpm: reflect that vendor_db is in fact logged as "vendor_db"
    1958b0f reject message with different values in multiple Content-Length header field
    9c423e0 Some save_logs() improvements.
    81d40e3 Disable log saving for now.
    498b149 fallback: don't add new boot order entries backwards
    06d8dec makefiles: Make GITTAG swizzle tildes to dashes
    f02b2c1 make-archive: some minor housekeeping
    794d237 Update version to 16.0~rc1
    d45c610 SetSecureVariable(): free Cert on failure
    76fab7b generate_sbat_var_defs: run clang-format on readfile()
    6dadb70 generate_sbat_var_defs: Fix memory leak on realloc failure and fd leak.
    f58c77e generate_sbat_var_defs: Ensure revlistentry-&gt;revocations is initialized.
    b427a34 mirror_mok_db(): get rid of an unused variable+allocation
    92630f2 mirror_one_mok_variable(): fix a memory leak on TPM log error.
    38f0a9c mirror_mok_db(): Free our mok variable name correctly
    db04321 shim_load_image(): initialize the buffer fully
    7b75382 simple_dir_filter(): test our 'next' pointer
    db1f1da Make 'make fanalyzer' work again.
    28d8871 README.tpm: Update MokList entry to MokListRT
    8932527 SBAT Level update for February 2025 GRUB CVEs
    18d98bf Update version to 16.0</changelog>
  <changelog author="dennis.tseng@suse.com" date="1748433600">- add revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt into dbx
- build shim with EKU enable flag (ENABLE_CODESIGN_EKU)
  remove EKU enable flag when build MokManager and fallback</changelog>
  <changelog author="dennis.tseng@suse.com" date="1749124800">- rename incorrect certificat name revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt
  to revoked-openSUSE-UEFI-SIGN-Certificate-2022-06.crt, and
  re-arrange its sequence.</changelog>
  <changelog author="jlee@suse.com" date="1751976000">- The old shim-16.0.tar.bz2 is repackaged from a local source which
  includes quilt series files. It causes that we can not direct add
  new patch file through shim.spec. I replaced it by shim-16.0 tarball
  from upstream:
  https://github.com/rhboot/shim/releases/download/16.0/shim-16.0.tar.bz2</changelog>
  <changelog author="jlee@suse.com" date="1753444800">- Add shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - shim: change automatically enable MOK_POLICY_REQUIRE_NX (PR #761)
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753444801">- Building out shim.nx.efi for supporting non-executable
  - Building additional shim with POST_PROCESS_PE_FLAGS=-n to set
    the PE NX-compatibility DLL. (NxCompatible field in DllCharacteristics)
  - Packaging shim.nx.efi to shim-nx RPM.
  - Add MS signatures for shim.nx
  - signature-opensuse-nx.x86_64.asc
    signature-sles-nx.x86_64.asc
    signature-opensuse-nx.aarch64.asc
    signature-sles-nx.aarch64.asc
  - We direc copy signatures of shim for shim.nx before we got
    signatures from Microsoft.
- Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753617600">- Add pre script to shim package for checking UEFI db has valid key for shim.
  It prevents that SUSE shim be installed on a machine which can no verify
  and boot with it when secure boot is enabled.
  User can still install shim success when secure boot is disabled even no
  valid key in UEFI db. User should aware that shim can not be boot when
  secure boot is enabled.
  This checking will useful for changing Microsoft or SUSE CA in the future.
  The shim be signed by new MS/SUSE key will NOT be installed on a machine
  which does not have new key in UEFI db when secure boot is enabled. It
  can prevent booting fail after shim package is updated.</changelog>
  <changelog author="jlee@suse.com" date="1753704000">- Removed pre script in shim package for checking UEFI db has valid key
  for shim because it will interrupt group update of RPMs. It should be
  moved to %pretrans and re-written by lua.</changelog>
  <changelog author="jlee@suse.com" date="1753963200">- Add shim-disable-dxe-get-mem-attrs.patch
  - On old edk2-stable202308 ovmf, running dxe_get_mem_attrs() causes
    get_hsi_mem_info() confusion on hsi_status. It looks that hsi_status
    has a copy after running dxe_get_mem_attrs(). Those elements in
    hsi_nx_is_enforced(), HEAPX|STACKX|ROW can NOT set into hsi_status.
    Let's disabling the approach of DXE get memory attributes until
    we found the root cause.
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754136000">- Using gcc13 for building shim/shim-nx
  - The gcc13 can workaround dxe_get_mem_attrs() hsi_status problem
  - Add the following changes to shim.spec :
    define gcc_version 13
    global cc_compiler /usr/bin/gcc-%{gcc_version}
    BuildRequires  gcc%{gcc_version}
    make CC=%{cc_compiler} RELEASE=0
- Remove shim-disable-dxe-get-mem-attrs.patch
  - This downstream patch can be removed after moving to gcc13
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754481600">- Building with the latest version of gcc in the codebase:
  - We prefer that building shim with the latest version of gcc in codebase.
  - Set the minimum version is gcc-13.
    if gcc_version &lt; 13
    define gcc_version 13
    endif
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1755000000">- SLE shim should includes vendor-dbx-sles.esl instead of
  vendor-dbx-opensuse.esl. Fixed it in shim.spec.
    verify='SUSE Linux Enterprise Secure Boot CA1'
-       vendor_dbx='vendor-dbx-opensuse.esl'
  +       vendor_dbx='vendor-dbx-sles.esl'</changelog>
  <changelog author="jlee@suse.com" date="1755604800">- Update to 16.1
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]</changelog>
  <changelog author="jlee@suse.com" date="1755604801">- Removed the following patches because they are merged to shim 16.1:
  - shim-alloc-one-more-byte-for-sprintf.patch
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch</changelog>
</package>
<package pkgid="1b838a150077d6c8645bab0377ff0a65a0a01c13114ec37e0a0ac47aa8e55c5b" name="shim-debugsource" arch="aarch64">
  <version epoch="0" ver="16.1" rel="150700.10.9"/>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="glin@suse.com" date="1712059200">- Introduce %shim_use_fde_tpm_helper macro so that the project
  can include the fde-tpm-helper-macros for the build targets
  other than Tumbleweed</changelog>
  <changelog author="dennis.tseng@suse.com" date="1719316800">- Update asc files of shim-15.8 after being signed back from
  Microsoft, including:
  signature-opensuse.x86_64.asc,
  signature-opensuse.aarch64.asc,
  signature-sles.x86_64.asc,
  signature-sles.aarch64.asc.
- Enable aarch64 signature comparison which was disabled temporarily
  before. Now, we got a real one. So it is enabled again.</changelog>
  <changelog author="glin@suse.com" date="1726488000">- Update shim-install to apply the missing fix for openSUSE Leap
  (bsc#1210382)
  * 86b73d1 Fix that bootx64.efi is not updated on Leap
- Update shim-install to use the 'removable' way for SL-Micro
  (bsc#1230316)
  * 433cc4e Always use the removable way for SL-Micro</changelog>
  <changelog author="glin@suse.com" date="1726747200">- Update shim-install to limit the scope of the 'removable'
  SL-Micro to the image booting with TPM2 unsealing (bsc#1210382)
  * 769e41d Limit the removable option to encrypted SL-Micro</changelog>
  <changelog author="mls@suse.de" date="1734696000">- undefine %_enable_debug_packages to fix building with rpm-4.20</changelog>
  <changelog author="dennis.tseng@suse.com" date="1746532800">-- Update to version 16.0
  - remove shim-bsc1177315-verify-eku-codesign.patch
    remove it because shim github upstream has accepted it (PR #664)
  - add revoked-SLES-UEFI-SIGN-Certificate-2022-05.crt to revoked certificates for dbx
    SLES-UEFI-SIGN-Certificate-20220525.crt can be blacklisted,
    and can be added to the vendor dbx.
  - add shim-alloc-one-more-byte-for-sprintf.patch (bsc#1240871)
    The codes already submitted to git upstream (PR #746)
    In generate_sbat_var_defs.c, realloc() should allocate one more byte for
    the end of string '\0' when running sprintf() later.
  - Patches (git log --oneline --reverse 15.8..16.0)
    126a07e Validate that a supplied vendor cert is not in PEM format
    63edf92 sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
    3e1394e sbat: Also bump latest for grub,4 (and to todays date)
    470a8cd undo change that limits certificate files to a single file
    0287c6b shim: don't set second_stage to the empty string
    3685b13 Fix SBAT.md for today's consensus about numbers
    dc07432 Realize the suggestions as part of PR #672
    e064e7d Update Code of Conduct contact address
    e68f4ca make-certs: Handle missing OpenSSL installation
    74a1f29 Update MokVars.txt  - Update documented mirrored variable attributes from RT to BS,RT  - Add missing MokSBStateRT  - Clarify that MokIgnoreDB is a mirror of MokDBState  - Add missing attributes for MokPWStore
    f6674fe export DEFINES for sub makefile
    47bbb5e Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
    338fded Null-terminate 'arguments' in fallback
    3d1dcd4 Fix "Verifiying" typo in error message
    b5d359a CI: use checkout@v4
    1d8365f CI: work around ownership issue on github
    20094ca Update fedora CI targets
    3cf0e09 Force gcc to produce DWARF4 so that gdb can use it
    5f54182 includes: work around CLANG_PREREQ() double-definition
    ab06527 Makefile: don't warn about clang when building compile_commands.json
    0c9249d Suppress some warnings even harder in Cryptlib and OpenSSL.
    fd7e16f Add building compile_commands.json to CI
    314aecf Discard load-options that start with WINDOWS
    ac85ba4 Fix the issue that the gBS-&gt;LoadImage pointer was empty.
    d8c86b7 shim: Allow data after the end of device path node in load options
    d197220 Backport EFI_HTTP_ERROR status code
    6410312 netboot: Convert TFTP error codes to EFI status codes
    ef8e729 httpboot: Convert HTTP status codes to EFI status codes
    2a1cbe6 Update gnu-efi submodule for EFI_HTTP_ERROR
    196cbb9 Increase EFI file alignment
    ad8692e avoid EFIv2 runtime services on Apple x86 machines
    0345331 Improve shortcut performance when comparing two boolean expressions
    27562ea Fix bad reference to PathName in image loading
    1508ece Move is_removable_media_path() to a shared location.
    7864c10 Provide better error message when MokManager is not found
    3e60895 tpm: Boot with a warning if the event log is full
    b560c52 MokManager: remove redundant logical constraints
    9229e7c Make mock_set_variable() correctly account for resource usage.
    f7e1d72 tests: make it possible to use different limits for variable space
    67efdfc test-mok-mirror: refactor the validation of test_mok_mirror_0
    70366a2 test-mok-mirror: add a test case where MokListRT won't fit.
    3caa75e test-mok-mirror: minor bug fix
    dc45aa6 lib/simple_file.c: Allocate zeroed pool for SimpleFS entries
    9415d3c simple_file: Allow to form a volume name from DevicePath
    d6076cb simple_file: Use second variable to create filesystem entries
    f99749a Ignore a minor clang-tidy nit
    98173f0 Fall back to default loader when encountering errors on network boot
    e42c319 test.mk: don't use a temporary random.bin
    c66c157 pe: Enhance debug report for update_mem_attrs
    1125212 Fix leak in error path
    2daf1db Load concatenated EFI_SIGNATURE_LISTs from shim_certificate.efi
    eeca60a Update SbatLevel_Variable.txt with peimage CVE-2024-2312 revocation
    743f3fa Add generate_sbat_var_defs utility program
    5ae408a Generate and use generated_sbat_var_defs.h
    e886fb3 SbatLevel_Variable.txt: clarify where and how revocation data is tracked
    15c1a9a Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
    eb02afc Optionally enabling codesign EKU check in compiling time.
    7ae0ee6 Add docs for ENABLE_CODESIGN_EKU
    38dfa37 Create utils file
    83850cd Add configuration option to boot an alternative 2nd stage
    bb114a3 Implement shim image load protocol
    e7b3598 Move some stuff around
    0322e10 Implement the rest of the loader protocol functions
    e43aea8 Add EFI_LOAD_FILE2_PROTOCOL to gnu-efi
    2bff460 loader-proto: Add support for loading files from disk to LoadImage()
    5d17278 loader-proto: Mark load_image()'s handle_image() call as "in_protocol"
    fe2ad36 Don't print full screen error dialog from handle_image() when called in_protocol
    c57af36 loader-proto: Respect optional DevicePath parameter to load_image()
    2b49dc1 Suppress file open failures for some netboot cases
    3c3295d netboot: process revocations.efi as revocations not shim_certificate
    c66ce2a Allow indepdent SkuSi and SBAT revocation updates
    6b8e40c netboot can try to load shim_certificate_[0..9].efi
    301cf52 Document how revocations can be delivered
    7cde2cc post-process-pe: add tests to validate NX compliance
    1294b47 regression: out of bounds read in CopyMem() in ad8692e
    765f294 compiler.h: minor ALIGN_... fixes
    5c1e6e4 Move error logging decls out of shim.h
    d972515 Save the debug and error logs in mok-variables
    e3f0338 Silence minor nit in load-options parsing debug output
    3d7c057 get_mem_attrs(): ensure an error code is set on failure
    49db3de mok: add MOK_VARIABLE_CONFIG_ONLY
    887c0ed mok variables: add a format callback
    e4857b4 Make test-mok-error failures *slightly* more clear.
    589c3f2 Move memory attribute support to its own file.
    848667d shim: add HSIStatus feature
    e136e64 mock-variables: fix debugging printf format specifier oopsie
    f0958ba test-mock-variables: improve some debug prints
    b216543 Move mok state variable data flag definitions to the header.
    fc0cfac Mirror some more efi variables to mok-variables
    eeda3fa gnu-efi: add some DXE services.
    c41b1f0 Add support for DXE memory attribute updates.
    9269e9b Add DXE Services information to HSI
    c868d54 hexdump: give a different debug log for size==0
    1baf1ef HSI: Add decode_hsi_bits() for easier reading of the debug log
    3bce118 pe: read_header(): allow skipping SecDir content validation
    89e6150 Add shim's current NX_COMPAT status to HSIStatus
    c5c5287 peimage.h: minor whitespace fixes
    5007d83 peimage: add a bunch of comments to read_header()
    489af5e README.tpm: reflect that vendor_db is in fact logged as "vendor_db"
    1958b0f reject message with different values in multiple Content-Length header field
    9c423e0 Some save_logs() improvements.
    81d40e3 Disable log saving for now.
    498b149 fallback: don't add new boot order entries backwards
    06d8dec makefiles: Make GITTAG swizzle tildes to dashes
    f02b2c1 make-archive: some minor housekeeping
    794d237 Update version to 16.0~rc1
    d45c610 SetSecureVariable(): free Cert on failure
    76fab7b generate_sbat_var_defs: run clang-format on readfile()
    6dadb70 generate_sbat_var_defs: Fix memory leak on realloc failure and fd leak.
    f58c77e generate_sbat_var_defs: Ensure revlistentry-&gt;revocations is initialized.
    b427a34 mirror_mok_db(): get rid of an unused variable+allocation
    92630f2 mirror_one_mok_variable(): fix a memory leak on TPM log error.
    38f0a9c mirror_mok_db(): Free our mok variable name correctly
    db04321 shim_load_image(): initialize the buffer fully
    7b75382 simple_dir_filter(): test our 'next' pointer
    db1f1da Make 'make fanalyzer' work again.
    28d8871 README.tpm: Update MokList entry to MokListRT
    8932527 SBAT Level update for February 2025 GRUB CVEs
    18d98bf Update version to 16.0</changelog>
  <changelog author="dennis.tseng@suse.com" date="1748433600">- add revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt into dbx
- build shim with EKU enable flag (ENABLE_CODESIGN_EKU)
  remove EKU enable flag when build MokManager and fallback</changelog>
  <changelog author="dennis.tseng@suse.com" date="1749124800">- rename incorrect certificat name revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt
  to revoked-openSUSE-UEFI-SIGN-Certificate-2022-06.crt, and
  re-arrange its sequence.</changelog>
  <changelog author="jlee@suse.com" date="1751976000">- The old shim-16.0.tar.bz2 is repackaged from a local source which
  includes quilt series files. It causes that we can not direct add
  new patch file through shim.spec. I replaced it by shim-16.0 tarball
  from upstream:
  https://github.com/rhboot/shim/releases/download/16.0/shim-16.0.tar.bz2</changelog>
  <changelog author="jlee@suse.com" date="1753444800">- Add shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - shim: change automatically enable MOK_POLICY_REQUIRE_NX (PR #761)
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753444801">- Building out shim.nx.efi for supporting non-executable
  - Building additional shim with POST_PROCESS_PE_FLAGS=-n to set
    the PE NX-compatibility DLL. (NxCompatible field in DllCharacteristics)
  - Packaging shim.nx.efi to shim-nx RPM.
  - Add MS signatures for shim.nx
  - signature-opensuse-nx.x86_64.asc
    signature-sles-nx.x86_64.asc
    signature-opensuse-nx.aarch64.asc
    signature-sles-nx.aarch64.asc
  - We direc copy signatures of shim for shim.nx before we got
    signatures from Microsoft.
- Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753617600">- Add pre script to shim package for checking UEFI db has valid key for shim.
  It prevents that SUSE shim be installed on a machine which can no verify
  and boot with it when secure boot is enabled.
  User can still install shim success when secure boot is disabled even no
  valid key in UEFI db. User should aware that shim can not be boot when
  secure boot is enabled.
  This checking will useful for changing Microsoft or SUSE CA in the future.
  The shim be signed by new MS/SUSE key will NOT be installed on a machine
  which does not have new key in UEFI db when secure boot is enabled. It
  can prevent booting fail after shim package is updated.</changelog>
  <changelog author="jlee@suse.com" date="1753704000">- Removed pre script in shim package for checking UEFI db has valid key
  for shim because it will interrupt group update of RPMs. It should be
  moved to %pretrans and re-written by lua.</changelog>
  <changelog author="jlee@suse.com" date="1753963200">- Add shim-disable-dxe-get-mem-attrs.patch
  - On old edk2-stable202308 ovmf, running dxe_get_mem_attrs() causes
    get_hsi_mem_info() confusion on hsi_status. It looks that hsi_status
    has a copy after running dxe_get_mem_attrs(). Those elements in
    hsi_nx_is_enforced(), HEAPX|STACKX|ROW can NOT set into hsi_status.
    Let's disabling the approach of DXE get memory attributes until
    we found the root cause.
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754136000">- Using gcc13 for building shim/shim-nx
  - The gcc13 can workaround dxe_get_mem_attrs() hsi_status problem
  - Add the following changes to shim.spec :
    define gcc_version 13
    global cc_compiler /usr/bin/gcc-%{gcc_version}
    BuildRequires  gcc%{gcc_version}
    make CC=%{cc_compiler} RELEASE=0
- Remove shim-disable-dxe-get-mem-attrs.patch
  - This downstream patch can be removed after moving to gcc13
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754481600">- Building with the latest version of gcc in the codebase:
  - We prefer that building shim with the latest version of gcc in codebase.
  - Set the minimum version is gcc-13.
    if gcc_version &lt; 13
    define gcc_version 13
    endif
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1755000000">- SLE shim should includes vendor-dbx-sles.esl instead of
  vendor-dbx-opensuse.esl. Fixed it in shim.spec.
    verify='SUSE Linux Enterprise Secure Boot CA1'
-       vendor_dbx='vendor-dbx-opensuse.esl'
  +       vendor_dbx='vendor-dbx-sles.esl'</changelog>
  <changelog author="jlee@suse.com" date="1755604800">- Update to 16.1
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]</changelog>
  <changelog author="jlee@suse.com" date="1755604801">- Removed the following patches because they are merged to shim 16.1:
  - shim-alloc-one-more-byte-for-sprintf.patch
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch</changelog>
</package>
<package pkgid="919b6cc5a4f549fb404e9fec9e32fc7e9e18f7080e9d2fb8b9fb9cbd08d7cd2c" name="shim-debugsource" arch="x86_64">
  <version epoch="0" ver="16.1" rel="150700.10.9"/>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="glin@suse.com" date="1712059200">- Introduce %shim_use_fde_tpm_helper macro so that the project
  can include the fde-tpm-helper-macros for the build targets
  other than Tumbleweed</changelog>
  <changelog author="dennis.tseng@suse.com" date="1719316800">- Update asc files of shim-15.8 after being signed back from
  Microsoft, including:
  signature-opensuse.x86_64.asc,
  signature-opensuse.aarch64.asc,
  signature-sles.x86_64.asc,
  signature-sles.aarch64.asc.
- Enable aarch64 signature comparison which was disabled temporarily
  before. Now, we got a real one. So it is enabled again.</changelog>
  <changelog author="glin@suse.com" date="1726488000">- Update shim-install to apply the missing fix for openSUSE Leap
  (bsc#1210382)
  * 86b73d1 Fix that bootx64.efi is not updated on Leap
- Update shim-install to use the 'removable' way for SL-Micro
  (bsc#1230316)
  * 433cc4e Always use the removable way for SL-Micro</changelog>
  <changelog author="glin@suse.com" date="1726747200">- Update shim-install to limit the scope of the 'removable'
  SL-Micro to the image booting with TPM2 unsealing (bsc#1210382)
  * 769e41d Limit the removable option to encrypted SL-Micro</changelog>
  <changelog author="mls@suse.de" date="1734696000">- undefine %_enable_debug_packages to fix building with rpm-4.20</changelog>
  <changelog author="dennis.tseng@suse.com" date="1746532800">-- Update to version 16.0
  - remove shim-bsc1177315-verify-eku-codesign.patch
    remove it because shim github upstream has accepted it (PR #664)
  - add revoked-SLES-UEFI-SIGN-Certificate-2022-05.crt to revoked certificates for dbx
    SLES-UEFI-SIGN-Certificate-20220525.crt can be blacklisted,
    and can be added to the vendor dbx.
  - add shim-alloc-one-more-byte-for-sprintf.patch (bsc#1240871)
    The codes already submitted to git upstream (PR #746)
    In generate_sbat_var_defs.c, realloc() should allocate one more byte for
    the end of string '\0' when running sprintf() later.
  - Patches (git log --oneline --reverse 15.8..16.0)
    126a07e Validate that a supplied vendor cert is not in PEM format
    63edf92 sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
    3e1394e sbat: Also bump latest for grub,4 (and to todays date)
    470a8cd undo change that limits certificate files to a single file
    0287c6b shim: don't set second_stage to the empty string
    3685b13 Fix SBAT.md for today's consensus about numbers
    dc07432 Realize the suggestions as part of PR #672
    e064e7d Update Code of Conduct contact address
    e68f4ca make-certs: Handle missing OpenSSL installation
    74a1f29 Update MokVars.txt  - Update documented mirrored variable attributes from RT to BS,RT  - Add missing MokSBStateRT  - Clarify that MokIgnoreDB is a mirror of MokDBState  - Add missing attributes for MokPWStore
    f6674fe export DEFINES for sub makefile
    47bbb5e Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
    338fded Null-terminate 'arguments' in fallback
    3d1dcd4 Fix "Verifiying" typo in error message
    b5d359a CI: use checkout@v4
    1d8365f CI: work around ownership issue on github
    20094ca Update fedora CI targets
    3cf0e09 Force gcc to produce DWARF4 so that gdb can use it
    5f54182 includes: work around CLANG_PREREQ() double-definition
    ab06527 Makefile: don't warn about clang when building compile_commands.json
    0c9249d Suppress some warnings even harder in Cryptlib and OpenSSL.
    fd7e16f Add building compile_commands.json to CI
    314aecf Discard load-options that start with WINDOWS
    ac85ba4 Fix the issue that the gBS-&gt;LoadImage pointer was empty.
    d8c86b7 shim: Allow data after the end of device path node in load options
    d197220 Backport EFI_HTTP_ERROR status code
    6410312 netboot: Convert TFTP error codes to EFI status codes
    ef8e729 httpboot: Convert HTTP status codes to EFI status codes
    2a1cbe6 Update gnu-efi submodule for EFI_HTTP_ERROR
    196cbb9 Increase EFI file alignment
    ad8692e avoid EFIv2 runtime services on Apple x86 machines
    0345331 Improve shortcut performance when comparing two boolean expressions
    27562ea Fix bad reference to PathName in image loading
    1508ece Move is_removable_media_path() to a shared location.
    7864c10 Provide better error message when MokManager is not found
    3e60895 tpm: Boot with a warning if the event log is full
    b560c52 MokManager: remove redundant logical constraints
    9229e7c Make mock_set_variable() correctly account for resource usage.
    f7e1d72 tests: make it possible to use different limits for variable space
    67efdfc test-mok-mirror: refactor the validation of test_mok_mirror_0
    70366a2 test-mok-mirror: add a test case where MokListRT won't fit.
    3caa75e test-mok-mirror: minor bug fix
    dc45aa6 lib/simple_file.c: Allocate zeroed pool for SimpleFS entries
    9415d3c simple_file: Allow to form a volume name from DevicePath
    d6076cb simple_file: Use second variable to create filesystem entries
    f99749a Ignore a minor clang-tidy nit
    98173f0 Fall back to default loader when encountering errors on network boot
    e42c319 test.mk: don't use a temporary random.bin
    c66c157 pe: Enhance debug report for update_mem_attrs
    1125212 Fix leak in error path
    2daf1db Load concatenated EFI_SIGNATURE_LISTs from shim_certificate.efi
    eeca60a Update SbatLevel_Variable.txt with peimage CVE-2024-2312 revocation
    743f3fa Add generate_sbat_var_defs utility program
    5ae408a Generate and use generated_sbat_var_defs.h
    e886fb3 SbatLevel_Variable.txt: clarify where and how revocation data is tracked
    15c1a9a Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
    eb02afc Optionally enabling codesign EKU check in compiling time.
    7ae0ee6 Add docs for ENABLE_CODESIGN_EKU
    38dfa37 Create utils file
    83850cd Add configuration option to boot an alternative 2nd stage
    bb114a3 Implement shim image load protocol
    e7b3598 Move some stuff around
    0322e10 Implement the rest of the loader protocol functions
    e43aea8 Add EFI_LOAD_FILE2_PROTOCOL to gnu-efi
    2bff460 loader-proto: Add support for loading files from disk to LoadImage()
    5d17278 loader-proto: Mark load_image()'s handle_image() call as "in_protocol"
    fe2ad36 Don't print full screen error dialog from handle_image() when called in_protocol
    c57af36 loader-proto: Respect optional DevicePath parameter to load_image()
    2b49dc1 Suppress file open failures for some netboot cases
    3c3295d netboot: process revocations.efi as revocations not shim_certificate
    c66ce2a Allow indepdent SkuSi and SBAT revocation updates
    6b8e40c netboot can try to load shim_certificate_[0..9].efi
    301cf52 Document how revocations can be delivered
    7cde2cc post-process-pe: add tests to validate NX compliance
    1294b47 regression: out of bounds read in CopyMem() in ad8692e
    765f294 compiler.h: minor ALIGN_... fixes
    5c1e6e4 Move error logging decls out of shim.h
    d972515 Save the debug and error logs in mok-variables
    e3f0338 Silence minor nit in load-options parsing debug output
    3d7c057 get_mem_attrs(): ensure an error code is set on failure
    49db3de mok: add MOK_VARIABLE_CONFIG_ONLY
    887c0ed mok variables: add a format callback
    e4857b4 Make test-mok-error failures *slightly* more clear.
    589c3f2 Move memory attribute support to its own file.
    848667d shim: add HSIStatus feature
    e136e64 mock-variables: fix debugging printf format specifier oopsie
    f0958ba test-mock-variables: improve some debug prints
    b216543 Move mok state variable data flag definitions to the header.
    fc0cfac Mirror some more efi variables to mok-variables
    eeda3fa gnu-efi: add some DXE services.
    c41b1f0 Add support for DXE memory attribute updates.
    9269e9b Add DXE Services information to HSI
    c868d54 hexdump: give a different debug log for size==0
    1baf1ef HSI: Add decode_hsi_bits() for easier reading of the debug log
    3bce118 pe: read_header(): allow skipping SecDir content validation
    89e6150 Add shim's current NX_COMPAT status to HSIStatus
    c5c5287 peimage.h: minor whitespace fixes
    5007d83 peimage: add a bunch of comments to read_header()
    489af5e README.tpm: reflect that vendor_db is in fact logged as "vendor_db"
    1958b0f reject message with different values in multiple Content-Length header field
    9c423e0 Some save_logs() improvements.
    81d40e3 Disable log saving for now.
    498b149 fallback: don't add new boot order entries backwards
    06d8dec makefiles: Make GITTAG swizzle tildes to dashes
    f02b2c1 make-archive: some minor housekeeping
    794d237 Update version to 16.0~rc1
    d45c610 SetSecureVariable(): free Cert on failure
    76fab7b generate_sbat_var_defs: run clang-format on readfile()
    6dadb70 generate_sbat_var_defs: Fix memory leak on realloc failure and fd leak.
    f58c77e generate_sbat_var_defs: Ensure revlistentry-&gt;revocations is initialized.
    b427a34 mirror_mok_db(): get rid of an unused variable+allocation
    92630f2 mirror_one_mok_variable(): fix a memory leak on TPM log error.
    38f0a9c mirror_mok_db(): Free our mok variable name correctly
    db04321 shim_load_image(): initialize the buffer fully
    7b75382 simple_dir_filter(): test our 'next' pointer
    db1f1da Make 'make fanalyzer' work again.
    28d8871 README.tpm: Update MokList entry to MokListRT
    8932527 SBAT Level update for February 2025 GRUB CVEs
    18d98bf Update version to 16.0</changelog>
  <changelog author="dennis.tseng@suse.com" date="1748433600">- add revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt into dbx
- build shim with EKU enable flag (ENABLE_CODESIGN_EKU)
  remove EKU enable flag when build MokManager and fallback</changelog>
  <changelog author="dennis.tseng@suse.com" date="1749124800">- rename incorrect certificat name revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt
  to revoked-openSUSE-UEFI-SIGN-Certificate-2022-06.crt, and
  re-arrange its sequence.</changelog>
  <changelog author="jlee@suse.com" date="1751976000">- The old shim-16.0.tar.bz2 is repackaged from a local source which
  includes quilt series files. It causes that we can not direct add
  new patch file through shim.spec. I replaced it by shim-16.0 tarball
  from upstream:
  https://github.com/rhboot/shim/releases/download/16.0/shim-16.0.tar.bz2</changelog>
  <changelog author="jlee@suse.com" date="1753444800">- Add shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - shim: change automatically enable MOK_POLICY_REQUIRE_NX (PR #761)
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753444801">- Building out shim.nx.efi for supporting non-executable
  - Building additional shim with POST_PROCESS_PE_FLAGS=-n to set
    the PE NX-compatibility DLL. (NxCompatible field in DllCharacteristics)
  - Packaging shim.nx.efi to shim-nx RPM.
  - Add MS signatures for shim.nx
  - signature-opensuse-nx.x86_64.asc
    signature-sles-nx.x86_64.asc
    signature-opensuse-nx.aarch64.asc
    signature-sles-nx.aarch64.asc
  - We direc copy signatures of shim for shim.nx before we got
    signatures from Microsoft.
- Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753617600">- Add pre script to shim package for checking UEFI db has valid key for shim.
  It prevents that SUSE shim be installed on a machine which can no verify
  and boot with it when secure boot is enabled.
  User can still install shim success when secure boot is disabled even no
  valid key in UEFI db. User should aware that shim can not be boot when
  secure boot is enabled.
  This checking will useful for changing Microsoft or SUSE CA in the future.
  The shim be signed by new MS/SUSE key will NOT be installed on a machine
  which does not have new key in UEFI db when secure boot is enabled. It
  can prevent booting fail after shim package is updated.</changelog>
  <changelog author="jlee@suse.com" date="1753704000">- Removed pre script in shim package for checking UEFI db has valid key
  for shim because it will interrupt group update of RPMs. It should be
  moved to %pretrans and re-written by lua.</changelog>
  <changelog author="jlee@suse.com" date="1753963200">- Add shim-disable-dxe-get-mem-attrs.patch
  - On old edk2-stable202308 ovmf, running dxe_get_mem_attrs() causes
    get_hsi_mem_info() confusion on hsi_status. It looks that hsi_status
    has a copy after running dxe_get_mem_attrs(). Those elements in
    hsi_nx_is_enforced(), HEAPX|STACKX|ROW can NOT set into hsi_status.
    Let's disabling the approach of DXE get memory attributes until
    we found the root cause.
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754136000">- Using gcc13 for building shim/shim-nx
  - The gcc13 can workaround dxe_get_mem_attrs() hsi_status problem
  - Add the following changes to shim.spec :
    define gcc_version 13
    global cc_compiler /usr/bin/gcc-%{gcc_version}
    BuildRequires  gcc%{gcc_version}
    make CC=%{cc_compiler} RELEASE=0
- Remove shim-disable-dxe-get-mem-attrs.patch
  - This downstream patch can be removed after moving to gcc13
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754481600">- Building with the latest version of gcc in the codebase:
  - We prefer that building shim with the latest version of gcc in codebase.
  - Set the minimum version is gcc-13.
    if gcc_version &lt; 13
    define gcc_version 13
    endif
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1755000000">- SLE shim should includes vendor-dbx-sles.esl instead of
  vendor-dbx-opensuse.esl. Fixed it in shim.spec.
    verify='SUSE Linux Enterprise Secure Boot CA1'
-       vendor_dbx='vendor-dbx-opensuse.esl'
  +       vendor_dbx='vendor-dbx-sles.esl'</changelog>
  <changelog author="jlee@suse.com" date="1755604800">- Update to 16.1
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]</changelog>
  <changelog author="jlee@suse.com" date="1755604801">- Removed the following patches because they are merged to shim 16.1:
  - shim-alloc-one-more-byte-for-sprintf.patch
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch</changelog>
</package>
<package pkgid="8155e1464194f02cd57d8cb9b89bfd833b42987a97eb34b8c884aa21d69b9acd" name="shim-nx" arch="aarch64">
  <version epoch="0" ver="16.1" rel="150700.10.9"/>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="glin@suse.com" date="1712059200">- Introduce %shim_use_fde_tpm_helper macro so that the project
  can include the fde-tpm-helper-macros for the build targets
  other than Tumbleweed</changelog>
  <changelog author="dennis.tseng@suse.com" date="1719316800">- Update asc files of shim-15.8 after being signed back from
  Microsoft, including:
  signature-opensuse.x86_64.asc,
  signature-opensuse.aarch64.asc,
  signature-sles.x86_64.asc,
  signature-sles.aarch64.asc.
- Enable aarch64 signature comparison which was disabled temporarily
  before. Now, we got a real one. So it is enabled again.</changelog>
  <changelog author="glin@suse.com" date="1726488000">- Update shim-install to apply the missing fix for openSUSE Leap
  (bsc#1210382)
  * 86b73d1 Fix that bootx64.efi is not updated on Leap
- Update shim-install to use the 'removable' way for SL-Micro
  (bsc#1230316)
  * 433cc4e Always use the removable way for SL-Micro</changelog>
  <changelog author="glin@suse.com" date="1726747200">- Update shim-install to limit the scope of the 'removable'
  SL-Micro to the image booting with TPM2 unsealing (bsc#1210382)
  * 769e41d Limit the removable option to encrypted SL-Micro</changelog>
  <changelog author="mls@suse.de" date="1734696000">- undefine %_enable_debug_packages to fix building with rpm-4.20</changelog>
  <changelog author="dennis.tseng@suse.com" date="1746532800">-- Update to version 16.0
  - remove shim-bsc1177315-verify-eku-codesign.patch
    remove it because shim github upstream has accepted it (PR #664)
  - add revoked-SLES-UEFI-SIGN-Certificate-2022-05.crt to revoked certificates for dbx
    SLES-UEFI-SIGN-Certificate-20220525.crt can be blacklisted,
    and can be added to the vendor dbx.
  - add shim-alloc-one-more-byte-for-sprintf.patch (bsc#1240871)
    The codes already submitted to git upstream (PR #746)
    In generate_sbat_var_defs.c, realloc() should allocate one more byte for
    the end of string '\0' when running sprintf() later.
  - Patches (git log --oneline --reverse 15.8..16.0)
    126a07e Validate that a supplied vendor cert is not in PEM format
    63edf92 sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
    3e1394e sbat: Also bump latest for grub,4 (and to todays date)
    470a8cd undo change that limits certificate files to a single file
    0287c6b shim: don't set second_stage to the empty string
    3685b13 Fix SBAT.md for today's consensus about numbers
    dc07432 Realize the suggestions as part of PR #672
    e064e7d Update Code of Conduct contact address
    e68f4ca make-certs: Handle missing OpenSSL installation
    74a1f29 Update MokVars.txt  - Update documented mirrored variable attributes from RT to BS,RT  - Add missing MokSBStateRT  - Clarify that MokIgnoreDB is a mirror of MokDBState  - Add missing attributes for MokPWStore
    f6674fe export DEFINES for sub makefile
    47bbb5e Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
    338fded Null-terminate 'arguments' in fallback
    3d1dcd4 Fix "Verifiying" typo in error message
    b5d359a CI: use checkout@v4
    1d8365f CI: work around ownership issue on github
    20094ca Update fedora CI targets
    3cf0e09 Force gcc to produce DWARF4 so that gdb can use it
    5f54182 includes: work around CLANG_PREREQ() double-definition
    ab06527 Makefile: don't warn about clang when building compile_commands.json
    0c9249d Suppress some warnings even harder in Cryptlib and OpenSSL.
    fd7e16f Add building compile_commands.json to CI
    314aecf Discard load-options that start with WINDOWS
    ac85ba4 Fix the issue that the gBS-&gt;LoadImage pointer was empty.
    d8c86b7 shim: Allow data after the end of device path node in load options
    d197220 Backport EFI_HTTP_ERROR status code
    6410312 netboot: Convert TFTP error codes to EFI status codes
    ef8e729 httpboot: Convert HTTP status codes to EFI status codes
    2a1cbe6 Update gnu-efi submodule for EFI_HTTP_ERROR
    196cbb9 Increase EFI file alignment
    ad8692e avoid EFIv2 runtime services on Apple x86 machines
    0345331 Improve shortcut performance when comparing two boolean expressions
    27562ea Fix bad reference to PathName in image loading
    1508ece Move is_removable_media_path() to a shared location.
    7864c10 Provide better error message when MokManager is not found
    3e60895 tpm: Boot with a warning if the event log is full
    b560c52 MokManager: remove redundant logical constraints
    9229e7c Make mock_set_variable() correctly account for resource usage.
    f7e1d72 tests: make it possible to use different limits for variable space
    67efdfc test-mok-mirror: refactor the validation of test_mok_mirror_0
    70366a2 test-mok-mirror: add a test case where MokListRT won't fit.
    3caa75e test-mok-mirror: minor bug fix
    dc45aa6 lib/simple_file.c: Allocate zeroed pool for SimpleFS entries
    9415d3c simple_file: Allow to form a volume name from DevicePath
    d6076cb simple_file: Use second variable to create filesystem entries
    f99749a Ignore a minor clang-tidy nit
    98173f0 Fall back to default loader when encountering errors on network boot
    e42c319 test.mk: don't use a temporary random.bin
    c66c157 pe: Enhance debug report for update_mem_attrs
    1125212 Fix leak in error path
    2daf1db Load concatenated EFI_SIGNATURE_LISTs from shim_certificate.efi
    eeca60a Update SbatLevel_Variable.txt with peimage CVE-2024-2312 revocation
    743f3fa Add generate_sbat_var_defs utility program
    5ae408a Generate and use generated_sbat_var_defs.h
    e886fb3 SbatLevel_Variable.txt: clarify where and how revocation data is tracked
    15c1a9a Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
    eb02afc Optionally enabling codesign EKU check in compiling time.
    7ae0ee6 Add docs for ENABLE_CODESIGN_EKU
    38dfa37 Create utils file
    83850cd Add configuration option to boot an alternative 2nd stage
    bb114a3 Implement shim image load protocol
    e7b3598 Move some stuff around
    0322e10 Implement the rest of the loader protocol functions
    e43aea8 Add EFI_LOAD_FILE2_PROTOCOL to gnu-efi
    2bff460 loader-proto: Add support for loading files from disk to LoadImage()
    5d17278 loader-proto: Mark load_image()'s handle_image() call as "in_protocol"
    fe2ad36 Don't print full screen error dialog from handle_image() when called in_protocol
    c57af36 loader-proto: Respect optional DevicePath parameter to load_image()
    2b49dc1 Suppress file open failures for some netboot cases
    3c3295d netboot: process revocations.efi as revocations not shim_certificate
    c66ce2a Allow indepdent SkuSi and SBAT revocation updates
    6b8e40c netboot can try to load shim_certificate_[0..9].efi
    301cf52 Document how revocations can be delivered
    7cde2cc post-process-pe: add tests to validate NX compliance
    1294b47 regression: out of bounds read in CopyMem() in ad8692e
    765f294 compiler.h: minor ALIGN_... fixes
    5c1e6e4 Move error logging decls out of shim.h
    d972515 Save the debug and error logs in mok-variables
    e3f0338 Silence minor nit in load-options parsing debug output
    3d7c057 get_mem_attrs(): ensure an error code is set on failure
    49db3de mok: add MOK_VARIABLE_CONFIG_ONLY
    887c0ed mok variables: add a format callback
    e4857b4 Make test-mok-error failures *slightly* more clear.
    589c3f2 Move memory attribute support to its own file.
    848667d shim: add HSIStatus feature
    e136e64 mock-variables: fix debugging printf format specifier oopsie
    f0958ba test-mock-variables: improve some debug prints
    b216543 Move mok state variable data flag definitions to the header.
    fc0cfac Mirror some more efi variables to mok-variables
    eeda3fa gnu-efi: add some DXE services.
    c41b1f0 Add support for DXE memory attribute updates.
    9269e9b Add DXE Services information to HSI
    c868d54 hexdump: give a different debug log for size==0
    1baf1ef HSI: Add decode_hsi_bits() for easier reading of the debug log
    3bce118 pe: read_header(): allow skipping SecDir content validation
    89e6150 Add shim's current NX_COMPAT status to HSIStatus
    c5c5287 peimage.h: minor whitespace fixes
    5007d83 peimage: add a bunch of comments to read_header()
    489af5e README.tpm: reflect that vendor_db is in fact logged as "vendor_db"
    1958b0f reject message with different values in multiple Content-Length header field
    9c423e0 Some save_logs() improvements.
    81d40e3 Disable log saving for now.
    498b149 fallback: don't add new boot order entries backwards
    06d8dec makefiles: Make GITTAG swizzle tildes to dashes
    f02b2c1 make-archive: some minor housekeeping
    794d237 Update version to 16.0~rc1
    d45c610 SetSecureVariable(): free Cert on failure
    76fab7b generate_sbat_var_defs: run clang-format on readfile()
    6dadb70 generate_sbat_var_defs: Fix memory leak on realloc failure and fd leak.
    f58c77e generate_sbat_var_defs: Ensure revlistentry-&gt;revocations is initialized.
    b427a34 mirror_mok_db(): get rid of an unused variable+allocation
    92630f2 mirror_one_mok_variable(): fix a memory leak on TPM log error.
    38f0a9c mirror_mok_db(): Free our mok variable name correctly
    db04321 shim_load_image(): initialize the buffer fully
    7b75382 simple_dir_filter(): test our 'next' pointer
    db1f1da Make 'make fanalyzer' work again.
    28d8871 README.tpm: Update MokList entry to MokListRT
    8932527 SBAT Level update for February 2025 GRUB CVEs
    18d98bf Update version to 16.0</changelog>
  <changelog author="dennis.tseng@suse.com" date="1748433600">- add revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt into dbx
- build shim with EKU enable flag (ENABLE_CODESIGN_EKU)
  remove EKU enable flag when build MokManager and fallback</changelog>
  <changelog author="dennis.tseng@suse.com" date="1749124800">- rename incorrect certificat name revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt
  to revoked-openSUSE-UEFI-SIGN-Certificate-2022-06.crt, and
  re-arrange its sequence.</changelog>
  <changelog author="jlee@suse.com" date="1751976000">- The old shim-16.0.tar.bz2 is repackaged from a local source which
  includes quilt series files. It causes that we can not direct add
  new patch file through shim.spec. I replaced it by shim-16.0 tarball
  from upstream:
  https://github.com/rhboot/shim/releases/download/16.0/shim-16.0.tar.bz2</changelog>
  <changelog author="jlee@suse.com" date="1753444800">- Add shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - shim: change automatically enable MOK_POLICY_REQUIRE_NX (PR #761)
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753444801">- Building out shim.nx.efi for supporting non-executable
  - Building additional shim with POST_PROCESS_PE_FLAGS=-n to set
    the PE NX-compatibility DLL. (NxCompatible field in DllCharacteristics)
  - Packaging shim.nx.efi to shim-nx RPM.
  - Add MS signatures for shim.nx
  - signature-opensuse-nx.x86_64.asc
    signature-sles-nx.x86_64.asc
    signature-opensuse-nx.aarch64.asc
    signature-sles-nx.aarch64.asc
  - We direc copy signatures of shim for shim.nx before we got
    signatures from Microsoft.
- Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753617600">- Add pre script to shim package for checking UEFI db has valid key for shim.
  It prevents that SUSE shim be installed on a machine which can no verify
  and boot with it when secure boot is enabled.
  User can still install shim success when secure boot is disabled even no
  valid key in UEFI db. User should aware that shim can not be boot when
  secure boot is enabled.
  This checking will useful for changing Microsoft or SUSE CA in the future.
  The shim be signed by new MS/SUSE key will NOT be installed on a machine
  which does not have new key in UEFI db when secure boot is enabled. It
  can prevent booting fail after shim package is updated.</changelog>
  <changelog author="jlee@suse.com" date="1753704000">- Removed pre script in shim package for checking UEFI db has valid key
  for shim because it will interrupt group update of RPMs. It should be
  moved to %pretrans and re-written by lua.</changelog>
  <changelog author="jlee@suse.com" date="1753963200">- Add shim-disable-dxe-get-mem-attrs.patch
  - On old edk2-stable202308 ovmf, running dxe_get_mem_attrs() causes
    get_hsi_mem_info() confusion on hsi_status. It looks that hsi_status
    has a copy after running dxe_get_mem_attrs(). Those elements in
    hsi_nx_is_enforced(), HEAPX|STACKX|ROW can NOT set into hsi_status.
    Let's disabling the approach of DXE get memory attributes until
    we found the root cause.
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754136000">- Using gcc13 for building shim/shim-nx
  - The gcc13 can workaround dxe_get_mem_attrs() hsi_status problem
  - Add the following changes to shim.spec :
    define gcc_version 13
    global cc_compiler /usr/bin/gcc-%{gcc_version}
    BuildRequires  gcc%{gcc_version}
    make CC=%{cc_compiler} RELEASE=0
- Remove shim-disable-dxe-get-mem-attrs.patch
  - This downstream patch can be removed after moving to gcc13
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754481600">- Building with the latest version of gcc in the codebase:
  - We prefer that building shim with the latest version of gcc in codebase.
  - Set the minimum version is gcc-13.
    if gcc_version &lt; 13
    define gcc_version 13
    endif
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1755000000">- SLE shim should includes vendor-dbx-sles.esl instead of
  vendor-dbx-opensuse.esl. Fixed it in shim.spec.
    verify='SUSE Linux Enterprise Secure Boot CA1'
-       vendor_dbx='vendor-dbx-opensuse.esl'
  +       vendor_dbx='vendor-dbx-sles.esl'</changelog>
  <changelog author="jlee@suse.com" date="1755604800">- Update to 16.1
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]</changelog>
  <changelog author="jlee@suse.com" date="1755604801">- Removed the following patches because they are merged to shim 16.1:
  - shim-alloc-one-more-byte-for-sprintf.patch
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch</changelog>
</package>
<package pkgid="cb915097f937efe36b996c638c49c590ba097a37d23402c1277f88f7f235391a" name="shim-nx" arch="x86_64">
  <version epoch="0" ver="16.1" rel="150700.10.9"/>
  <changelog author="dimstar@opensuse.org" date="1708948800">- Use %autosetup macro. Allows to eliminate the usage of deprecated
  PatchN.</changelog>
  <changelog author="glin@suse.com" date="1712059200">- Introduce %shim_use_fde_tpm_helper macro so that the project
  can include the fde-tpm-helper-macros for the build targets
  other than Tumbleweed</changelog>
  <changelog author="dennis.tseng@suse.com" date="1719316800">- Update asc files of shim-15.8 after being signed back from
  Microsoft, including:
  signature-opensuse.x86_64.asc,
  signature-opensuse.aarch64.asc,
  signature-sles.x86_64.asc,
  signature-sles.aarch64.asc.
- Enable aarch64 signature comparison which was disabled temporarily
  before. Now, we got a real one. So it is enabled again.</changelog>
  <changelog author="glin@suse.com" date="1726488000">- Update shim-install to apply the missing fix for openSUSE Leap
  (bsc#1210382)
  * 86b73d1 Fix that bootx64.efi is not updated on Leap
- Update shim-install to use the 'removable' way for SL-Micro
  (bsc#1230316)
  * 433cc4e Always use the removable way for SL-Micro</changelog>
  <changelog author="glin@suse.com" date="1726747200">- Update shim-install to limit the scope of the 'removable'
  SL-Micro to the image booting with TPM2 unsealing (bsc#1210382)
  * 769e41d Limit the removable option to encrypted SL-Micro</changelog>
  <changelog author="mls@suse.de" date="1734696000">- undefine %_enable_debug_packages to fix building with rpm-4.20</changelog>
  <changelog author="dennis.tseng@suse.com" date="1746532800">-- Update to version 16.0
  - remove shim-bsc1177315-verify-eku-codesign.patch
    remove it because shim github upstream has accepted it (PR #664)
  - add revoked-SLES-UEFI-SIGN-Certificate-2022-05.crt to revoked certificates for dbx
    SLES-UEFI-SIGN-Certificate-20220525.crt can be blacklisted,
    and can be added to the vendor dbx.
  - add shim-alloc-one-more-byte-for-sprintf.patch (bsc#1240871)
    The codes already submitted to git upstream (PR #746)
    In generate_sbat_var_defs.c, realloc() should allocate one more byte for
    the end of string '\0' when running sprintf() later.
  - Patches (git log --oneline --reverse 15.8..16.0)
    126a07e Validate that a supplied vendor cert is not in PEM format
    63edf92 sbat: Add grub.peimage,2 to latest (CVE-2024-2312)
    3e1394e sbat: Also bump latest for grub,4 (and to todays date)
    470a8cd undo change that limits certificate files to a single file
    0287c6b shim: don't set second_stage to the empty string
    3685b13 Fix SBAT.md for today's consensus about numbers
    dc07432 Realize the suggestions as part of PR #672
    e064e7d Update Code of Conduct contact address
    e68f4ca make-certs: Handle missing OpenSSL installation
    74a1f29 Update MokVars.txt  - Update documented mirrored variable attributes from RT to BS,RT  - Add missing MokSBStateRT  - Clarify that MokIgnoreDB is a mirror of MokDBState  - Add missing attributes for MokPWStore
    f6674fe export DEFINES for sub makefile
    47bbb5e Drop unused EFI_IMAGE_SECURITY_DATABASE_GUID definition
    338fded Null-terminate 'arguments' in fallback
    3d1dcd4 Fix "Verifiying" typo in error message
    b5d359a CI: use checkout@v4
    1d8365f CI: work around ownership issue on github
    20094ca Update fedora CI targets
    3cf0e09 Force gcc to produce DWARF4 so that gdb can use it
    5f54182 includes: work around CLANG_PREREQ() double-definition
    ab06527 Makefile: don't warn about clang when building compile_commands.json
    0c9249d Suppress some warnings even harder in Cryptlib and OpenSSL.
    fd7e16f Add building compile_commands.json to CI
    314aecf Discard load-options that start with WINDOWS
    ac85ba4 Fix the issue that the gBS-&gt;LoadImage pointer was empty.
    d8c86b7 shim: Allow data after the end of device path node in load options
    d197220 Backport EFI_HTTP_ERROR status code
    6410312 netboot: Convert TFTP error codes to EFI status codes
    ef8e729 httpboot: Convert HTTP status codes to EFI status codes
    2a1cbe6 Update gnu-efi submodule for EFI_HTTP_ERROR
    196cbb9 Increase EFI file alignment
    ad8692e avoid EFIv2 runtime services on Apple x86 machines
    0345331 Improve shortcut performance when comparing two boolean expressions
    27562ea Fix bad reference to PathName in image loading
    1508ece Move is_removable_media_path() to a shared location.
    7864c10 Provide better error message when MokManager is not found
    3e60895 tpm: Boot with a warning if the event log is full
    b560c52 MokManager: remove redundant logical constraints
    9229e7c Make mock_set_variable() correctly account for resource usage.
    f7e1d72 tests: make it possible to use different limits for variable space
    67efdfc test-mok-mirror: refactor the validation of test_mok_mirror_0
    70366a2 test-mok-mirror: add a test case where MokListRT won't fit.
    3caa75e test-mok-mirror: minor bug fix
    dc45aa6 lib/simple_file.c: Allocate zeroed pool for SimpleFS entries
    9415d3c simple_file: Allow to form a volume name from DevicePath
    d6076cb simple_file: Use second variable to create filesystem entries
    f99749a Ignore a minor clang-tidy nit
    98173f0 Fall back to default loader when encountering errors on network boot
    e42c319 test.mk: don't use a temporary random.bin
    c66c157 pe: Enhance debug report for update_mem_attrs
    1125212 Fix leak in error path
    2daf1db Load concatenated EFI_SIGNATURE_LISTs from shim_certificate.efi
    eeca60a Update SbatLevel_Variable.txt with peimage CVE-2024-2312 revocation
    743f3fa Add generate_sbat_var_defs utility program
    5ae408a Generate and use generated_sbat_var_defs.h
    e886fb3 SbatLevel_Variable.txt: clarify where and how revocation data is tracked
    15c1a9a Implement the CodeSign EKU check to fulfill the requirements of NIAP OS_PP.
    eb02afc Optionally enabling codesign EKU check in compiling time.
    7ae0ee6 Add docs for ENABLE_CODESIGN_EKU
    38dfa37 Create utils file
    83850cd Add configuration option to boot an alternative 2nd stage
    bb114a3 Implement shim image load protocol
    e7b3598 Move some stuff around
    0322e10 Implement the rest of the loader protocol functions
    e43aea8 Add EFI_LOAD_FILE2_PROTOCOL to gnu-efi
    2bff460 loader-proto: Add support for loading files from disk to LoadImage()
    5d17278 loader-proto: Mark load_image()'s handle_image() call as "in_protocol"
    fe2ad36 Don't print full screen error dialog from handle_image() when called in_protocol
    c57af36 loader-proto: Respect optional DevicePath parameter to load_image()
    2b49dc1 Suppress file open failures for some netboot cases
    3c3295d netboot: process revocations.efi as revocations not shim_certificate
    c66ce2a Allow indepdent SkuSi and SBAT revocation updates
    6b8e40c netboot can try to load shim_certificate_[0..9].efi
    301cf52 Document how revocations can be delivered
    7cde2cc post-process-pe: add tests to validate NX compliance
    1294b47 regression: out of bounds read in CopyMem() in ad8692e
    765f294 compiler.h: minor ALIGN_... fixes
    5c1e6e4 Move error logging decls out of shim.h
    d972515 Save the debug and error logs in mok-variables
    e3f0338 Silence minor nit in load-options parsing debug output
    3d7c057 get_mem_attrs(): ensure an error code is set on failure
    49db3de mok: add MOK_VARIABLE_CONFIG_ONLY
    887c0ed mok variables: add a format callback
    e4857b4 Make test-mok-error failures *slightly* more clear.
    589c3f2 Move memory attribute support to its own file.
    848667d shim: add HSIStatus feature
    e136e64 mock-variables: fix debugging printf format specifier oopsie
    f0958ba test-mock-variables: improve some debug prints
    b216543 Move mok state variable data flag definitions to the header.
    fc0cfac Mirror some more efi variables to mok-variables
    eeda3fa gnu-efi: add some DXE services.
    c41b1f0 Add support for DXE memory attribute updates.
    9269e9b Add DXE Services information to HSI
    c868d54 hexdump: give a different debug log for size==0
    1baf1ef HSI: Add decode_hsi_bits() for easier reading of the debug log
    3bce118 pe: read_header(): allow skipping SecDir content validation
    89e6150 Add shim's current NX_COMPAT status to HSIStatus
    c5c5287 peimage.h: minor whitespace fixes
    5007d83 peimage: add a bunch of comments to read_header()
    489af5e README.tpm: reflect that vendor_db is in fact logged as "vendor_db"
    1958b0f reject message with different values in multiple Content-Length header field
    9c423e0 Some save_logs() improvements.
    81d40e3 Disable log saving for now.
    498b149 fallback: don't add new boot order entries backwards
    06d8dec makefiles: Make GITTAG swizzle tildes to dashes
    f02b2c1 make-archive: some minor housekeeping
    794d237 Update version to 16.0~rc1
    d45c610 SetSecureVariable(): free Cert on failure
    76fab7b generate_sbat_var_defs: run clang-format on readfile()
    6dadb70 generate_sbat_var_defs: Fix memory leak on realloc failure and fd leak.
    f58c77e generate_sbat_var_defs: Ensure revlistentry-&gt;revocations is initialized.
    b427a34 mirror_mok_db(): get rid of an unused variable+allocation
    92630f2 mirror_one_mok_variable(): fix a memory leak on TPM log error.
    38f0a9c mirror_mok_db(): Free our mok variable name correctly
    db04321 shim_load_image(): initialize the buffer fully
    7b75382 simple_dir_filter(): test our 'next' pointer
    db1f1da Make 'make fanalyzer' work again.
    28d8871 README.tpm: Update MokList entry to MokListRT
    8932527 SBAT Level update for February 2025 GRUB CVEs
    18d98bf Update version to 16.0</changelog>
  <changelog author="dennis.tseng@suse.com" date="1748433600">- add revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt into dbx
- build shim with EKU enable flag (ENABLE_CODESIGN_EKU)
  remove EKU enable flag when build MokManager and fallback</changelog>
  <changelog author="dennis.tseng@suse.com" date="1749124800">- rename incorrect certificat name revoked-SLES-UEFI-SIGN-Certificate-2022-06.crt
  to revoked-openSUSE-UEFI-SIGN-Certificate-2022-06.crt, and
  re-arrange its sequence.</changelog>
  <changelog author="jlee@suse.com" date="1751976000">- The old shim-16.0.tar.bz2 is repackaged from a local source which
  includes quilt series files. It causes that we can not direct add
  new patch file through shim.spec. I replaced it by shim-16.0 tarball
  from upstream:
  https://github.com/rhboot/shim/releases/download/16.0/shim-16.0.tar.bz2</changelog>
  <changelog author="jlee@suse.com" date="1753444800">- Add shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - shim: change automatically enable MOK_POLICY_REQUIRE_NX (PR #761)
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753444801">- Building out shim.nx.efi for supporting non-executable
  - Building additional shim with POST_PROCESS_PE_FLAGS=-n to set
    the PE NX-compatibility DLL. (NxCompatible field in DllCharacteristics)
  - Packaging shim.nx.efi to shim-nx RPM.
  - Add MS signatures for shim.nx
  - signature-opensuse-nx.x86_64.asc
    signature-sles-nx.x86_64.asc
    signature-opensuse-nx.aarch64.asc
    signature-sles-nx.aarch64.asc
  - We direc copy signatures of shim for shim.nx before we got
    signatures from Microsoft.
- Building MokManager.efi and fallback.efi with POST_PROCESS_PE_FLAGS=-n
  (bsc#1205588)</changelog>
  <changelog author="jlee@suse.com" date="1753617600">- Add pre script to shim package for checking UEFI db has valid key for shim.
  It prevents that SUSE shim be installed on a machine which can no verify
  and boot with it when secure boot is enabled.
  User can still install shim success when secure boot is disabled even no
  valid key in UEFI db. User should aware that shim can not be boot when
  secure boot is enabled.
  This checking will useful for changing Microsoft or SUSE CA in the future.
  The shim be signed by new MS/SUSE key will NOT be installed on a machine
  which does not have new key in UEFI db when secure boot is enabled. It
  can prevent booting fail after shim package is updated.</changelog>
  <changelog author="jlee@suse.com" date="1753704000">- Removed pre script in shim package for checking UEFI db has valid key
  for shim because it will interrupt group update of RPMs. It should be
  moved to %pretrans and re-written by lua.</changelog>
  <changelog author="jlee@suse.com" date="1753963200">- Add shim-disable-dxe-get-mem-attrs.patch
  - On old edk2-stable202308 ovmf, running dxe_get_mem_attrs() causes
    get_hsi_mem_info() confusion on hsi_status. It looks that hsi_status
    has a copy after running dxe_get_mem_attrs(). Those elements in
    hsi_nx_is_enforced(), HEAPX|STACKX|ROW can NOT set into hsi_status.
    Let's disabling the approach of DXE get memory attributes until
    we found the root cause.
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754136000">- Using gcc13 for building shim/shim-nx
  - The gcc13 can workaround dxe_get_mem_attrs() hsi_status problem
  - Add the following changes to shim.spec :
    define gcc_version 13
    global cc_compiler /usr/bin/gcc-%{gcc_version}
    BuildRequires  gcc%{gcc_version}
    make CC=%{cc_compiler} RELEASE=0
- Remove shim-disable-dxe-get-mem-attrs.patch
  - This downstream patch can be removed after moving to gcc13
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1754481600">- Building with the latest version of gcc in the codebase:
  - We prefer that building shim with the latest version of gcc in codebase.
  - Set the minimum version is gcc-13.
    if gcc_version &lt; 13
    define gcc_version 13
    endif
  (bsc#1247432)</changelog>
  <changelog author="jlee@suse.com" date="1755000000">- SLE shim should includes vendor-dbx-sles.esl instead of
  vendor-dbx-opensuse.esl. Fixed it in shim.spec.
    verify='SUSE Linux Enterprise Secure Boot CA1'
-       vendor_dbx='vendor-dbx-opensuse.esl'
  +       vendor_dbx='vendor-dbx-sles.esl'</changelog>
  <changelog author="jlee@suse.com" date="1755604800">- Update to 16.1
  - Patches (git log --oneline --reverse 16.0..16.1)
    4040ec4 shim_start_image(): fix guid/handle pairing when uninstalling protocols
    39c0aa1 str2ip6(): parsing of "uncompressed" ipv6 addresses
    3133d19 test-mock-variables: make our filter list entries safer.
    d44405e mock-variables: remove unused variable
    0e8459f Update CI to use ubuntu-24.04 instead of ubuntu-20.04
    d16a5a6 SbatLevel_Variable.txt: minor typo fix.
    32804cf Realloc() needs one more byte for sprintf()
    431d370 IPv6: Add more check to avoid multiple double colon and illegal char
    5e4d93c Loader Proto: make freeing of bprop.buffer conditional.
    33deac2 Prepare to move things from shim.c to verify.c
    030e7df Move a bunch of stuff from shim.c to verify.c
    f3ddda7 handle_image(): make verification conditional
    774f226 Cache sections of a loaded image and sub-images from them.
    eb0d20b loader-protocol: handle sub-section loading for UKIs
    2f64bb9 loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages
    1abc7ca loader-protocol: NULL output variable in load_image on failure
    fb77b44 Generate Authenticode for the entire PE file
    b86b909 README: mention new loader protocol and interaction with UKIs
    8522612 ci: add mkosi configuration and CI
    9ebab84 mkosi workflow: fix the branch name for main.
    72a4c41 shim: change automatically enable MOK_POLICY_REQUIRE_NX
    a2f0dfa This is an organizational patch to move some things around in mok.c
    54b9946 Update to the shim-16.1 branch of gnu-efi to get AsciiSPrint()
    a5a6922 get_max_var_sz(): add more debugging for apple platforms
    77a2922 Add a "VariableInfo" variable to mok-variables.
    efc71c9 build: Avoid passing *FLAGS to sub-make
    7670932 Fixes for 'make TOPDIR=... clean'
    13ab598 add SbatLevel entry 2025051000 for PSA-2025-00012-1
    617aed5 Update version to 16.1~rc1
    d316ba8 format_variable_info(): fix wrong size test.
    f5fad0e _do_sha256_sum(): Fix missing error check.
    3a9734d doc: add howto for running mkosi locally
    ced5f71 mkosi: remove spurious slashes from script
    0076155 ci: update mkosi commit
    5481105 fix http boot
    121cddf loader-protocol: Handle UnloadImage after StartImage properly
    6a1d1a9 loader-protocol: Fix memory leaks
    27a5d22 gitignore: add more mkosi dirs and vscode dir
    346ed15 mkosi: disable repository key check on Fedora
    afc4955 Update version to 16.1
  - 16.1 release note https://github.com/rhboot/shim/releases
    shim_start_image(): fix guid/handle pairing when uninstalling protocols by @vathpela in #738
    Fix uncompressed ipv6 netboot by @hrvach in #742
    fix test segfaults caused by uninitialized memory by @Fabian-Gruenbichler in #739
    Update CI to use ubuntu-24.04 instead of ubuntu-20.04 by @vathpela in #749
    SbatLevel_Variable.txt: minor typo fix. by @vathpela in #751
    Realloc() needs to allocate one more byte for sprintf() by @dennis-tseng99 in #746
    IPv6: Add more check to avoid multiple double colon and illegal char by @dennis-tseng99 in #753
    Loader proto v2 by @vathpela in #748
    loader-protocol: add workaround for EDK2 2025.02 page fault on FreePages by @bluca in #750
    Generate Authenticode for the entire PE file by @esnowberg in #604
    README: mention new loader protocol and interaction with UKIs by @bluca in #755
    ci: add mkosi configuration and CI by @bluca in #764
    shim: change automatically enable MOK_POLICY_REQUIRE_NX by @vathpela in #761
    Save var info by @vathpela in #763
    build: Avoid passing *FLAGS to sub-make by @rosslagerwall in #758
    Fixes for 'make TOPDIR=... clean' by @bluca in #762
    add SbatLevel entry 2025051000 for PSA-2025-00012-1 by @Fabian-Gruenbichler in #766
    Coverity fixes 20250804 by @vathpela in #767
    ci: fixlets and docs for mkosi workflow by @bluca in #768
    fix http boot by @jsetje in #770
    Fix double free and leak in the loader protocol by @rosslagerwall in #769
    gitignore: add more mkosi dirs and vscode dir by @bluca in #771
  - Drop upstreamed patch:
    The following patches are merged to 16.1
  - shim-alloc-one-more-byte-for-sprintf.patch
  - 32804cf5d9 Realloc() needs one more byte for sprintf()    [16.1]
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch
  - 72a4c41877 shim: change automatically enable MOK_POLICY_REQUIRE_NX [16.1]</changelog>
  <changelog author="jlee@suse.com" date="1755604801">- Removed the following patches because they are merged to shim 16.1:
  - shim-alloc-one-more-byte-for-sprintf.patch
  - shim-change-automatically-enable-MOK_POLICY_REQUIRE_NX.patch</changelog>
</package>
<package pkgid="b2f935c2685082df3e806dd770d5d69e4cb95299495fd750fe3432bbad75281f" name="shim-pretrans" arch="aarch64">
  <version epoch="0" ver="0.1" rel="150700.7.1"/>
  <changelog author="jlee@suse.com" date="1773144000">- Initial</changelog>
</package>
<package pkgid="21a658e7bb84455be3f94b6979384b5caf770a318f45610d7ce2614265f65785" name="shim-pretrans" arch="src">
  <version epoch="0" ver="0.1" rel="150700.7.1"/>
  <changelog author="jlee@suse.com" date="1773144000">- Initial</changelog>
</package>
<package pkgid="46eb20b1675737c509f57268cd9525d44143c1785c7e49501c5d0e2ab4e0a082" name="shim-pretrans" arch="x86_64">
  <version epoch="0" ver="0.1" rel="150700.7.1"/>
  <changelog author="jlee@suse.com" date="1773144000">- Initial</changelog>
</package>
</otherdata>