Version in base suite: 1+15+1533136590.3beb971+7+deb10u1 Version in overlay suite: 1+15.4+2~deb10u1 Base version: shim-helpers-arm64-signed_1+15.4+2~deb10u1 Target version: shim-helpers-arm64-signed_1+15.4+3~deb10u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/shim-helpers-arm64-signed/shim-helpers-arm64-signed_1+15.4+2~deb10u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/shim-helpers-arm64-signed/shim-helpers-arm64-signed_1+15.4+3~deb10u1.dsc /srv/release.debian.org/tmp/_4ZJ9iJYlk/shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/signatures/shim-unsigned/usr/lib/shim/fbaa64.efi.sig |binary /srv/release.debian.org/tmp/_4ZJ9iJYlk/shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/signatures/shim-unsigned/usr/lib/shim/mmaa64.efi.sig |binary shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/changelog | 6 shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/control | 6 shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/shim-helpers-arm64-signed.postinst | 81 ++++++++++ shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/shim-helpers-arm64-signed.postrm | 53 ++++++ 6 files changed, 140 insertions(+), 6 deletions(-) gpgv: Signature made Thu Apr 29 15:25:09 2021 UTC gpgv: using RSA key 7CA15FBC7108FA0914F84F9D8B415188B74E3736 gpgv: Can't check signature: No public key dpkg-source: warning: failed to verify signature on /srv/release.debian.org/tmp/tmp6g5vxldg/shim-helpers-arm64-signed_1+15.4+2~deb10u1.dsc gpgv: Signature made Thu May 6 17:54:16 2021 UTC gpgv: using RSA key 7CA15FBC7108FA0914F84F9D8B415188B74E3736 gpgv: Can't check signature: No public key dpkg-source: warning: failed to verify signature on /srv/release.debian.org/tmp/tmp6g5vxldg/shim-helpers-arm64-signed_1+15.4+3~deb10u1.dsc diff -Nru shim-helpers-arm64-signed-1+15.4+2~deb10u1/debian/changelog shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/changelog --- shim-helpers-arm64-signed-1+15.4+2~deb10u1/debian/changelog 2021-04-21 00:06:27.000000000 +0000 +++ shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/changelog 2021-05-03 20:31:33.000000000 +0000 @@ -1,8 +1,8 @@ -shim-helpers-arm64-signed (1+15.4+2~deb10u1) buster; urgency=medium +shim-helpers-arm64-signed (1+15.4+3~deb10u1) buster; urgency=medium - * Update to shim 15.4-2~deb10u1 + * Update to shim 15.4-3~deb10u1 - -- Debian signing service Wed, 21 Apr 2021 01:06:27 +0100 + -- Debian signing service Mon, 03 May 2021 21:31:33 +0100 shim-helpers-arm64-signed (1) unstable; urgency=medium diff -Nru shim-helpers-arm64-signed-1+15.4+2~deb10u1/debian/control shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/control --- shim-helpers-arm64-signed-1+15.4+2~deb10u1/debian/control 2021-04-21 00:06:27.000000000 +0000 +++ shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/control 2021-05-03 20:31:33.000000000 +0000 @@ -5,15 +5,15 @@ Standards-Version: 4.3.0 Build-Depends: debhelper (>= 10.1~), sbsigntool [amd64 arm64 i386], - shim-unsigned (= 15.4-2~deb10u1), + shim-unsigned (= 15.4-3~deb10u1), Package: shim-helpers-arm64-signed Architecture: arm64 Conflicts: shim (<< 15+1533136590.3beb971-3~), Replaces: shim (<< 15+1533136590.3beb971-3~), shim-signed (<< 1.29), Breaks: shim-signed (<< 1.29), -Depends: shim-unsigned (>= 15.4-2~deb10u1), ${misc:Depends}, -Built-Using: shim (= 15.4-2~deb10u1) +Depends: shim-unsigned (>= 15.4-3~deb10u1), ${misc:Depends}, +Built-Using: shim (= 15.4-3~deb10u1) Description: boot loader to chain-load signed boot loaders (signed by Debian) This package provides a minimalist boot loader which allows verifying signatures of other UEFI binaries against either the Secure Boot DB/DBX or diff -Nru shim-helpers-arm64-signed-1+15.4+2~deb10u1/debian/shim-helpers-arm64-signed.postinst shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/shim-helpers-arm64-signed.postinst --- shim-helpers-arm64-signed-1+15.4+2~deb10u1/debian/shim-helpers-arm64-signed.postinst 1970-01-01 00:00:00.000000000 +0000 +++ shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/shim-helpers-arm64-signed.postinst 2021-05-03 20:31:33.000000000 +0000 @@ -0,0 +1,81 @@ +#! /bin/sh +set -e + +# Must load the confmodule for our template to be installed correctly. +. /usr/share/debconf/confmodule + +# Select the right target architecture for grub-install +ARCH=arm64 +case ${ARCH} in + i386|amd64) + FW_SIZE=$(cat /sys/firmware/efi/fw_platform_size) + if [ "$FW_SIZE"x = "32"x ]; then + GRUB_EFI_TARGET="i386-efi" + elif [ "$FW_SIZE"x = "64"x ]; then + GRUB_EFI_TARGET="x86_64-efi" + else + echo "Unable to read a valid value from fw_platform_size, ABORT" + exit 1 + fi + ;; + arm64) + GRUB_EFI_TARGET="arm64-efi" + ;; + *) + echo "Unsupported dpkg architecture ${ARCH} in $0. ABORT" + exit 1 + ;; +esac + +# Pull out a config value from /etc/default/grub +config_item () +{ + if [ -f /etc/default/grub ]; then + . /etc/default/grub || return + for x in /etc/default/grub.d/*.cfg; do + if [ -e "$x" ]; then + . "$x" + fi + done + fi + eval echo "\$$1" +} + +case $1 in + configure) + bootloader_id="$(config_item GRUB_DISTRIBUTOR | tr A-Z a-z | \ + cut -d' ' -f1)" + case $bootloader_id in + kubuntu) bootloader_id=ubuntu ;; + esac + + # Call grub-install to make sure we're added to the ESP as + # needed + if [ "$bootloader_id" ] && \ + [ -d "/boot/efi/EFI/$bootloader_id" ] && \ + [ -d /sys/firmware/efi ] && \ + which grub-install >/dev/null 2>&1 + then + # Check for some of the options that matter, so we can + # call grub-install safely without dropping them + OPTIONS="" + + db_get grub2/force_efi_extra_removable + if [ "$RET" = true ]; then + OPTIONS="$OPTIONS --force-extra-removable" + fi + + db_get grub2/update_nvram + if [ "$RET" = false ]; then + OPTIONS="$OPTIONS --no-nvram" + fi + + grub-install --target=${GRUB_EFI_TARGET} $OPTIONS + fi + ;; +esac + +#DEBHELPER# + +exit 0 + diff -Nru shim-helpers-arm64-signed-1+15.4+2~deb10u1/debian/shim-helpers-arm64-signed.postrm shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/shim-helpers-arm64-signed.postrm --- shim-helpers-arm64-signed-1+15.4+2~deb10u1/debian/shim-helpers-arm64-signed.postrm 1970-01-01 00:00:00.000000000 +0000 +++ shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/shim-helpers-arm64-signed.postrm 2021-05-03 20:31:33.000000000 +0000 @@ -0,0 +1,53 @@ +#! /bin/sh +set -e + +case arm64 in + i386) + SHIM_REMOVE="mmia32.efi fbia32.efi";; + amd64) + SHIM_REMOVE="mmx64.efi fbx64.efi";; + arm64) + SHIM_REMOVE="mmaa64.efi fbaa64.efi";; + *) + echo "Unsupported dpkg architecture arm64 in $0. ABORT" + exit 1 + ;; +esac + +# Pull out a config value from /etc/default/grub +config_item () +{ + if [ -f /etc/default/grub ]; then + . /etc/default/grub || return + for x in /etc/default/grub.d/*.cfg; do + if [ -e "$x" ]; then + . "$x" + fi + done + fi + eval echo "\$$1" +} + +case $1 in + remove|purge) + bootloader_id="$(config_item GRUB_DISTRIBUTOR | tr A-Z a-z | \ + cut -d' ' -f1)" + case $bootloader_id in + kubuntu) bootloader_id=ubuntu ;; + esac + + # If we're being removed, remove the copies installed in the + # ESP. grub-install doesn't clean those up for us. + if [ "$bootloader_id" ] && \ + [ -d "/boot/efi/EFI/$bootloader_id" ] && \ + [ -d /sys/firmware/efi ]; then + + cd /boot/efi/EFI/$bootloader_id + rm -f $SHIM_REMOVE + fi + ;; +esac + +#DEBHELPER# + +exit 0 Binary files /srv/release.debian.org/tmp/Eq4P2G2yYi/shim-helpers-arm64-signed-1+15.4+2~deb10u1/debian/signatures/shim-unsigned/usr/lib/shim/fbaa64.efi.sig and /srv/release.debian.org/tmp/_4ZJ9iJYlk/shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/signatures/shim-unsigned/usr/lib/shim/fbaa64.efi.sig differ Binary files /srv/release.debian.org/tmp/Eq4P2G2yYi/shim-helpers-arm64-signed-1+15.4+2~deb10u1/debian/signatures/shim-unsigned/usr/lib/shim/mmaa64.efi.sig and /srv/release.debian.org/tmp/_4ZJ9iJYlk/shim-helpers-arm64-signed-1+15.4+3~deb10u1/debian/signatures/shim-unsigned/usr/lib/shim/mmaa64.efi.sig differ