Attachment #196712 for bug #231029




# Created by: Edward Tomasz Napierala <trasz@FreeBSD.org>
# $FreeBSD$

PORTNAME=	shim
PORTVERSION=	0.9
PORTREVISION=	6
CATEGORIES=	sysutils

MAINTAINER=	egypcio@googlemail.com
COMMENT=	UEFI Secure Boot shim loader

LICENSE=	BSD2CLAUSE
LICENSE_FILE=	${WRKSRC}/COPYRIGHT

BUILD_DEPENDS=	${LOCALBASE}/lib/libgnuefi.a:devel/gnu-efi \
		bash:shells/bash

USE_GITHUB=	yes
GH_ACCOUNT=	mjg59

USES=		compiler gmake
USE_CSTD=	gnu89
USE_GCC=	yes
USE_GITHUB=	yes
MAKE_ARGS=	CC="${CC} ${CFLAGS:M-std=*}" LD="${LD}" OBJCOPY="${OBJCOPY}"
MAKE_JOBS_UNSAFE=	yes
ONLY_FOR_ARCHS=	amd64

PLIST_FILES=	lib/shim/shim.pem lib/shim/shim.key \
		lib/shim/MokManager.efi lib/shim/fallback.efi lib/shim/shim.efi

post-patch:
	@${REINPLACE_CMD} -e "s|/bin/bash|${LOCALBASE}/bin/bash|" ${WRKSRC}/make-certs

do-install:
	# Note that before this step, the shim.pem contains the _private_ key.
	openssl x509 -inform der -in ${WRKSRC}/shim.cer -outform pem -out ${WRKSRC}/shim.pem
	${MKDIR} ${STAGEDIR}/${PREFIX}/lib/shim
	${INSTALL_DATA} -m 600 ${WRKSRC}/shim.key ${STAGEDIR}/${PREFIX}/lib/shim
	${INSTALL_DATA} ${WRKSRC}/shim.pem ${STAGEDIR}/${PREFIX}/lib/shim
	${INSTALL_DATA} ${WRKSRC}/shim.efi ${STAGEDIR}/${PREFIX}/lib/shim
	${INSTALL_DATA} ${WRKSRC}/MokManager.efi ${STAGEDIR}/${PREFIX}/lib/shim
	${INSTALL_DATA} ${WRKSRC}/fallback.efi ${STAGEDIR}/${PREFIX}/lib/shim

.include <bsd.port.mk>

Lines 1-2 Link Here

(-)sysutils/shim/distinfo (-2 / +3 lines)
1	SHA256 (mjg59-shim-0.8_GH0.tar.gz) = 668629b51179d4832415d5c3ebf0cdb28feaae16e7158d8fc6e3740a1a29cdd8	1	TIMESTAMP = 1535569510
2	SIZE (mjg59-shim-0.8_GH0.tar.gz) = 1251831	2	SHA256 (mjg59-shim-0.9_GH0.tar.gz) = d277d7bea0b5d554dacf284d84252a5e995fb4ef54b6de5ec6296c6c2a9a21bd
		3	SIZE (mjg59-shim-0.9_GH0.tar.gz) = 1302211




--- Makefile.orig	2015-06-30 18:20:12.000000000 +0000
+++ Makefile	2018-08-30 16:35:51.966986000 +0000
@@ -1,5 +1,5 @@
 VERSION		= 0.9
-RELEASE		:=
+RELEASE		:= ""
 ifneq ($(RELEASE),"")
 	RELEASE="-$(RELEASE)"
 endif
@@ -9,15 +9,20 @@
 OBJCOPY		= $(CROSS_COMPILE)objcopy
 
 ARCH		= $(shell $(CC) -dumpmachine | cut -f1 -d- | sed s,i[3456789]86,ia32,)
+
+ifeq ($(ARCH),amd64)
+	override ARCH := x86_64
+endif
+
 OBJCOPY_GTE224  = $(shell expr `$(OBJCOPY) --version |grep ^"GNU objcopy" | sed 's/^.* //g' | cut -f1-2 -d.` \>= 2.24)
 
 SUBDIRS		= Cryptlib lib
 
-LIB_PATH	= /usr/lib64
+LIB_PATH	= /usr/lib -L$(LOCALBASE)/lib
 
-EFI_INCLUDE	:= /usr/include/efi
-EFI_INCLUDES	= -nostdinc -ICryptlib -ICryptlib/Include -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH) -I$(EFI_INCLUDE)/protocol -I$(shell pwd)/include
 EFI_INCLUDES	= -nostdinc -ICryptlib -ICryptlib/Include -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH) -I$(EFI_INCLUDE)/protocol -Iinclude
-EFI_PATH	:= /usr/lib64/gnuefi
+EFI_INCLUDE	:= $(LOCALBASE)/include/efi
+EFI_INCLUDES	= -nostdinc -ICryptlib -ICryptlib/Include -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH) -I$(EFI_INCLUDE)/protocol -I$(shell pwd)/include -I/usr/include
+EFI_PATH	:= $(LOCALBASE)/lib
 
 LIB_GCC		= $(shell $(CC) -print-libgcc-file-name)
 EFI_LIBS	= -lefi -lgnuefi --start-group Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a --end-group $(LIB_GCC) 
@@ -65,7 +70,7 @@
 
 LDFLAGS		= --hash-style=sysv -nostdlib -znocombreloc -T $(EFI_LDS) -shared -Bsymbolic -L$(EFI_PATH) -L$(LIB_PATH) -LCryptlib -LCryptlib/OpenSSL $(EFI_CRT_OBJS) --build-id=sha1
 
-TARGET	= shim.efi MokManager.efi.signed fallback.efi.signed
+TARGET	= shim.efi MokManager.efi fallback.efi
 OBJS	= shim.o netboot.o cert.o replacements.o version.o
 KEYS	= shim_cert.h ocsp.* ca.* shim.crt shim.csr shim.p12 shim.pem shim.key shim.cer
 SOURCES	= shim.c shim.h netboot.c include/PeImage.h include/wincert.h include/console.h replacements.c replacements.h version.c version.h
@@ -156,9 +161,6 @@
 		-j .note.gnu.build-id \
 		$(FORMAT) $^ $@.debug
 
-%.efi.signed: %.efi certdb/secmod.db
-	pesign -n certdb -i $< -c "shim" -s -o $@ -f
-
+#	pesign -n certdb -i $< -c "shim" -s -o $@ -f
 
 clean:
 	$(MAKE) -C Cryptlib clean
 	$(MAKE) -C Cryptlib/OpenSSL clean

Return to bug 231029

Lines 1-44 Link Here

(-)sysutils/shim/Makefile (-4 / +4 lines)
1	# Created by: Edward Tomasz Napierala <trasz@FreeBSD.org>	1	# Created by: Edward Tomasz Napierala <trasz@FreeBSD.org>
2	# $FreeBSD$	2	# $FreeBSD$
3		3
4	PORTNAME= shim	4	PORTNAME= shim
5	PORTVERSION= 0.8	5	PORTVERSION= 0.9
6	PORTREVISION= 6
7	CATEGORIES= sysutils	6	CATEGORIES= sysutils
8		7
9	MAINTAINER= ports@FreeBSD.org	8	MAINTAINER= egypcio@googlemail.com
10	COMMENT= UEFI Secure Boot shim loader	9	COMMENT= UEFI Secure Boot shim loader
11		10
12	LICENSE= BSD2CLAUSE	11	LICENSE= BSD2CLAUSE
		12	LICENSE_FILE= ${WRKSRC}/COPYRIGHT
13		13
14	BUILD_DEPENDS= ${LOCALBASE}/lib/libgnuefi.a:devel/gnu-efi \	14	BUILD_DEPENDS= ${LOCALBASE}/lib/libgnuefi.a:devel/gnu-efi \
15	bash:shells/bash	15	bash:shells/bash
16		16
17	USE_GITHUB= yes	17	USE_GITHUB= yes
18	GH_ACCOUNT= mjg59	18	GH_ACCOUNT= mjg59
19		19
20	USES= gmake	20	USES= compiler gmake
21	USE_CSTD= gnu89	21	USE_CSTD= gnu89
22	USE_GCC= yes	22	USE_GCC= yes
23	USE_GITHUB= yes	23	USE_GITHUB= yes
24	MAKE_ARGS= CC="${CC} ${CFLAGS:M-std=*}" LD="${LD}" OBJCOPY="${OBJCOPY}"	24	MAKE_ARGS= CC="${CC} ${CFLAGS:M-std=*}" LD="${LD}" OBJCOPY="${OBJCOPY}"
25	MAKE_JOBS_UNSAFE= yes	25	MAKE_JOBS_UNSAFE= yes
26	ONLY_FOR_ARCHS= amd64	26	ONLY_FOR_ARCHS= amd64
27		27
28	PLIST_FILES= lib/shim/shim.pem lib/shim/shim.key \	28	PLIST_FILES= lib/shim/shim.pem lib/shim/shim.key \
29	lib/shim/MokManager.efi lib/shim/fallback.efi lib/shim/shim.efi	29	lib/shim/MokManager.efi lib/shim/fallback.efi lib/shim/shim.efi
30		30
31	post-patch:	31	post-patch:
32	@${REINPLACE_CMD} -e "s\|/bin/bash\|${LOCALBASE}/bin/bash\|" ${WRKSRC}/make-certs	32	@${REINPLACE_CMD} -e "s\|/bin/bash\|${LOCALBASE}/bin/bash\|" ${WRKSRC}/make-certs
33		33
34	do-install:	34	do-install:
35	# Note that before this step, the shim.pem contains the _private_ key.	35	# Note that before this step, the shim.pem contains the _private_ key.
36	openssl x509 -inform der -in ${WRKSRC}/shim.cer -outform pem -out ${WRKSRC}/shim.pem	36	openssl x509 -inform der -in ${WRKSRC}/shim.cer -outform pem -out ${WRKSRC}/shim.pem
37	${MKDIR} ${STAGEDIR}/${PREFIX}/lib/shim	37	${MKDIR} ${STAGEDIR}/${PREFIX}/lib/shim
38	${INSTALL_DATA} -m 600 ${WRKSRC}/shim.key ${STAGEDIR}/${PREFIX}/lib/shim	38	${INSTALL_DATA} -m 600 ${WRKSRC}/shim.key ${STAGEDIR}/${PREFIX}/lib/shim
39	${INSTALL_DATA} ${WRKSRC}/shim.pem ${STAGEDIR}/${PREFIX}/lib/shim	39	${INSTALL_DATA} ${WRKSRC}/shim.pem ${STAGEDIR}/${PREFIX}/lib/shim
40	${INSTALL_DATA} ${WRKSRC}/shim.efi ${STAGEDIR}/${PREFIX}/lib/shim	40	${INSTALL_DATA} ${WRKSRC}/shim.efi ${STAGEDIR}/${PREFIX}/lib/shim
41	${INSTALL_DATA} ${WRKSRC}/MokManager.efi ${STAGEDIR}/${PREFIX}/lib/shim	41	${INSTALL_DATA} ${WRKSRC}/MokManager.efi ${STAGEDIR}/${PREFIX}/lib/shim
42	${INSTALL_DATA} ${WRKSRC}/fallback.efi ${STAGEDIR}/${PREFIX}/lib/shim	42	${INSTALL_DATA} ${WRKSRC}/fallback.efi ${STAGEDIR}/${PREFIX}/lib/shim
43		43
44	.include <bsd.port.mk>	44	.include <bsd.port.mk>

Lines 1-43 Link Here

(-)sysutils/shim/files/patch-Makefile (-15 / +25 lines)
1	--- Makefile.orig 2014-10-13 22:41:51.000000000 +0200	1	--- Makefile.orig 2015-06-30 18:20:12.000000000 +0000
2	+++ Makefile 2014-12-21 16:18:40.000000000 +0100	2	+++ Makefile 2018-08-30 16:35:51.966986000 +0000
3	@@ -4,13 +1,17 @@	3	@@ -1,5 +1,5 @@
		4	VERSION = 0.9
		5	-RELEASE :=
		6	+RELEASE := ""
		7	ifneq ($(RELEASE),"")
		8	RELEASE="-$(RELEASE)"
		9	endif
		10	@@ -9,15 +9,20 @@
		11	OBJCOPY = $(CROSS_COMPILE)objcopy
4		12
5	ARCH = $(shell $(CC) -dumpmachine \| cut -f1 -d- \| sed s,i[3456789]86,ia32,)	13	ARCH = $(shell $(CC) -dumpmachine \| cut -f1 -d- \| sed s,i[3456789]86,ia32,)
6		14	+
7	+ifeq ($(ARCH),amd64)	15	+ifeq ($(ARCH),amd64)
8	+ override ARCH := x86_64	16	+ override ARCH := x86_64
9	+endif	17	+endif
10	+	18	+
		19	OBJCOPY_GTE224 = $(shell expr `$(OBJCOPY) --version \|grep ^"GNU objcopy" \| sed 's/^.* //g' \| cut -f1-2 -d.` \>= 2.24)
		20
11	SUBDIRS = Cryptlib lib	21	SUBDIRS = Cryptlib lib
12		22
13	-LIB_PATH = /usr/lib64	23	-LIB_PATH = /usr/lib64
14	+LIB_PATH = $(LOCALBASE)/lib	24	+LIB_PATH = /usr/lib -L$(LOCALBASE)/lib
15		25
16	-EFI_INCLUDE := /usr/include/efi	26	-EFI_INCLUDE := /usr/include/efi
17	+EFI_INCLUDE := $(LOCALBASE)/include/efi	27	-EFI_INCLUDES = -nostdinc -ICryptlib -ICryptlib/Include -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH) -I$(EFI_INCLUDE)/protocol -I$(shell pwd)/include
18	EFI_INCLUDES = -nostdinc -ICryptlib -ICryptlib/Include -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH) -I$(EFI_INCLUDE)/protocol -Iinclude
19	-EFI_PATH := /usr/lib64/gnuefi	28	-EFI_PATH := /usr/lib64/gnuefi
		29	+EFI_INCLUDE := $(LOCALBASE)/include/efi
		30	+EFI_INCLUDES = -nostdinc -ICryptlib -ICryptlib/Include -I$(EFI_INCLUDE) -I$(EFI_INCLUDE)/$(ARCH) -I$(EFI_INCLUDE)/protocol -I$(shell pwd)/include -I/usr/include
20	+EFI_PATH := $(LOCALBASE)/lib	31	+EFI_PATH := $(LOCALBASE)/lib
21		32
22	LIB_GCC = $(shell $(CC) -print-libgcc-file-name)	33	LIB_GCC = $(shell $(CC) -print-libgcc-file-name)
23	EFI_LIBS = -lefi -lgnuefi --start-group Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a --end-group $(LIB_GCC)	34	EFI_LIBS = -lefi -lgnuefi --start-group Cryptlib/libcryptlib.a Cryptlib/OpenSSL/libopenssl.a --end-group $(LIB_GCC)
24	@@ -57,7 +63,7 @@ LDFLAGS = -nostdlib -znocombreloc -T $(	35	@@ -65,7 +70,7 @@
25		36
26	VERSION = 0.8	37	LDFLAGS = --hash-style=sysv -nostdlib -znocombreloc -T $(EFI_LDS) -shared -Bsymbolic -L$(EFI_PATH) -L$(LIB_PATH) -LCryptlib -LCryptlib/OpenSSL $(EFI_CRT_OBJS) --build-id=sha1
27		38
28	-TARGET = shim.efi MokManager.efi.signed fallback.efi.signed	39	-TARGET = shim.efi MokManager.efi.signed fallback.efi.signed
29	+TARGET = shim.efi MokManager.efi fallback.efi	40	+TARGET = shim.efi MokManager.efi fallback.efi
30	OBJS = shim.o netboot.o cert.o replacements.o version.o	41	OBJS = shim.o netboot.o cert.o replacements.o version.o
31	KEYS = shim_cert.h ocsp.* ca.* shim.crt shim.csr shim.p12 shim.pem shim.key shim.cer	42	KEYS = shim_cert.h ocsp.* ca.* shim.crt shim.csr shim.p12 shim.pem shim.key shim.cer
32	SOURCES = shim.c shim.h netboot.c include/PeImage.h include/wincert.h include/console.h replacements.c replacements.h version.c version.h	43	SOURCES = shim.c shim.h netboot.c include/PeImage.h include/wincert.h include/console.h replacements.c replacements.h version.c version.h
33	@@ -144,8 +150,8 @@ FORMAT ?= --target efi-app-$(ARCH)	44	@@ -156,9 +161,6 @@
34	-j .debug_line -j .debug_str -j .debug_ranges \	45	-j .note.gnu.build-id \
35	$(FORMAT) $^ $@.debug	46	$(FORMAT) $^ $@.debug
36		47
37	-%.efi.signed: %.efi certdb/secmod.db	48	-%.efi.signed: %.efi certdb/secmod.db
38	- pesign -n certdb -i $< -c "shim" -s -o $@ -f	49	- pesign -n certdb -i $< -c "shim" -s -o $@ -f
39	+#%.efi.signed: %.efi certdb/secmod.db	50	-
40	+# pesign -n certdb -i $< -c "shim" -s -o $@ -f
41
42	clean:	51	clean:
43	$(MAKE) -C Cryptlib clean	52	$(MAKE) -C Cryptlib clean
		53	$(MAKE) -C Cryptlib/OpenSSL clean