From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id 251F41FF165 for ; Thu, 6 Nov 2025 16:42:59 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 8D62F1C8DE; Thu, 6 Nov 2025 16:43:27 +0100 (CET) From: Fiona Ebner To: pve-devel@lists.proxmox.com Date: Thu, 6 Nov 2025 16:42:56 +0100 Message-ID: <20251106154314.772317-6-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20251106154314.772317-1-f.ebner@proxmox.com> References: <20251106154314.772317-1-f.ebner@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1762443779142 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.020 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment LOTS_OF_MONEY 0.001 Huge... sums of money SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH edk2-firmware 5/6] Initialize the Secure Boot dbx in *.ms.fd with the latest revocations X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" Follow Debian commit 45c101a4b5 ("Initialize the Secure Boot dbx in *.ms.fd with the latest revocations") and pick up the latest revocation DBX files from Debian's debian/2025.05-1 tag. Adapt how entries in debian/source/include-binaries are handled, because it already contains different entries in Proxmox VE's downstream. Signed-off-by: Fiona Ebner --- debian/DBXUpdate-2025-02-24.arm64.bin | Bin 0 -> 4613 bytes debian/DBXUpdate-2025-10-16.amd64.bin | Bin 0 -> 24053 bytes debian/rules | 19 +++++++++++++++++-- debian/source/include-binaries | 2 ++ 4 files changed, 19 insertions(+), 2 deletions(-) create mode 100644 debian/DBXUpdate-2025-02-24.arm64.bin create mode 100644 debian/DBXUpdate-2025-10-16.amd64.bin diff --git a/debian/DBXUpdate-2025-02-24.arm64.bin b/debian/DBXUpdate-2025-02-24.arm64.bin new file mode 100644 index 0000000000000000000000000000000000000000..33520068f2602fbd2c739b7f71e8946f5ba6ccd4 GIT binary patch literal 4613 zcmd6p2{hDeAIE328|x5lhN4pV&y1Z!6N!+0DZ9ZKjKE=e*~<=e%?NXJ&rS^L>8L^Z)(7&*%TVVuP~^@(V$} ze^$7`f3O9fYu#mfL+*1Y5{l%*lq?7Z0F8SP28CjH0VFGjL#!^807t-}ED(T;l|wpK zH+C5bWrNabobvz;Y^1>_>2Men1{1`A=`h4*?xex6tS8?l!7wuXJ_O1IiX$U1TmT0v z+#JCw2s1au2m<_!fL)N&($UwQ=+j9!4XZAe#xn#f$9ig4qr1WVCP!3K7Ix9mOR_E!1^e($i73989U0%#l97e8VCfm~xx~b`fDzvD^Xguw(X)mD`gm)R#}N z2tnMyJ1d?IWgRD>ll%`|^1$Hr7c@V+~ zl-%~lss%5b;+x~L)35zHr?yAo`2lT4H$OrHP|s5Zl)u}I>+ftP{B0Hliy#t_XN-7vYjFDy!LIey{0x^UUU;yaTPtcFY zYP(aZKB{tZ0RaKBUf(S(>rD2N^C1z*KE86!6i+$OD4@wf@8Y!>&b4QJ$pDHnSb15n zTM`QZ4y^3py|S>dL7@mUzyvt;JqBR0$Nu9K1Payn-%mmXxEU)KghICvFaYwS9l_lU z+7SwoARoHv7oU;k4I`)(%sWgpTm=r~1Y28gcYIjrZY7s{Ou8gxOvq=?PyR^F3){@t z()iK+-o3TDGxuSmOXH%7o%nVfT`O6AK%20QR$TvjT7;@!9IWQvX3`Ut?J*P+J*hQ) z$QgY_P23S0b0Nf_hjf*&pJ-+6@#{cEOqDLBARW5WmP$IE$VyryTut4D2|v7!9ijCe-53Y3LXFFam)7kwx5>Y<6H z%1gZ*!y^rd!eU_OknU&JQ<*LW#^J3oMi4kzRpu_L464ag^kiNc7 zvCf$;P5JmmK``PmZ05cF(`)`6ADvSg%YrncgW|$RO$sNkg|HDX3Vo-b5lBIOfbS3Z z2|*FyTN&~L0skeLME@9of+4tfb3#lZeh?=J9-;+;6x{l}2u7M%fcFm$umErn2mi!8 zZC4Zg@Hs2~`d-8AJ?89csuCWBz!}B}F@!l_3K-Lk=mxR+zXJ(m*I$|U4R}5jvWuVd zA5a3V3;Gr`E$CGS`~Vs70u&hV`|rso=llcq{(c53)Aohaz+(19$1kBSi@@5X)z_p` zc5?U8yA~!*Tnp!ND*S?zA-81m{B1r2RaPr`7>Dq=d>MB61aqrfF5D6Lu%7T3e}>q)!%UYBQO)?~2&i z#AUI&(%ebYT6tkpY!Am>1os+lsCSj!aHVX(J#Vs zWsxoa=skMC2D|8|vldUU$L`6CYtP@XI@d#V6S{OR@>96r7&0+IJuZ5BwDTc;tVAX{ z^@7Jio6uvcCbuG6Wp@7Z&SVI}|26Y)qeJ;Ht|B+Siy+FmeWExtuaOpKsC-8b`3Mz9 z-bj+IRe3Nm-u&);$G+%~mydotkeIBar53rvt$zh?O=w5fZa`9u7X8!;iuSIb($Wli zCu79vvCrSzWcCU%q>Ohtj^(*_Q;8`mQfv)C+)`3>e5FU+A>Z#l+Y5W#%$rC057!ZnSmJ5M>^s4osGs71B@sw`B!D*ManLj1h#jdI%~ zk7AUX%~4!%rFWz#Lqx&6bworVhrX>K%X_=qn@U>}<7~Z-l7}lY-(!D06nUA{P!$ms zZtD7hI%3;(I56BRtw2h+rSasc6wTrytrf*o{Qh;sw^ud<0Dm54t_E1cu?7zv_AgFc z4Af_{`@qU_-Yk*saCdW-@0B|G*UhWjI$)&Bllf6q{3goGdX6D`Lt_EINu$@vl$1ad>#Kw;DP}zqS=UBBFheKfwue#P$LkAlgx}LmSCvN5`;Hj#p?LqI zfAV=Pqd=l6^^ zJD&8?dL-4jN~*!Ls{Z4_%OwiR3UQRK)UUE#ZT!so#6|i0*^sBpLa>~UWOhP3bVltk zU0tE>l>Jc1OXnqVW_^BzkeH(Ri<~m#@qN}or1yDf9;=sFvJp7v zTG*jif-9>yRoJMJn{n9;e>valj$>j&CpBUBnDtfjfdf%FdM!9{=hS!wR7dI|T$#wk zpilfsn!@5fOGRdVZCt+lq^PTIRt5W9gmF}3wnxX_XWN3Z=uX|E(XV*^vYvKQOrqus zdb+=rP(@0kvEB&>qq1Ih(O2<(1>R|ao6F4kJJnX}tb0Qzi<36=gqK@1R+{!2AE_l+ zTlOie9$3=sWYz}^it^?nr^5t?GAFBuX-t z9H=^egGx^?zbUa1YtKI}Hz&`3c0gq^npy8udHp_J(`5aAdQrGUu7&^6p4#JGOQ1pS>v35JpCPns3gm5I9b+uRlRp1jS-1}6=&Om-sP2B+eY=6^%}GbOOp|sPWKKgR$i1)Sja^QDQ6T%==_{^ zASClzw+yrX4({#ITwnjC0hCJFVaFFV=mI>T*{gV<$&uIOmVn+RX8qzD8_n*b*RSsK z)x3Me{?4>C-P0gX#@(M&*t~bGw85BJf8%CWQ{YjZ5~A9!1!HZUqgcc9t?3pX*2(Ud z79-BjOfl;lOu0&0p1Zzmsj4=IX=Ja4SL4pLpA$%*Xum<}cSpo9>w5^jYVha<4`IIY zLQh-YdmcES^!;xyj(F8Pe&f9g31imZ#_aYzEAak>UcH%>Vy&C7lB-6l?@u3dsVw3r JC!a`L{R6gwL0kX; literal 0 HcmV?d00001 diff --git a/debian/DBXUpdate-2025-10-16.amd64.bin b/debian/DBXUpdate-2025-10-16.amd64.bin new file mode 100644 index 0000000000000000000000000000000000000000..07a95e2b09cc8c0e3ec40e035ca4c3cc30fadfc4 GIT binary patch literal 24053 zcmd731yCJ*x8{qxdvFQCVM8FeLvRQd+}+*X-Q5Wm+=9EihaiFA?hZl1&HK$cXTIBe z&Yh}THC2McubZDqMV7Jq zaDF!V3JOH|1qBJoiVi}BL(~tIgfxMMfr5mE03pL6(uYch-lIaoL*@q}U4R1rz8DC7 zkPi(72?d4y{;wQ6T-$2!+^aeNzrKY1ABF$;2qf}fIKZD38H5N2tqKE&4W+8giVed2 zX9EEnNzK5?+``t(+0K>~1BCX^i}2X+N+!lOcDBZ>q#)vdUO~dfm9sE%v~#jEbtV_J zbF{Z}G;p@~`w4mw?LY5BV^jPu-zS$5mmwDwCT9b&vVutQQQ0^^9IPCyTR`b8{kB75^wjE@R?BF79q*ZeVL>^3Mh+5R&rW z58vMt038U4{`Y`GB0&X0LPGpvXAFr@@7kMibtn1Eov|WLaZy<8w3>BO!eVhu+g?ZW zVEJxfPGzHe3ZSQ=){z5>wX(3aZ8uSE{PBD06{+U-Kgzxdw z&^odfUqonw()QA%{n2*cZMK~mh7^5MyGU+s4VMZGGOduL+rxP{v9t%8d8 za>M{mtG4!3Qjy4e%DZ|(l($&kP*JQ5u2bXCuIzKIW1$|Wjdn{eHK|{CU6|<7XmmTY zQb~8vhjaJ_tWq!&>@alLv`T( zH>V=-;N{<)*Z7Y%y(OoCf`){EEDVIS_OV=!00#*J8OW&s2_pID zRWukp7#tbsfQYd^Mk5tclf1WE(r!6x`zRpsf8NG~5diTO@qoDgGtH3yyEMc5*SEmH zVxzLLadUrQW#9m@bAMn5k^Lh>1w#PB^T#oK7M;u&C>l4zn$ucVt@N5`iqr#r{s$m~ zQ2@z-Wb&o*B|^o`ot^D@SXkWL+?Z|tGo_i0>}*)?nhgZfhePA9!cB@Dy4?t_%gkcjzim!fK-}Ewfhny75wA;L!+pv${;KFV z5~2`C9y;}hWi#(Ju;=t}a_UCe(vSyPv~`R6{F_6YOaRw_Nn@q)LA!~IVeRQT(HG9ZlqGCy2Mn7^ws#J@S<|I(S>{MQF?pkPo) zksy>ITp$b~L?ML#8tLClA06f&nNSe=fB66`2>P!b{J%U;+*C<)(^nm{dqF;zN)>^Z zhtjeXr2Wq)$Y4}K${@vjg?zbCng1}PzupDzdH*szdq+EC7o-0&rN62BH*fzY?cZGe z$NWG{e}6z6|CrzZf9GQ{`ZwGA@4vwraQQ+9{ymuU!QrS5RhM_oYPcoo!R$>c%JwY9nt7^`HlZSL@e41cm#*gprK1dde;Q`=`-9sY?&UrZ(2-A^W~r$>pA zd8MVp@Va00E}nI5g&pxYMUPL+?)$TD=WC7bHQy`#i(N658+}*z^AZ7U>J5B}$hUmA z7lb!g4xcCTLaBNW? z9Jubm!Emu+&nIfk(7)EM9aNM5Fvk|$oy!^sIq>%~>-k$8g96h3FL1~Iw&wo#s{P+e z@V_-AOduqL_#~I}1XFv)44WC;=E@K$jwJb>|Mz!^w=!anFnql^zgAA$%V#RlQLWnV zDDEZHu2(r%RPbbt_`c~D`U?qtarqt38=NvnxRC$`~U$5Wg zW?jgwQZrx6tnUmBCOXg7$?Ic&^-2;J{iMVnY|svZ;BFEdTz;(L9Zn>s_+l(^vW5=d zRgu#(%X7QSthN$fjL?P5`-|=?`DX_{_drS3T_L^a!>Pjy!^W46RQdF;)7Vj+Xs?0e7W1nBQSotckr8qjQVo%*yl`*H3v{te3( ztlg+kF9{{2Z)O!pij?+j>V=|9_2q=g5>4`ufcz~>P~l_t(?TM;BkkLj9cXd(Ijs=* zw^qCv9N4RRU3<8ZLb2lg!ArqSItRf&=pXWtksQi;VNt`qgcMrfzSl5t=c$Jx(Lo zoS808l~GKAy!ulz;dx4dhUm8^J!*{nb-^83^-*1<7ML(P7xRiV2OzJU&|mO`NdZ+- zPP$56?Y5bxV~042cvk-@gR*;4Bk>5xFTBI`C9!mf>U~=gQ{dfh0?(Mw<7Gwd(>dO$ zf2Vsr3*={vPH69Z+mtVjnYw*m-wzei{|e31$Nq!I%*b{*zH0;I>4uJ#8u)m=L@_R% z+Lr2jpYuI#w*A30anZio!wHra1M=}t`)C#m?}cIn@KMa!R_f;vH)yD7)|>dH=29F> zZe)QxhF#^+^vR1nh}ZeXKi@xnYsQ};$u4%-d5Yp1FVs96$m7fNAZv*ZmB6=u7gB&_ zC*_~!HZ+?`erQBvrYifHhyvspGN#{&Fem=`pw}(ak4l4Jox3UHY4X_3JV z1edjn&Er3iEy<#%+4dbs+C> z6>m33DdnqD_|dT9ZQAn)2DuyhEw=gL_Hy_5i;)YE4_x7$YPdrXoytk;pADPL(h#2H zKfpj!w`2JEnNv;A49G_=NNQZBG~UM4lqVxw8kkisc!t}?eM~aOccd895N`$YF|h>^ z)B8xo@D)xbV>7{1bn=&vjAVyJc&$2-@5B3^f&37DZ)x2b zeE>0SV=0kr(Bf#6777h5i2)S+@m^wIsvnRaMSpLK-?INZC`|=>H0=`E>G+-B(ifE0 z?auBYvx=1{AaAUuwT$JS$&6F=`Hr1TsmAI7<+m7wyN1i*g*=n-qBxKjA0DZ8L7Hxt zeCAa0F~<63ELXjhz&9EBc2q9J!fZVj$OkMv$>uV922z_?$pktzj~CSnTpb>hZ{*YA zy*>HT77FBB>95jP5n!_1hn*7_REZo=7U`=B7rk~rBJQxcpWDg-`OTc_pdMyBT5R?C z<5?0ns)pMmG!75=A7cC`gTMJmbAUYeN*`_Pjf`H(d&XwBZA|C`p_LMUBk5AO+tE4* zI07gj&vu)PQjoKRRnRNG_Z(qtO8YwD?I|+0i}l_ohHd~E%x^K~^~MWRtFLhd4(?8> z)oTtUENPL*-#t6rQTR+twXp#8M_~2&6!N*;Y(=h&hF}_UQiGu>HxrpY!n4C+BKO7mpVBzo3A>(N0YJW&6BoaAqye$IqS8g>5S*r<=2YH3sz2D^7 z(`8|*(@fYH`D&%qn?+(%=&ybup}7r|?@@bXSY^@abZoxn0{JT5-H09u`Ls2y`tJA2Qj*P9 zEzqv(tLk-s7R?&JXo2PbhGKL0N!w{L=;JV&o5-xu4()tx-$oeE9GZN}<${uWv zfTVX)ss^J6#QDH@qWA>d(s`#{Y}!(Hs!l`VJ=OJUl}Cn0$CnQptC-s9{8S%zT^FKI>s>o#)p z3%rV5HIgHkzqPI3?p*x&ifK<=`b4=iz(ui5N`Z3AM55sQ>(k{7cLz{^DHC(nS~6z- zsY8WC2LAEE4Am4dSu$={hOGO_US1>|$X|W2;b>H`5Dxo_Dl}$Jr*U(w&A4&Y@?v~n zN#A=}uo2lbkC?3td* zBpYvlyuUn$tdV&;O&NN1tW=~LECU@o0d*#1wt{j2grkZSI*@M_gv-!~iz0tSt?Xrd zekP+f_Ykyo%Z2gKwehA@Mh9Duj$Wff`ViXWw5hFnT89o!$fKbZT z7g~wuXwWvc3Z>NRhNyExfV?*M#qP%bBk#ti_yAt)S%bpOa3LFSAiXz`EM&76jb(c~#f zm{4l@1ObLc5+X3-_(mK4EHrb(0Imv1by!gElMNO_nc?0AbDASJ$ta1j5R3i_Wy=r$Jw6A3z zBwy}6^z@Q-4Wy?5c}|l>iyp1tQ6gR(nDM+6oCif&b|E=Pml~&*q3)I?>_FbV;dHEG zWEoL_d<);7vAW?Rm#UCkR(irV?BH5Cg%vD+GE}~l<)|LiMN|-t3Ckqh<>S90vlc3~ zvJ<#A{}l?s3e>-BxKrdsRgpH2!LI5{I4>Q{6G16ntrtMngnRTwMc@bHLj^{fZv>O8 zaGsE(q%EX8qfJga=v6n`MbO+BqE{1uygR-z21R&jL!Hxn>Fr7K60NbrXGFgY4o`Jb zLm5sNL?FKxVu$VLk-;>oP;kSRcEUEd{MF8D&j4rWi@-DQU(F!<^^HX_=-`qM1f zV1TVJ-yM5qZeB)jnRCggo9gc0>8J3-2F8Q?%q4QnavPfu}CZT=-J?FlkK9>)#Tz=HWlO7IY>iJCNRlEIGsyX9>X=#m7gh$R^n z9>~*86sgD;f);QShJ!7%ak8yoASf%nv?9hAX(472guwb2rs>$20DG$0gH3Tle)EMB z&~n$ZY)6aVn_s;Xka(4ZKz$ws=dPM+hNPgXK-{_aCDZ({e&2?-un*F@&P7xo&%o*# z;gCQwn+mN`b}#n=2E9xq7yB{oq_1)kkska(Z3F4BKz;ErE4d|uc`cq~e|TpoPn`x$ z$@;H!!iWe>!Yq+thdMxBJ^qo>fnwMu{xsKU#Fxk9{aOCq#g_s>vH@}Itf3CDdR~V# zbG%*J2TI0VX&p+#ersyM?vC;dGJEFKZ%KHf3aq}eIhtitTkoG3D*9%R*OuU-cersv zCj1GM%&gfVap4WN9(CQD^6nnVbuXFQzO^TXwv&Z^@|!d(88kgjo;lo= zNoKz2V_$m==&-5rryyAB_TMwjC>~YU2g0<#{auGDZwLx2+ngU#qD9DVs@O~&x%rkl zywl#FvW9Kpb_d2MRECr(OrksmsCIgHJyznh44yfq{b3x@2o}#}{vr?Lw{4ysawu^6 zwlj~ygL7%cE7{aTTK}bV#yB z1l^W4x7o_MpaDT?HGRHb>?_9OK@T9GkVcG?)*Y)g6wF;Y5My-Q@>ucWDmQ+>!dvDx zHZpAqz;g~V5skgt&Ys; z_qw_nq}BwsNeW&J%vO7ABM>J*{+)*j`nK@ZG-+wjM`VuA2jnB<+_^u*v87KWXdXB-UxOA4OfzmYB%-ev8La9hbtN%{L!k`T|EeHB z{$khZ?H9OV{ib!(vlsRKO`}_D#b(*`<#>OdN*qu>;(GROC#0W!5;g}hWqb0a2iBo3 zI9(;!Q*2dLa%=So$mbClovPvYCpR!(BALS1iIr%5A!}00`7IM$e=#tr-wWj1NoH-7 zArOr0sHmX7mfG>Zrsf5QA=tO#+rL@gA*p0h$pZNx^?<8lH70wF#u1}W1gf-&hvJ5In0ljQ z@Rj$S2Wnvbn!psz__q@=u8Cc$R+@ney;W@u9!}GhbXi?dPre3 z`6>B!1b1~6#Vt;?Kd$r7D4ZIi!0Npem^?IL&f)mlIai02T{|a#A1t2Lhr9i5CbZS4AvoE7v<8KS<)T!|?_75-jbTLSWH$f{>pb(U^AFdm+LYw! zjxSGpt&oGvy?9Qw9AL+j_hA2+J%*z=!7DBn2l8puPb2 zyNi}Dnm@h>o3$Hz2J`WYQf%vVh^-!sa0>e|(SluHLP$e48qKxIW!uP*C7qBwuOuKf z^q_qW77>yzy_+^L|M_UvO^veHn{O5DJcK=2w{9Hir|x9etu~`$=b}?#2G$R%?IrL$ zPAE}!x=z-xKAeU}s2Ec#JD($Z1}@%aeosjS#&1%;KS8hz-Osv?skH7ihC0eNmxrI> z9584H3akIc3U+?ogMx~N-?xX&bt{_j4+|u&<5u`6t~z|Csdh8BiJ=1P$Ni)xz9F*l z5_{GWCylDM42xY9G;6bxN$C>A>)U^VpaI4cSlK4|gUWjP-X!xGM?>x`o?!uj`LYlR zIqOp>?KC^s{>CINpjf=oFu`%%UHvGtNgwj4REhJU8S-5G@w)0Mb`RMG#* zXPbhZWe3P-(30<+L<|3{mRYKhybUxz6fLp;u3fyRo1E_mA-=mZm?Dp&71(88 z%1>oLzHi4RD%{h{LO2Rm<#N|aWF#ew$`Y$MKjj}=WSFfS*&~pe$7L`{csR$1>Uq!7RKZ4C4 zw$l@CqB;hXT24c!0;f#vdU3S!#$OoV+h$6$Zic(Nf%<1b#imjQh+h>fhjuX5A=>E* z;y0jh@v3@ zX2~Hog;&2ofw8LuDTQLK+H8edM9YU~icisJ8Ek!*2{kXCH|hBG_jY^C^Q#Dq!uU+} z6x*{sW~o4e{y`pC|C<9*Ej#ZiJRGztc`ef8+ShBxj(sz?{%JN~jJL5W1g!r;ayddK zu|F#Me(n6$rcq(ILBLPLlH)yMYrmDkvWufGF#gn?PsyLY`~U1We2t}3jlhZ|Bi>aH znL~}}^C~EtK?IAZXxY7ap!16g#}9;uRt@I9;;JXCBd;nPOOBI9P_i)#P@l`jLVKM_ z+;xL!Y~pq&*ZrqrO@?Yu%cCnCCohCY@;4xF|3w_>s)}3Hq6+Cx-EuEAoBSct33s1* zI3)Xg1e0O~kk?j+ePbDN$QdDSk3awW*qpZ2TX;OHq34L`5)L)(8+w4KxsjY(v`|gn9&|uU84j>fW8`^FQ)Glms6DUf&HS{dEsNr6KJaNP7*wqNu^w)-@ zSZs$s45HOxC_mVEqV`+N%RPJ>E{lH|L}tSD3GpWd?Lhr7z}lO*KZ` zFsxwxvXnA}2by)(l_F|Ian83NzBvpbi;KoE>?ba5g(1YwVDsu&OphE6}>gh+jETrcsustfpg)Q7GV9<0`^{JnWJ$t^>P@ft?oGVsK_- zuLFIH0u+0)`w2bQZ~Gn`uzC!koigI^kVuaFRS?%u(X!SzEsN3me5=BKXubDMUQ97i zpA0`C^n6|SY7H__ybY~7fIT!6vJI8vl|S92SK0eC3CMq7{!T((w*j3IyAIxETSK`egv=DPf;|7G*g>7+2ILK< z1`6G}HK2O_RBzj}cc=a6u!Y0j;vrsd+uOc<;seVcbEmmGV!BSHLzS~v4Y%?jGtrE+ z07Ao83dZDs_d_vY^G2KYqd9@-P?U!TKj)|CVsg3dt*CHp>~<2;iB$=SB(V8_W1n51 z_iBKqT-3&Kw<`zpDXN09bvJRiog#Xmz_#n%3Q^CzAC=4rU`tvi~f` zH3=y&?v)E{KAHPn5WRx{xrgl`KD%I`f}P;BpGUkHm71ckG0d{?h!Gf1%R=LRh?jT} z8l<<^_R{C7+IyepP-jQFP* zN-y$l_&ksw$}ui(;oc$oVkV;Giw|o_FvUk>H)qQpPe?R8 zvrP#$-(EJ2Y@`W6FbnNvZ`|ozxqqt^z-!?|nb}JJrC5%f=oY9CgUs8{ec1H7a*4Jj zjy&d5USE64(*Y?Sa;Uq8!w36WhdFG;VOES{B@2dw)Dlc0$ zr*C-+H)HmP<}l;wH57Kuz~*~G3u7B}PVVvk)3Q97vqYLma#3w!TotKXt`qKJDr@^d zeFZ3-=bgv!w3!j4j|)E=uq58iet3SHcs@h)XT31oGaJZj)Bj=bjPyKi7tN+7d9oBy zfY{}zl)EGCO%rdrM2p}7@)?U&`3t^E?=fOJUF}(9@chH32Tn|+hKvwwe3Nyz>a!__>e$8n<_TT4Q!m>_v$SETy%V#i6t4~*wmJ{HL|o=@GDArr=piah~mrR6nD zzCe!^h$dbtd=RYu+@W@?sdPlwktX&me}KA3{yEhYcymY-RNpR`k6>5>_I$z~l}+y% zyez!8Cvg_HNwPC2*lUyezPgzt;R`J`&k-1Z9@Z66gl*z;;E0p1%J_TZy7!)Fi0RR& z^-8P5^uQRbKD<3h{AD}PxArJ4rHx3DWr*$3Bv&|Fzb(BkqlXFA$qn4!`L~$ylbRoL zqS<9l(cWG|`L*oBDO9|7LrZ#e)qBEa2J%!m%s3(n-(KaPU1pGtLfvSB3EMuw;>6pZ zy~SUTY|a4k366wc4NV){S^N<%2|_RmZB=T1*rqy#9r++*%DIz+t*5JzuYTn@gb;<> z%;((^Ss;z^Z`egqfsffSNn}6bnsR{p85*bZu)C6tc@#+qMXE+eA?=j1gv&N3XsJE> zWY3cUKwjb-A+fueu?+J8A}^C(7sVEtTd#p9BSHX+TIEIvS{{&p?BL9~PT9MC>)4=B zjKGqIhFau*p_o2oj?)aQ1%2}o$Zz{yKcl^pclY+_7j=IQ*Cl;XEj^s#)04CildXKM z0;^|ae{LrtDKcim(nm?R#iyobAwi}!;Xsqh8W%66k0Z7M^|c}{%inV3^AjxBL(lp( zJQY3M!dqYdZdq7vc}Gdf0X9E`@RLo!Qp2vpLKL7d6=0&;?yb(=XEaplJX)ctp>-fHd8013Ie21%LcKRcWu(0c z*%@fyHvln@i;i?grP?qCBz^{Na+*_|)15_Kl)%#xjbVBl-D~ zG<1o>T#5o6sgnZl^?|(UjK2W&r{(?lz|76Y2V9AXtf##!#Q=Nrlg6Lzo)OPLo>o|S ze?~fwz*n2Ud(-QkV--v1?3*jE6Zd5N=7e`Uog!9S~ z>!2@Tp=!JC5EzdoTHr^OW{CtP*yww%Lias7NiOH6l?7ka==U`B&y~hNp0s*_QM#jE z>7(eTqo8Hg1nXDnn>kt?UhHs`0a?m5uz3Q-l~2UgzR#KW{Cis-p0&SsX{z(;&$r-{ z6N(A0e~_I5^{J6I+CounK1PToEP#GQ5$7Y^rHnFeAxP7ygx-^-YXN!gyquD0&9IK$hS<=RDkh_C#wy_5{aY6QHI1l zakGrMx7*2;a)#1IRCq+Kc3yzZ_cRIQo#E8B2o^Z-0z)tEksHmJ zf$gs@Lvu$I-bU-MR~LO#^SvC`8mu?H4*uszT3K9z5UnY|c>I3-fg6w;05KJdyK(Rl zymVnU5P#c)lke@tJHuev@CWh{7X5W_4{`mUc3g_9^SNU9wO8*ti z|C4U11TyTuu8_)R7OcI6F*2jwAF_tNYTuV3s7Fd_1DpR;lZ-`Hc+32v7%YENNOham zN$^Qb$JIi+J^^K-@zSUT7*F?D5svs3vPyNyrx|{4?q=^LdQY4{xk1h1uz{X?kwPHf zPv^_gUv@swqiAng;Wn4~ZjULGYmM6G_1G={Y{V4o{@sX6b!1GV7@?YjV`!%Q&^}4! zeyPh1JxhC0BMTjS#u`w6g;d)>sUSw6sjlXzO3L}#M0)6{%QYtqsonW>kF6D~|6OT# zJ0AI6cQ524;ydvH^BjGeGQZR7!J1%(6vs;%3$T7_lW66sQsP5Gw3J)=!YO2&Qrf$c zx(JyKlNh3uH_B0zzJuT0hZTm#7<2-A$%~+;6@=0;u zz4O!^rFbT&A2)&gi+DoS+-|L@sF5RzgA`rhk9w*v!X?d{S3Ho%#Ym6gpV%b7dY4*u;03k+xbVUEraJ0H zWwMdBcpw%mKe_aqhhObvCe=-Xd6`4&Pl{g^Y8^82DCp*gU3mTN*n#>I_r=$NSfOP@ zZg)^S4QIdKbC!i{C-TVei4_3GN?0YOO!+o1a&& zwv{%zd(|k`d(cCn`ELssKD>Pm1Y3VSp_1F+3#zw`BcD-gm|v7EwOrYAN8ujc^zioK zQ@e5j;|ZZwgNQ(69c(6aTEECG#?oGdIx@M@5>n~?C;)*kxC-QBl-a(0QuA!COZQ89 z`2tgqh;C`PWk?}ne5=xgC*TiOpT{nhL%+${{~15o zlMbk##4-BI9o{he#V3yQccK#estOwNyr@2k@-S1-`AfNf0T6j;OvO_JnU2Mhl zcN6?OdEkblZSwWv=v5?rii{7~O0 zHLqzIDsX8o`UTSx6U*;2P=6{~Y%}Ds96BZYij7X+UFF=D)po{>-*mA{7fBM11k6tk z5DGa@EilhN6Vr^fjdjbHENr1SqpM)oQB+bBcJ!hE^$&-Mynhs}BNxRm7R6eBj5Tpo zyB9Qt^x4rRICHjL1dIO#WXKVVMl#S}0_}fJv_3ybCg#+lkI1=9u`a>Von->lH!;-2 z;ip9V61?(b@`)%nn|IknB>AYIHI%l4MxcYB5y<<)P)#-OxTI2)Fgj*cjFA0(Kq}?l zSdCJ80aAs*>)kw%ho-&%h1IBZ{$LoS@!_hxYLh2WONMjC>SO|IN)XG}59F$886EXxpCwzom zcAd7Z()@&`GSgHsS^hjV+aa-`0OUV3Pd0s)RUcQ0(6V84dWfMz=;*ZIeWB(S?_}LR z3+Mpy+!d#E91*1FsawtO+lNv}YN`ljtv;bLWzqJlb7)$E)f>{1PK9p@3)eV~*wh@> zpW9haa8!}xp|UUjv`(5^MJEFFKZRimi)T_iw(+;$@fVkmgbEfel|_&dFfTImI5#PP z`KQY8a$l(97m%&!so&Z6C_25^6PiTD->Hvug67ZGPgp>G-TGm3(R$^|j+6FaSJyPG zI0zI1j%fG6wo8uU3~Okxd4fsc>Ub1L_YZP=&Fb)6N=a!q$pyDBVdU_KL&QjWW3c=& z1C3(tEn^^xppvsRT_=Bzgey-wycPrvAJUgQyk{~8#$%^Esdd9%mnDxghUKkcrUajp zo;Q)+?&E!p`}xfYJD5K^G(nzme*Ed+=4jKRpe5{`MxoBn6kZkLb!}d(aBuYp)OVYl z9yL~o^M4icUSqZF2UeeZBQCWfJ2v-CToz$(bM(y?=(x0p z2>U=nRmLZg{Bv%Ep=PHpM8D|(0{Ddqlj8JJg80-Nt8d_tU^&M|M@1sSge&Nm~g&t2f;bHPps z8Pj~HT7KpL>gQv4ewI&4&sKv`n2jveI>u7RAnaeh+eE%(BsOvCU;y%kpqD*uI8Qxf zml0GX5WHDG6 zc83ARKXtD|QhJzBnfl!>66Z6m6uDo{5A-1rZCenHk2cK=*!<^52j-JO*7K?H+pHuM zcik$zF>acRDL&m7L6Xc18P0B?{?80i8VBc8WKir;!zZUj28OYyDNoXL2<-ZWO(_^xJzr@zdv?Dzt<#MJh1AA}JQ+Ve}Rr1!Xunnl>8b-Qg9z zf8q^;VmD;+tf|QK1nN^gFLZ-~r}oNzhwCbFQz0Y$+8D7{&)qRlB_S@oIRNY5-^q5U znK(ouPt@LLqyNI@i3o&#vQr>e8i$j3x`RLi^M`lVICLYcT*(370%ZDY!l+hg&!%eI zp{&|Z^CyJATlE9uVIaz#xDBZzR-`l`@k&;fsbeko4wI)egpLYX5jYT#1M+MZX2Y+& zEjBIR7+~!WA|obn*{7#L$mu<9J5Imr;=Ta+_isN%pl8Ru`u1uoClXyb(p2Q;TcHsL z*aYOoQcO4M0eN26)OAD8HBdWl=irneAI)2owD-yfs-#}f*6}k~{-Z!%1&-_%HG$5K zMQrICSM}*rSLnLbiq1iiVnTTt>um?v{T+4l^dXd2%_YlqOUbpn0WqragI+i-YPZ-x}s&n6|fV{3*_giEV*t{mkjJLpFw zPoEw=khdTz6qa{4qz>p%%&I{i$9sCm#M8cHlqY~TMo;%U84k!>Z(gO_p?oyw&G(_R zK?)X&opv3{sSEl;*Kd0o7aIrmyoB}3iXrrs%J)dE$$5N!MPpA%@2^Pp*zYRy^Lf9` zwSmoG+Y~K{F;+&vWppydQ_jYnDL3P-W^k_*!!IKhOw&7IXC`goMr6M8GYjqF2 z0`h)z3{x?qUize$M~o5r@hTR@#Q`$&LH(J1H}`NIk#FrH+b z+edZfv}pKet2$5OvXAIHqOW66WW|i3j%8x{H(>R1ZfBXQ^pEyje(imT`w<%jEmU`g z%av;+OGkF+Or0P2K>aGbHByEGhg5FGx8}V5=e?n4zKZkg53gp+PB*r(`e6C?_py_? zR|q1fbJpGVt}YUrcAxa{vZq~YLZ#wUNK>V0pnj82%MZRpz2mByDbdg5)*<%-l;XD4 z@(X8fcV(M|@X?Y48~Y=LeeZ z#vN)~m&;)TjimZerecR=-2ljlz)^s@Wg+q$C zI4q2ha{$_6<`(J;I&M-;`$eFAQD_g?d}e>SvtuYq>r?}Uu9<0!A=ND_%Dj$VVr|B` z`RRh~{Gz zYQWv6ZQnQLQ`zF33x8$2F>vQVh~oz8i=(}c(2OZ-di)r86(AHekS)Wq;!OOV_B||N z%qfEnZ2l0t=Eg=VS0P;(tZ$v~wUz7ma*8OP_KuLn*hxw{atsNmKkb+6gNQ-(6y^;;dWNuhhc+&62{D`oA8luQh2Xm7( z-0$lzp0sXt1!Si?nl_7T#yA$ef{a^i*+Fy7+-OwM4R}CQBR4`FslL? zY~VE-rkxAD%fYK~tlt?= zDVp2Zpx635qcM6#)yHP0d=xD7HXKa9aaX6f7N?rb`^6QrefXJkR~XOqn@hS z{{pn;#ZDStcvoluR=)|{c+iF_a0Ss5JuGW1aa7)1Z8-j00Q5&2pA7tB3!J3fgO{h^5KsFyfQz^L_xXU z=1BD}v5eNhlPh~5zvPa8Z-iL4L$2bEFs{aPgc9qsDNNjuzRF5p^Zn+Pjs@i*ZmFTFTTyp4~o0{ zZ!I@F#x}{!g*VO@*p38U_au`h%e1&TSMxeF{}MGTz^}Onh@`b3V6*xIHfj`Q2t*=GRL@J;tk_!PcXP>u81J!=)Wv zha!!^?n?(3ZT1*FgFHUlYb3$A8HQP)e!JA0rR$iscwB{4K8dcNCKGsT+lG43x2Z!? z88^5Iuz3jXFP1xDb9E0SCE{zC3EM0y{+RK#!wvYSJn8!#U3{htwI=@~6!j4kgLUlP!iG)MQ`1IUNPpKIiH3TxlY3>h&W5C^82D0G6v^zn1AegSz>r{AkrtayA`8KXuF zD4bcz`$u!^tvdy7#gHr3oE!2^FzeLW8RSgtXUcXDT@3m7KJJP8@q-=z z753?ZTdLI0=f{f5p1zf>ktZ0Z3_|4D=$}@0P;8(NeLvZ_~ z{we!Epm1wf`=%Yh?mtR)Jw{j9bU7!T?gVjLH4v4}nFSI;XV3ee?tJ)&@j#bnlkj;*hM65H*8xtU82#R8ie( z<%Q@QI~lwV19=1_Ltoa;Q3&BGP@}%w;nBf}W@i&cW1|lBB=#u*6Ij0!X=}cuS&P1y z7S!FUI-Q<1n-mANseqi=;5D~mbQ*Di00jr;*4?_*)?KvqT4OSFeT-gcI1KfnG4irC6t8^02dSsLU z^_Sl|eW*mm8taBxUkd!&!VC4RYB**6_%?>W9{=qQBNIB6kCKW~kcgc{F$!Tg^|qc00KZ&zA@B5Jqp+KsAE+uJ2Y8{x+cJ&vm-0mvjjrzdg9C8_Y=} z$kI{pmh{4b>;b{`_@1Z&eraziZBcXQD(Bn3qIXY($#r_#&DCl~()xg4hlgJg+p#s$3lnq~%e4h=gYHlu7wEd87qZ(^6@EpoRs6Zkl5jF4q F{{XMjn*RU* literal 0 HcmV?d00001 diff --git a/debian/rules b/debian/rules index 316a7b7727..0f217730ea 100755 --- a/debian/rules +++ b/debian/rules @@ -167,7 +167,8 @@ endif # Usage: $(call enroll_vendor,,,) enroll_vendor = virt-fw-vars --input $(1) --output $(2) \ - --enroll-cert debian/PkKek-1-vendor.pem + --enroll-cert debian/PkKek-1-vendor.pem \ + --set-dbx ./debian/DBXUpdate-*.$(3).bin # Usage: $(call enroll_snakeoil,,) enroll_snakeoil = virt-fw-vars --input $(1) --output $(2) \ --set-pk OvmfEnrollDefaultKeys \ @@ -262,4 +263,18 @@ get-orig-source: edk2-$(DEB_VERSION_UPSTREAM) rm -rf edk2.tmp edk2-$(DEB_VERSION_UPSTREAM) -.PHONY: build-ovmf build-ovmf32 build-ovmf-cvm build-qemu-efi build-qemu-efi-aarch64 build-qemu-efi-riscv64 +update-dbx: + rm -rf debian/DBXUpdate-*.bin + set -ex; \ + tmpdir="$$(mktemp -d)"; \ + git clone https://github.com/microsoft/secureboot_objects $$tmpdir; \ + for arch in amd64 arm64; do \ + bin=PostSignedObjects/DBX/$$arch/DBXUpdate.bin; \ + date=$$(cd $$tmpdir && git log -1 --pretty=format:"%cs" $$bin); \ + cp $$tmpdir/$$bin debian/DBXUpdate-$${date}.$${arch}.bin; \ + done; \ + rm -rf "$$tmpdir" + sed -i -e '/DBXUpdate-/d' debian/source/include-binaries + ls debian/DBXUpdate-*.bin >> debian/source/include-binaries + +.PHONY: build-ovmf build-ovmf32 build-ovmf-cvm build-qemu-efi build-qemu-efi-aarch64 build-qemu-efi-riscv64 update-dbx diff --git a/debian/source/include-binaries b/debian/source/include-binaries index 2d863865bd..862b8adda0 100644 --- a/debian/source/include-binaries +++ b/debian/source/include-binaries @@ -3,3 +3,5 @@ debian/legacy-2M-builds/OVMF_VARS.ms.fd debian/legacy-2M-builds/OVMF_VARS.fd debian/legacy-2M-builds/OVMF_CODE.secboot.fd debian/legacy-2M-builds/OVMF_CODE.fd +debian/DBXUpdate-2025-02-24.arm64.bin +debian/DBXUpdate-2025-10-16.amd64.bin -- 2.47.3 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel