Merge ~dannf/shim/+git/shim-signed:arm64-fixes into ~ubuntu-core-dev/shim/+git/shim-signed:master

[dann frazier]

[Julian Andres Klode (juliank)]

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 538baed..1de6e4e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+shim-signed (1.53) UNRELEASED; urgency=medium
+
+  * Fix arm64 issues due to hardcoding "x64" as the EFI architecture.
+    (LP: #2004208)
+  * is-not-revoked: Support vmlinux.gz files as used on arm64.
+    (LP: #2004201)
+
+ -- dann frazier <[e-mail]>  Mon, 30 Jan 2023 15:55:05 -0700
+
 shim-signed (1.52) kinetic; urgency=medium
 
   * New upstream version 15.7 (LP: #1996503)
diff --git a/debian/kernel-postinst.d/zz-shim b/debian/kernel-postinst.d/zz-shim
index 93a41e6..4a02c2e 100755
--- a/debian/kernel-postinst.d/zz-shim
+++ b/debian/kernel-postinst.d/zz-shim
@@ -1,6 +1,11 @@
 #!/bin/sh
-# Try to update shim alternative if pointing to previous shim
-if update-alternatives --query shimx64.efi.signed | grep "Best: /usr/lib/shim/shimx64.efi.signed.previous" -q; then
-	dpkg-trigger shim-kernel-check
-fi
 
+efi_archs="x64 aa64"
+
+# Try to update shim alternative if pointing to previous shim
+for efi_arch in ${efi_archs}; do
+	test -e /usr/lib/shim/shim${efi_arch}.efi.signed.latest || continue
+	if update-alternatives --query shim${efi_arch}.efi.signed | grep "Best: /usr/lib/shim/shim${efi_arch}.efi.signed.previous" -q; then
+		dpkg-trigger shim-kernel-check
+	fi
+done
diff --git a/debian/shim-signed.postinst b/debian/shim-signed.postinst
index 497ba66..b957ba9 100755
--- a/debian/shim-signed.postinst
+++ b/debian/shim-signed.postinst
@@ -7,6 +7,7 @@ set -e
 efivars=/sys/firmware/efi/efivars
 secureboot_var=SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c
 moksbstatert_var=MokSBStateRT-605dab50-e046-4300-abb6-3dd810dd8b23
+efi_archs="x64 aa64"
 
 on_secure_boot() {
 	# Validate any queued actions before we go try to do them.
@@ -61,14 +62,14 @@ find_revoked() {
 }
 
 setup_alternatives() {
-	for efi_arch in x64 aa64; do
+	for efi_arch in ${efi_archs}; do
 		test -e /usr/lib/shim/shim${efi_arch}.efi.signed.latest || continue
 		if ! on_secure_boot || ! find_revoked; then
-			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shimx64.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.latest 100
-			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shimx64.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.previous 50
+			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shim${efi_arch}.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.latest 100
+			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shim${efi_arch}.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.previous 50
 		else
-			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shimx64.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.latest 50
-			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shimx64.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.previous 100
+			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shim${efi_arch}.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.latest 50
+			update-alternatives --install /usr/lib/shim/shim${efi_arch}.efi.signed shim${efi_arch}.efi.signed /usr/lib/shim/shim${efi_arch}.efi.signed.previous 100
 		fi
 	done
 }
@@ -132,9 +133,12 @@ case "$1:$2" in
     triggered:shim-kernel-check)
 	setup_alternatives
 	# If we did not switch to the latest shim, do not reinstall shim and grub.
-	if update-alternatives --query shimx64.efi.signed | grep "Best: /usr/lib/shim/shimx64.efi.signed.previous" -q; then
-		exit 0
-	fi
+	for efi_arch in ${efi_archs}; do
+		test -e /usr/lib/shim/shim${efi_arch}.efi.signed.latest || continue
+		if update-alternatives --query shim${efi_arch}.efi.signed | grep "Best: /usr/lib/shim/shim${efi_arch}.efi.signed.previous" -q; then
+			exit 0
+		fi
+	done
 	bootloader_id="$(config_item GRUB_DISTRIBUTOR | tr A-Z a-z | \
 			 cut -d' ' -f1)"
 	case $bootloader_id in
diff --git a/is-not-revoked b/is-not-revoked
index 1ed1423..923f8b7 100755
--- a/is-not-revoked
+++ b/is-not-revoked
@@ -11,6 +11,19 @@ if [ "$1" = "-q" ]; then
 	shift
 fi
 
+compress_type() {
+	local file="$1"
+	magic="$(od -x -N2 "$file" | head -1 | cut -d' ' -f2)"
+	case $magic in
+		8b1f)
+			echo "gzip"
+			;;
+		*)
+			echo "none"
+			;;
+	esac
+}
+
 for signed_binary in "$@"; do
 	if [ ! -e "$signed_binary" ]; then
 		echo "E: $signed_binary: file not found">&2
@@ -18,10 +31,17 @@ for signed_binary in "$@"; do
 		continue
 	fi
 
-	sbverify --list "$signed_binary" | grep subject: | grep -E -o "CN=([^/]|\\/)*" | readarray -t signers
+	if [ "$(compress_type "$signed_binary")" = "gzip" ]; then
+		_signed_binary="$(mktemp)"
+		trap 'rm -f "$_signed_binary"' EXIT
+		gunzip < "$signed_binary" > "$_signed_binary"
+	else
+		_signed_binary="$signed_binary"
+	fi
+	sbverify --list "$_signed_binary" | grep subject: | grep -E -o "CN=([^/]|\\/)*" | readarray -t signers
 	if [ -z "$signers" ]; then
-		echo "E: $signed_binary: Could not finder signing subject, sbverify output follows:">&2
-		sbverify --list "$signed_binary" >&2
+		echo "E: $signed_binary: Could not find signing subject, sbverify output follows:">&2
+		sbverify --list "$_signed_binary" >&2
 		exit=1
 		continue
 	fi