Skip to content

Commit 54100ee

Browse files
Update sb-howto.md (#58)
* Update sb-howto.md * Update sb-howto.md * Update sb-howto.md
1 parent 93dc987 commit 54100ee

File tree

1 file changed

+16
-11
lines changed

1 file changed

+16
-11
lines changed

docs/developer-guide/get-started/sb-howto.md

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -125,10 +125,15 @@ export KEY=KeyInDB
125125
cd ~
126126
```
127127
Make sure your rpm %_topdir is ~/rpmbuild; if not you should edit your ~/.rpmmacros to include:
128+
128129
```bash
129130
mkdir -p ~/rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
130131
%_topdir %(echo $HOME)/rpmbuild
131132
```
133+
If file ~/.rpmmacros does not exist in home directory, create one:
134+
```bash
135+
vi ~/.rpmmacros
136+
```
132137

133138
### Step 2: Rebuild the shim-unsigned Package
134139

@@ -143,14 +148,14 @@ certutil -d /etc/pki/pesign -L -n KeyInShim -r > ~/key-in-shim.der
143148
```bash
144149
base_url=$(grep -E '^\s*baseurl' /etc/yum.repos.d/*.repo | awk -F= '{print $2}' | sed 's/^[ \t]*//')
145150

146-
shim_unsigned_package=$(tdnf repoquery --source shim-unsigned-x64 | tail -1)
147-
wget $base_url/SRPMS/$shim_unsigned_package.rpm
151+
shim_unsigned_package=$(tdnf repoquery --source shim-unsigned-x64 | tail -1 | sed 's/\.src$//')
152+
wget $base_url/SRPMS/$shim_unsigned_package.src.rpm
148153

149-
rpm -i shim-unsigned-x64-*.src.rpm
154+
rpm -i $shim_unsigned_package.src.rpm
150155
cd ~/rpmbuild
151156
cp ~/key-in-shim.der SOURCES/azurelinux-ca-20230216.der
152157
rpmbuild -bb SPECS/shim-unsigned-x64.spec
153-
sudo tdnf install RPMS/x86_64/shim-unsigned-x64-*.x86_64.rpm
158+
sudo tdnf install RPMS/x86_64/$shim_unsigned_package.x86_64.rpm
154159
```
155160
```bash
156161
cd ~
@@ -163,10 +168,10 @@ cd ~
163168
```bash
164169
base_url=$(grep -E '^\s*baseurl' /etc/yum.repos.d/*.repo | awk -F= '{print $2}' | sed 's/^[ \t]*//')
165170

166-
shim_package=$(tdnf repoquery --source shim | grep -v "unsigned" | tail -1)
167-
wget $base_url/SRPMS/$shim_package.rpm
171+
shim_package=$(tdnf repoquery --source shim | grep -v "unsigned" | tail -1 | sed 's/\.src$//')
172+
wget $base_url/SRPMS/$shim_package.src.rpm
168173

169-
rpm -i $shim_package.rpm
174+
rpm -i $shim_package.src.rpm
170175
```
171176

172177
**Sign the binaries**:
@@ -186,12 +191,12 @@ rpmbuild -bb SPECS/shim.spec
186191
Install the new package and reboot with secure boot disabled:
187192

188193
```bash
189-
sudo tdnf install RPMS/x86_64/$shim_package.rpm
194+
sudo tdnf install RPMS/x86_64/$shim_package.x86_64.rpm
190195
```
191-
Ensure that the `$shim_package.rpm` package is installed properly. If you encounter any messages, such as "Nothing to do", you can attempt to reinstall the package.
196+
Ensure that the `$shim_package.x86_64.rpm` package is installed properly. If you encounter any messages, such as "Nothing to do", you can attempt to reinstall the package.
192197

193198
```bash
194-
sudo tdnf reinstall --allowerasing RPMS/x86_64/$shim_package.rpm
199+
sudo tdnf reinstall --allowerasing RPMS/x86_64/$shim_package.x86_64.rpm
195200
```
196201

197202
```bash
@@ -213,7 +218,7 @@ sudo sh -c 'cp /boot/vmlinuz-* .'
213218
```bash
214219
sudo pesign -s -i grubx64.efi -o /boot/efi/EFI/BOOT/grubx64.efi -c KeyInShim --force
215220

216-
udo sh -c 'pesign -s -i vmlinuz-* -o /boot/vmlinuz-* -c KeyInShim --force'
221+
sudo sh -c 'pesign -s -i vmlinuz-* -o /boot/vmlinuz-* -c KeyInShim --force'
217222
```
218223

219224
### Step 6: Enroll KeyInDB into UEFI DB

0 commit comments

Comments
 (0)