@@ -125,10 +125,15 @@ export KEY=KeyInDB
125125cd ~
126126```
127127Make sure your rpm %_ topdir is ~ /rpmbuild; if not you should edit your ~ /.rpmmacros to include:
128+
128129``` bash
129130mkdir -p ~ /rpmbuild/{BUILD,RPMS,SOURCES,SPECS,SRPMS}
130131%_topdir %(echo $HOME )/rpmbuild
131132```
133+ If file ~ /.rpmmacros does not exist in home directory, create one:
134+ ``` bash
135+ vi ~ /.rpmmacros
136+ ```
132137
133138### Step 2: Rebuild the shim-unsigned Package
134139
@@ -143,14 +148,14 @@ certutil -d /etc/pki/pesign -L -n KeyInShim -r > ~/key-in-shim.der
143148``` bash
144149base_url=$( grep -E ' ^\s*baseurl' /etc/yum.repos.d/* .repo | awk -F= ' {print $2}' | sed ' s/^[ \t]*//' )
145150
146- shim_unsigned_package=$( tdnf repoquery --source shim-unsigned-x64 | tail -1)
147- wget $base_url /SRPMS/$shim_unsigned_package .rpm
151+ shim_unsigned_package=$( tdnf repoquery --source shim-unsigned-x64 | tail -1 | sed ' s/\.src$// ' )
152+ wget $base_url /SRPMS/$shim_unsigned_package .src. rpm
148153
149- rpm -i shim-unsigned-x64- * .src.rpm
154+ rpm -i $shim_unsigned_package .src.rpm
150155cd ~ /rpmbuild
151156cp ~ /key-in-shim.der SOURCES/azurelinux-ca-20230216.der
152157rpmbuild -bb SPECS/shim-unsigned-x64.spec
153- sudo tdnf install RPMS/x86_64/shim-unsigned-x64- * .x86_64.rpm
158+ sudo tdnf install RPMS/x86_64/$shim_unsigned_package .x86_64.rpm
154159```
155160``` bash
156161cd ~
@@ -163,10 +168,10 @@ cd ~
163168``` bash
164169base_url=$( grep -E ' ^\s*baseurl' /etc/yum.repos.d/* .repo | awk -F= ' {print $2}' | sed ' s/^[ \t]*//' )
165170
166- shim_package=$( tdnf repoquery --source shim | grep -v " unsigned" | tail -1)
167- wget $base_url /SRPMS/$shim_package .rpm
171+ shim_package=$( tdnf repoquery --source shim | grep -v " unsigned" | tail -1 | sed ' s/\.src$// ' )
172+ wget $base_url /SRPMS/$shim_package .src. rpm
168173
169- rpm -i $shim_package .rpm
174+ rpm -i $shim_package .src. rpm
170175```
171176
172177** Sign the binaries** :
@@ -186,12 +191,12 @@ rpmbuild -bb SPECS/shim.spec
186191Install the new package and reboot with secure boot disabled:
187192
188193``` bash
189- sudo tdnf install RPMS/x86_64/$shim_package .rpm
194+ sudo tdnf install RPMS/x86_64/$shim_package .x86_64. rpm
190195```
191- Ensure that the ` $shim_package.rpm ` package is installed properly. If you encounter any messages, such as "Nothing to do", you can attempt to reinstall the package.
196+ Ensure that the ` $shim_package.x86_64. rpm ` package is installed properly. If you encounter any messages, such as "Nothing to do", you can attempt to reinstall the package.
192197
193198``` bash
194- sudo tdnf reinstall --allowerasing RPMS/x86_64/$shim_package .rpm
199+ sudo tdnf reinstall --allowerasing RPMS/x86_64/$shim_package .x86_64. rpm
195200```
196201
197202``` bash
@@ -213,7 +218,7 @@ sudo sh -c 'cp /boot/vmlinuz-* .'
213218``` bash
214219sudo pesign -s -i grubx64.efi -o /boot/efi/EFI/BOOT/grubx64.efi -c KeyInShim --force
215220
216- udo sh -c ' pesign -s -i vmlinuz-* -o /boot/vmlinuz-* -c KeyInShim --force'
221+ sudo sh -c ' pesign -s -i vmlinuz-* -o /boot/vmlinuz-* -c KeyInShim --force'
217222```
218223
219224### Step 6: Enroll KeyInDB into UEFI DB
0 commit comments