chore(kernel): fix SBAT data and addon.efi names

[Lynsey Rydberg (corvus-callidus)]

Summary

• Add Azure Linux SBAT component records to the kernel UKI and UKI addon EFI binaries.
• Name UKI addon EFI files with .azurelinux.<arch>.addon.efi rather than .fedora.<arch>.addon.efi.

Validation

Built kernel artifacts were inspected with objdump -s -j .sbat.

vmlinuz-virt.efi

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
systemd-stub,1,The systemd Developers,systemd,258,https://systemd.io/
systemd-stub.azurelinux,1,Azure Linux,systemd,258.4-5.azl4,https://aka.ms/azurelinux
kernel-uki-virt.azurelinux,1,Microsoft,kernel-uki-virt,6.18.39-1.4.azl4.x86_64,https://github.com/microsoft/azurelinux/issues

fips-enable-virt.azurelinux.x86_64.addon.efi

sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel-uki-virt-addons.azurelinux,1,Microsoft,kernel-uki-virt-addons,6.18.39-1.4.azl4.x86_64,https://github.com/microsoft/azurelinux/issues

The kernel-uki-virt-addons RPM now contains Azure Linux-named EFI files:

crashkernel-1536M-virt.azurelinux.x86_64.addon.efi
crashkernel-192M-virt.azurelinux.x86_64.addon.efi
crashkernel-1G-virt.azurelinux.x86_64.addon.efi
crashkernel-256M-virt.azurelinux.x86_64.addon.efi
crashkernel-2G-virt.azurelinux.x86_64.addon.efi
crashkernel-512M-virt.azurelinux.x86_64.addon.efi
crashkernel-default-virt.azurelinux.x86_64.addon.efi
debug-virt.azurelinux.x86_64.addon.efi
fips-disable-virt.azurelinux.x86_64.addon.efi
fips-enable-virt.azurelinux.x86_64.addon.efi
systemd-volatile-overlay-virt.azurelinux.x86_64.addon.efi

Fixes AB#20616, AB#22661

[Copilot]

Pull request overview

Updates kernel EFI artifacts to use Azure Linux SBAT identity and addon filenames.

Changes:

• Adds Microsoft/Azure Linux SBAT metadata.
• Renames UKI addons from Fedora to Azure Linux.
• Bumps the kernel release and refreshes generated state.

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
base/comps/kernel/kernel.spec	Sets Azure Linux SBAT and addon naming.
base/comps/kernel/kernel.sbat.template	Updates kernel SBAT identity.
base/comps/kernel/uki.sbat.template	Updates UKI SBAT identity.
base/comps/kernel/uki-addons.sbat.template	Updates addon SBAT identity.
specs/k/kernel/kernel.spec	Records rendered spec changes.
specs/k/kernel/kernel.sbat.template	Records rendered kernel SBAT template.
specs/k/kernel/uki.sbat.template	Records rendered UKI SBAT template.
specs/k/kernel/uki-addons.sbat.template	Records rendered addon SBAT template.
locks/kernel.lock	Refreshes the component input fingerprint.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Lynsey Rydberg (corvus-callidus)]

/azp run

[azure-pipelines]

Azure Pipelines:
2 pipeline(s) were filtered out due to trigger conditions.

[reuben olinsky (reubeno)]

question(blocking): Could you remind us what the requirements for the last field are? Is it supposed to be a follow up for security issues?

If that's the case, per our security guidance we shouldn't point folks toward our GitHub issues and instead toward appropriate Microsoft security response contacts. (Can we point to our SECURITY.md itself, or the MSRC website linked in the .md? If not, I suppose we could point to the email address listed in it -- secure@microsoft.com .)

[Lynsey Rydberg (corvus-callidus)]

The requirements are fairly vague: https://github.com/rhboot/shim/blob/main/SBAT.md#generation-based-revocation-metadata

vendor_url | url to look stuff up, contact, whatever.

RHEL/CentOS/Fedora reference the RH secalert email. Debian uses their package tracker URL. Other distros use email or their own equivalent of https://microsoft.com in the field.

[reuben olinsky (reubeno)]

question(non-blocking): Do you think we should be changing primary_target to be azurelinux? What I don't know is what else that might touch.

[Lynsey Rydberg (corvus-callidus)]

primary_target is used as input to the config generation script, which I don't want to tinker with. When Rachel Menge (@rlmenge) does the rework to handle multiple kernel variants and flavors, I expect that script (and inputs to it) will be changed and a different approach may be taken. This narrowly scopes my changes to just the names of the addon efi binaries, as needed prior to our shim-review submission.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 9 changed files in this pull request and generated no new comments.

Suppressed comments (1)

base/comps/kernel/kernel.spec:20

• The validation output is stale: it reports 6.18.31-1.17/1.18 artifacts, while this spec now builds 6.18.39-1.4. Those binaries cannot verify the SBAT version fields or renamed addon payload produced by this revision. Please rebuild the current commit and update the objdump/RPM payload results with matching NEVRs before approval.

%define azl_pkgrelease 4