Skip to content

chore(kernel): fix SBAT data and addon.efi names #18598

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Lynsey Rydberg (corvus-callidus) wants to merge 2 commits into
base: 4.0
Choose a base branch
from
Open

chore(kernel): fix SBAT data and addon.efi names #18598

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
52d7a12
feat(kernel): add AZL EFI SBAT records
corvus-callidus Jul 28, 2026
bc81a77
fix(kernel): name UKI addons for Azure Linux
corvus-callidus Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion base/comps/kernel/kernel.sbat.template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel.@SBAT_SUFFIX,1,Red Hat,kernel-core,@KVER,mailto:secalert@redhat.com
kernel.@SBAT_SUFFIX,1,Microsoft,kernel-core,@KVER,https://github.com/microsoft/azurelinux/issues
18 changes: 16 additions & 2 deletions base/comps/kernel/kernel.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
# When rebuilding without a version change, bump azl_pkgrelease (manual release).
# This corresponds to upstream Fedora's %{pkgrelease} macro; we use it in the
# %{specrelease} macro below instead of a hardcoded value.
%define azl_pkgrelease 3
%define azl_pkgrelease 4
Comment thread
corvus-callidus marked this conversation as resolved.
# NVIDIA open GPU kernel module version (built as a kmod subpackage).
%define nvidia_open_version 595.58.03

Expand Down Expand Up @@ -132,6 +132,9 @@ Summary: The Linux kernel
%endif

# RHEL/CentOS specific .SBAT entries
%if 0%{?azl4}
%global sbat_suffix azurelinux
%else
%if 0%{?centos}
%global sbat_suffix centos
%else
Expand All @@ -141,6 +144,7 @@ Summary: The Linux kernel
%global sbat_suffix rhel
%endif
%endif
%endif

# Sign modules on all arches
%global signmodules 1
Expand All @@ -167,6 +171,12 @@ Summary: The Linux kernel
%endif

#
%if 0%{?azl4}
%define uki_addon_distro azurelinux
%else
%define uki_addon_distro %{primary_target}
%endif

# genspec.sh variables
#

Expand Down Expand Up @@ -2909,7 +2919,7 @@ BuildKernel() {

KernelAddonsDirOut="$KernelUnifiedImage.extra.d"
mkdir -p $KernelAddonsDirOut
python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu} @uki-addons.sbat
python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{uki_addon_distro} %{_target_cpu} @uki-addons.sbat

%if %{signkernel}
%{log_msg "Sign the EFI UKI kernel"}
Expand Down Expand Up @@ -4616,6 +4626,10 @@ fi\

# AZL-KMOD-FILES-ANCHOR — do not remove (kmod overlays chain here)
%changelog
* Wed Aug 26 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 6.18.39-1.4
- feat(kernel): add Azure Linux SBAT records
- fix(kernel): name UKI addons for Azure Linux

* Mon Aug 24 2026 Rachel Menge <rachelmenge@microsoft.com> - 6.18.39-1.3
- chore(kernel): tidy release macros

Expand Down
2 changes: 1 addition & 1 deletion base/comps/kernel/uki-addons.sbat.template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel-uki-virt-addons.@SBAT_SUFFIX,1,Red Hat,kernel-uki-virt-addons,@KVER,mailto:secalert@redhat.com
kernel-uki-virt-addons.@SBAT_SUFFIX,1,Microsoft,kernel-uki-virt-addons,@KVER,https://github.com/microsoft/azurelinux/issues

@reubeno reuben olinsky (reubeno) Aug 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question(blocking): Could you remind us what the requirements for the last field are? Is it supposed to be a follow up for security issues?

If that's the case, per our security guidance we shouldn't point folks toward our GitHub issues and instead toward appropriate Microsoft security response contacts. (Can we point to our SECURITY.md itself, or the MSRC website linked in the .md? If not, I suppose we could point to the email address listed in it -- secure@microsoft.com .)

@corvus-callidus Lynsey Rydberg (corvus-callidus) Aug 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The requirements are fairly vague: https://github.com/rhboot/shim/blob/main/SBAT.md#generation-based-revocation-metadata

vendor_url | url to look stuff up, contact, whatever.

RHEL/CentOS/Fedora reference the RH secalert email. Debian uses their package tracker URL. Other distros use email or their own equivalent of https://microsoft.com in the field.

2 changes: 1 addition & 1 deletion base/comps/kernel/uki.sbat.template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel-uki-virt.@SBAT_SUFFIX,1,Red Hat,kernel-uki-virt,@KVER,mailto:secalert@redhat.com
kernel-uki-virt.@SBAT_SUFFIX,1,Microsoft,kernel-uki-virt,@KVER,https://github.com/microsoft/azurelinux/issues
2 changes: 1 addition & 1 deletion locks/kernel.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Managed by azldev component update. Do not edit manually.
version = 1
manual-bump = 2
input-fingerprint = 'sha256:66be53c1264ba148acc86f57050d7265641db12cf90df3f995ea9f8ef34167c2'
input-fingerprint = 'sha256:a207fedcacfafd5c8a502eabe7165f13b75637bcffea4bb2d2b62a2a3b475609'
resolution-input-hash = 'sha256:466421704711c4fd3c71f0b2ed715a0e61d49e3e26f3a2637fee755795849c8e'
2 changes: 1 addition & 1 deletion specs/k/kernel/kernel.sbat.template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel.@SBAT_SUFFIX,1,Red Hat,kernel-core,@KVER,mailto:secalert@redhat.com
kernel.@SBAT_SUFFIX,1,Microsoft,kernel-core,@KVER,https://github.com/microsoft/azurelinux/issues
18 changes: 16 additions & 2 deletions specs/k/kernel/kernel.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
# When rebuilding without a version change, bump azl_pkgrelease (manual release).
# This corresponds to upstream Fedora's %{pkgrelease} macro; we use it in the
# %{specrelease} macro below instead of a hardcoded value.
%define azl_pkgrelease 3
%define azl_pkgrelease 4
# NVIDIA open GPU kernel module version (built as a kmod subpackage).
%define nvidia_open_version 595.58.03

Expand Down Expand Up @@ -135,6 +135,9 @@ Summary: The Linux kernel
%endif

# RHEL/CentOS specific .SBAT entries
%if 0%{?azl4}
%global sbat_suffix azurelinux
%else
%if 0%{?centos}
%global sbat_suffix centos
%else
Expand All @@ -144,6 +147,7 @@ Summary: The Linux kernel
%global sbat_suffix rhel
%endif
%endif
%endif

# Sign modules on all arches
%global signmodules 1
Expand All @@ -170,6 +174,12 @@ Summary: The Linux kernel
%endif

#
%if 0%{?azl4}
%define uki_addon_distro azurelinux
%else
%define uki_addon_distro %{primary_target}

@reubeno reuben olinsky (reubeno) Aug 25, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question(non-blocking): Do you think we should be changing primary_target to be azurelinux? What I don't know is what else that might touch.

@corvus-callidus Lynsey Rydberg (corvus-callidus) Aug 26, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

primary_target is used as input to the config generation script, which I don't want to tinker with. When Rachel Menge (@rlmenge) does the rework to handle multiple kernel variants and flavors, I expect that script (and inputs to it) will be changed and a different approach may be taken. This narrowly scopes my changes to just the names of the addon efi binaries, as needed prior to our shim-review submission.

%endif

# genspec.sh variables
#

Expand Down Expand Up @@ -2912,7 +2922,7 @@ BuildKernel() {

KernelAddonsDirOut="$KernelUnifiedImage.extra.d"
mkdir -p $KernelAddonsDirOut
python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu} @uki-addons.sbat
python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{uki_addon_distro} %{_target_cpu} @uki-addons.sbat

%if %{signkernel}
%{log_msg "Sign the EFI UKI kernel"}
Expand Down Expand Up @@ -4619,6 +4629,10 @@ fi\

# AZL-KMOD-FILES-ANCHOR — do not remove (kmod overlays chain here)
%changelog
* Wed Aug 26 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 6.18.39-1.4
- feat(kernel): add Azure Linux SBAT records
- fix(kernel): name UKI addons for Azure Linux

* Mon Aug 24 2026 Rachel Menge <rachelmenge@microsoft.com> - 6.18.39-1.3
- chore(kernel): tidy release macros

Expand Down
2 changes: 1 addition & 1 deletion specs/k/kernel/uki-addons.sbat.template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel-uki-virt-addons.@SBAT_SUFFIX,1,Red Hat,kernel-uki-virt-addons,@KVER,mailto:secalert@redhat.com
kernel-uki-virt-addons.@SBAT_SUFFIX,1,Microsoft,kernel-uki-virt-addons,@KVER,https://github.com/microsoft/azurelinux/issues
2 changes: 1 addition & 1 deletion specs/k/kernel/uki.sbat.template
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel-uki-virt.@SBAT_SUFFIX,1,Red Hat,kernel-uki-virt,@KVER,mailto:secalert@redhat.com
kernel-uki-virt.@SBAT_SUFFIX,1,Microsoft,kernel-uki-virt,@KVER,https://github.com/microsoft/azurelinux/issues
Loading