%undefine _hardened_build

%global tarversion 2.02

%undefine _missing_build_ids_terminate_build

%global _configure_gnuconfig_hack 0

Name:		grub2

Epoch:		1

Version:	2.02

Release:	99%{?dist}.1

Summary:	Bootloader with support for Linux, Multiboot and more

Group:		System Environment/Base

License:	GPLv3+

URL:		http://www.gnu.org/software/grub/

Obsoletes:	grub < 1:0.98

Source0:	ftp://alpha.gnu.org/gnu/grub/grub-%{tarversion}.tar.xz

#Source0:	ftp://ftp.gnu.org/gnu/grub/grub-%%{tarversion}.tar.xz

Source1:	grub.macros

Source2:	grub.patches

Source3:	release-to-master.patch

Source4:	http://unifoundry.com/unifont-5.1.20080820.pcf.gz

Source5:	theme.tar.bz2

Source6:	gitignore

Source8:	strtoull_test.c

Source9:	20-grub.install

Source12:	99-grub-mkconfig.install

Source13:	redhatsecurebootca3.cer

Source14:	redhatsecureboot301.cer

Source15:	redhatsecurebootca5.cer

Source16:	redhatsecureboot502.cer

Source17:	sbat.csv.in

%include %{SOURCE1}

# generate with do-rebase

%include %{SOURCE2}

BuildRequires:	gcc efi-srpm-macros

BuildRequires:	flex bison binutils python3-devel

BuildRequires:	ncurses-devel xz-devel bzip2-devel

BuildRequires:	freetype-devel libusb-devel

BuildRequires:	rpm-devel

BuildRequires:	rpm-devel rpm-libs

BuildRequires:	autoconf automake autogen device-mapper-devel

BuildRequires:	freetype-devel gettext-devel git

BuildRequires:	texinfo

BuildRequires:	dejavu-sans-fonts

BuildRequires:	help2man

# For %%_userunitdir macro

BuildRequires:	systemd

%ifarch %{efi_arch}

BuildRequires:	pesign >= 0.99-8

%endif

%if %{?_with_ccache: 1}%{?!_with_ccache: 0}

BuildRequires:	ccache

%endif

ExcludeArch:	s390 s390x %{arm}

Obsoletes:	%{name} <= %{evr}

%if 0%{with_legacy_arch}

Requires:	%{name}-%{legacy_package_arch} = %{evr}

%else

Requires:	%{name}-%{package_arch} = %{evr}

%endif

%global desc \

The GRand Unified Bootloader (GRUB) is a highly configurable and \

customizable bootloader with modular architecture.  It supports a rich \

variety of kernel formats, file systems, computer architectures and \

hardware devices.\

%{nil}

%description

%{desc}

%package common

Summary:	grub2 common layout

Group:		System Environment/Base

BuildArch:	noarch

Conflicts:	grubby < 8.40-13

%description common

This package provides some directories which are required by various grub2

subpackages.

%package tools

Summary:	Support tools for GRUB.

Group:		System Environment/Base

Obsoletes:	%{name}-tools < %{evr}

Requires:	%{name}-common = %{epoch}:%{version}-%{release}

Requires:	gettext os-prober which file

Requires(pre):	dracut

Requires(post):	dracut

%description tools

%{desc}

This subpackage provides tools for support of all platforms.

%ifarch x86_64

%package tools-efi

Summary:	Support tools for GRUB.

Group:		System Environment/Base

Requires:	gettext os-prober which file

Requires:	%{name}-common = %{epoch}:%{version}-%{release}

Obsoletes:	%{name}-tools < %{evr}

%description tools-efi

%{desc}

This subpackage provides tools for support of EFI platforms.

%endif

%package tools-minimal

Summary:	Support tools for GRUB.

Group:		System Environment/Base

Requires:	gettext

Requires:	%{name}-common = %{epoch}:%{version}-%{release}

Obsoletes:	%{name}-tools < %{evr}

%description tools-minimal

%{desc}

This subpackage provides tools for support of all platforms.

%package tools-extra

Summary:	Support tools for GRUB.

Group:		System Environment/Base

Requires:	gettext os-prober which file

Requires:	%{name}-tools-minimal = %{epoch}:%{version}-%{release}

Requires:	%{name}-common = %{epoch}:%{version}-%{release}

Obsoletes:	%{name}-tools < %{evr}

%description tools-extra

%{desc}

This subpackage provides tools for support of all platforms.

%if 0%{with_efi_arch}

%{expand:%define_efi_variant %%{package_arch} -o}

%endif

%if 0%{with_alt_efi_arch}

%{expand:%define_efi_variant %%{alt_package_arch}}

%endif

%if 0%{with_legacy_arch}

%{expand:%define_legacy_variant %%{legacy_package_arch}}

%endif

%prep

%do_common_setup

%if 0%{with_efi_arch}

mkdir grub-%{grubefiarch}-%{tarversion}

grep -A100000 '# stuff "make" creates' .gitignore > grub-%{grubefiarch}-%{tarversion}/.gitignore

cp %{SOURCE4} grub-%{grubefiarch}-%{tarversion}/unifont.pcf.gz

sed -e "s,@@VERSION@@,%{evr},g" %{SOURCE17} \

	> grub-%{grubefiarch}-%{tarversion}/sbat.csv

git add grub-%{grubefiarch}-%{tarversion}

%endif

%if 0%{with_alt_efi_arch}

mkdir grub-%{grubaltefiarch}-%{tarversion}

grep -A100000 '# stuff "make" creates' .gitignore > grub-%{grubaltefiarch}-%{tarversion}/.gitignore

cp %{SOURCE4} grub-%{grubaltefiarch}-%{tarversion}/unifont.pcf.gz

git add grub-%{grubaltefiarch}-%{tarversion}

%endif

%if 0%{with_legacy_arch}

mkdir grub-%{grublegacyarch}-%{tarversion}

grep -A100000 '# stuff "make" creates' .gitignore > grub-%{grublegacyarch}-%{tarversion}/.gitignore

cp %{SOURCE4} grub-%{grublegacyarch}-%{tarversion}/unifont.pcf.gz

git add grub-%{grublegacyarch}-%{tarversion}

%endif

git commit -m "After making subdirs"

%build

%if 0%{with_efi_arch}

%{expand:%do_primary_efi_build %%{grubefiarch} %%{grubefiname} %%{grubeficdname} %%{_target_platform} %%{efi_target_cflags} %%{efi_host_cflags} %{SOURCE13} %{SOURCE14} redhatsecureboot301 %{SOURCE15} %{SOURCE16} redhatsecureboot502}

%endif

%if 0%{with_alt_efi_arch}

%{expand:%do_alt_efi_build %%{grubaltefiarch} %%{grubaltefiname} %%{grubalteficdname} %%{_alt_target_platform} %%{alt_efi_target_cflags} %%{alt_efi_host_cflags} %{SOURCE13} %{SOURCE14} redhatsecureboot301 %{SOURCE15} %{SOURCE16} redhatsecureboot502}

%endif

%if 0%{with_legacy_arch}

%{expand:%do_legacy_build %%{grublegacyarch}}

%endif

makeinfo --info --no-split -I docs -o docs/grub-dev.info \

	docs/grub-dev.texi

makeinfo --info --no-split -I docs -o docs/grub.info \

	docs/grub.texi

makeinfo --html --no-split -I docs -o docs/grub-dev.html \

	docs/grub-dev.texi

makeinfo --html --no-split -I docs -o docs/grub.html \

	docs/grub.texi

%install

set -e

rm -fr $RPM_BUILD_ROOT

%do_common_install

%if 0%{with_efi_arch}

%{expand:%do_efi_install %%{grubefiarch} %%{grubefiname} %%{grubeficdname}}

%endif

%if 0%{with_alt_efi_arch}

%{expand:%do_alt_efi_install %%{grubaltefiarch} %%{grubaltefiname} %%{grubalteficdname}}

%endif

%if 0%{with_legacy_arch}

%{expand:%do_legacy_install %%{grublegacyarch} %%{alt_grub_target_name} 0%{with_efi_arch}}

%endif

rm -f $RPM_BUILD_ROOT%{_infodir}/dir

ln -s %{name}-set-password ${RPM_BUILD_ROOT}/%{_sbindir}/%{name}-setpassword

echo '.so man8/%{name}-set-password.8' > ${RPM_BUILD_ROOT}/%{_datadir}/man/man8/%{name}-setpassword.8

%ifnarch x86_64

rm -vf ${RPM_BUILD_ROOT}/%{_bindir}/%{name}-render-label

rm -vf ${RPM_BUILD_ROOT}/%{_sbindir}/%{name}-bios-setup

rm -vf ${RPM_BUILD_ROOT}/%{_sbindir}/%{name}-macbless

%endif

%find_lang grub

# Make selinux happy with exec stack binaries.

mkdir ${RPM_BUILD_ROOT}%{_sysconfdir}/prelink.conf.d/

cat << EOF > ${RPM_BUILD_ROOT}%{_sysconfdir}/prelink.conf.d/grub2.conf

# these have execstack, and break under selinux

-b /usr/bin/grub2-script-check

-b /usr/bin/grub2-mkrelpath

-b /usr/bin/grub2-fstest

-b /usr/sbin/grub2-bios-setup

-b /usr/sbin/grub2-probe

-b /usr/sbin/grub2-sparc64-setup

EOF

# Install kernel-install scripts

install -d -m 0755 %{buildroot}%{_prefix}/lib/kernel/install.d/

install -D -m 0755 -t %{buildroot}%{_prefix}/lib/kernel/install.d/ %{SOURCE9}

install -D -m 0755 -t %{buildroot}%{_prefix}/lib/kernel/install.d/ %{SOURCE12}

install -d -m 0755 %{buildroot}%{_sysconfdir}/kernel/install.d/

install -m 0644 /dev/null %{buildroot}%{_sysconfdir}/kernel/install.d/20-grubby.install

install -m 0644 /dev/null %{buildroot}%{_sysconfdir}/kernel/install.d/90-loaderentry.install

# Install systemd user service to set the boot_success flag

install -D -m 0755 -t %{buildroot}%{_userunitdir} \

	docs/grub-boot-success.{timer,service}

install -d -m 0755 %{buildroot}%{_userunitdir}/timers.target.wants

ln -s ../grub-boot-success.timer \

	%{buildroot}%{_userunitdir}/timers.target.wants

# Install systemd system-update unit to set boot_indeterminate for offline-upd

install -D -m 0755 -t %{buildroot}%{_unitdir} docs/grub-boot-indeterminate.service

install -d -m 0755 %{buildroot}%{_unitdir}/system-update.target.wants

ln -s ../grub-boot-indeterminate.service \

	%{buildroot}%{_unitdir}/system-update.target.wants

# Don't run debuginfo on all the grub modules and whatnot; it just

# rejects them, complains, and slows down extraction.

%global finddebugroot "%{_builddir}/%{?buildsubdir}/debug"

%global dip RPM_BUILD_ROOT=%{finddebugroot} %{__debug_install_post}

%define __debug_install_post (						\

	mkdir -p %{finddebugroot}/usr					\

	mv ${RPM_BUILD_ROOT}/usr/bin %{finddebugroot}/usr/bin		\

	mv ${RPM_BUILD_ROOT}/usr/sbin %{finddebugroot}/usr/sbin		\

	%{dip}								\

	install -m 0755 -d %{buildroot}/usr/lib/ %{buildroot}/usr/src/	\

	cp -al %{finddebugroot}/usr/lib/debug/				\\\

		%{buildroot}/usr/lib/debug/				\

	cp -al %{finddebugroot}/usr/src/debug/				\\\

		%{buildroot}/usr/src/debug/ )				\

	mv %{finddebugroot}/usr/bin %{buildroot}/usr/bin		\

	mv %{finddebugroot}/usr/sbin %{buildroot}/usr/sbin		\

	%{nil}

%undefine buildsubdir

%pre tools

if [ -f /boot/grub2/user.cfg ]; then

    if grep -q '^GRUB_PASSWORD=' /boot/grub2/user.cfg ; then

	sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' /boot/grub2/user.cfg

    fi

elif [ -f %{efi_esp_dir}/user.cfg ]; then

    if grep -q '^GRUB_PASSWORD=' %{efi_esp_dir}/user.cfg ; then

	sed -i 's/^GRUB_PASSWORD=/GRUB2_PASSWORD=/' \

	    %{efi_esp_dir}/user.cfg

    fi

elif [ -f /etc/grub.d/01_users ] && \

	grep -q '^password_pbkdf2 root' /etc/grub.d/01_users ; then

    if [ -f %{efi_esp_dir}/grub.cfg ]; then

	# on EFI we don't get permissions on the file, but

	# the directory is protected.

	grep '^password_pbkdf2 root' /etc/grub.d/01_users | \

		sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \

	    > %{efi_esp_dir}/user.cfg

    fi

    if [ -f /boot/grub2/grub.cfg ]; then

	install -m 0600 /dev/null /boot/grub2/user.cfg

	chmod 0600 /boot/grub2/user.cfg

	grep '^password_pbkdf2 root' /etc/grub.d/01_users | \

		sed 's/^password_pbkdf2 root \(.*\)$/GRUB2_PASSWORD=\1/' \

	    > /boot/grub2/user.cfg

    fi

fi

%post tools

if [ "$1" = 1 ]; then

	/sbin/install-info --info-dir=%{_infodir} %{_infodir}/%{name}.info.gz || :

	/sbin/install-info --info-dir=%{_infodir} %{_infodir}/%{name}-dev.info.gz || :

fi

if [ "$1" = 2 ]; then

	/sbin/grub2-switch-to-blscfg --backup-suffix=.rpmsave &>/dev/null || :

fi

%triggerun -- grub2 < 1:1.99-4

# grub2 < 1.99-4 removed a number of essential files in postun. To fix upgrades

# from the affected grub2 packages, we first back up the files in triggerun and

# later restore them in triggerpostun.

# https://bugzilla.redhat.com/show_bug.cgi?id=735259

# Back up the files before uninstalling old grub2

mkdir -p /boot/grub2.tmp &&

mv -f /boot/grub2/*.mod \

      /boot/grub2/*.img \

      /boot/grub2/*.lst \

      /boot/grub2/device.map \

      /boot/grub2.tmp/ || :

%triggerpostun -- grub2 < 1:1.99-4

# ... and restore the files.

test ! -f /boot/grub2/device.map &&

test -d /boot/grub2.tmp &&

mv -f /boot/grub2.tmp/*.mod \

      /boot/grub2.tmp/*.img \

      /boot/grub2.tmp/*.lst \

      /boot/grub2.tmp/device.map \

      /boot/grub2/ &&

rm -r /boot/grub2.tmp/ || :

%preun tools

if [ "$1" = 0 ]; then

	/sbin/install-info --delete --info-dir=%{_infodir} %{_infodir}/%{name}.info.gz || :

	/sbin/install-info --delete --info-dir=%{_infodir} %{_infodir}/%{name}-dev.info.gz || :

fi

%files common -f grub.lang

%dir %{_libdir}/grub/

%dir %{_datarootdir}/grub/

%dir %{_datarootdir}/grub/themes/

%exclude %{_datarootdir}/grub/themes/*

%attr(0700,root,root) %dir %{_sysconfdir}/grub.d

%{_prefix}/lib/kernel/install.d/20-grub.install

%{_sysconfdir}/kernel/install.d/20-grubby.install

%{_sysconfdir}/kernel/install.d/90-loaderentry.install

%{_prefix}/lib/kernel/install.d/99-grub-mkconfig.install

%dir %{_datarootdir}/grub

%exclude %{_datarootdir}/grub/*

%dir /boot/%{name}

%dir /boot/%{name}/themes/

%dir /boot/%{name}/themes/system

%exclude /boot/%{name}/themes/system/*

%attr(0700,root,root) %dir /boot/grub2

%exclude /boot/grub2/*

%dir %attr(0700,root,root) %{efi_esp_dir}

%exclude %{efi_esp_dir}/*

%license COPYING

%ghost %config(noreplace) %verify(not size mode md5 mtime) /boot/grub2/grubenv

%doc INSTALL

%doc NEWS

%doc README

%doc THANKS

%doc TODO

%doc docs/grub.html

%doc docs/grub-dev.html

%doc docs/font_char_metrics.png

%files tools-minimal

%{_sysconfdir}/prelink.conf.d/grub2.conf

%{_sbindir}/%{name}-get-kernel-settings

%attr(4755, root, root) %{_sbindir}/%{name}-set-bootflag

%{_sbindir}/%{name}-set-default

%{_sbindir}/%{name}-set*password

%{_bindir}/%{name}-editenv

%{_bindir}/%{name}-mkpasswd-pbkdf2

%{_datadir}/man/man3/%{name}-get-kernel-settings*

%{_datadir}/man/man8/%{name}-set-default*

%{_datadir}/man/man8/%{name}-set*password*

%{_datadir}/man/man1/%{name}-editenv*

%{_datadir}/man/man1/%{name}-mkpasswd-*

%ifarch x86_64

%files tools-efi

%{_sbindir}/%{name}-macbless

%{_bindir}/%{name}-render-label

%{_datadir}/man/man8/%{name}-macbless*

%{_datadir}/man/man1/%{name}-render-label*

%endif

%files tools

%attr(0644,root,root) %ghost %config(noreplace) %{_sysconfdir}/default/grub

%config %{_sysconfdir}/grub.d/??_*

%ifarch ppc64 ppc64le

%exclude %{_sysconfdir}/grub.d/10_linux

%else

%exclude %{_sysconfdir}/grub.d/10_linux_bls

%endif

%{_sysconfdir}/grub.d/README

%{_userunitdir}/grub-boot-success.timer

%{_userunitdir}/grub-boot-success.service

%{_userunitdir}/timers.target.wants

%{_unitdir}/grub-boot-indeterminate.service

%{_unitdir}/system-update.target.wants

%{_infodir}/%{name}*

%{_datarootdir}/grub/*

%{_sbindir}/%{name}-install

%exclude %{_datarootdir}/grub/themes

%exclude %{_datarootdir}/grub/*.h

%{_datarootdir}/bash-completion/completions/grub

%{_sbindir}/%{name}-mkconfig

%{_sbindir}/%{name}-switch-to-blscfg

%{_sbindir}/%{name}-probe

%{_sbindir}/%{name}-rpm-sort

%{_sbindir}/%{name}-reboot

%{_bindir}/%{name}-file

%{_bindir}/%{name}-menulst2cfg

%{_bindir}/%{name}-mkimage

%{_bindir}/%{name}-mkrelpath

%{_bindir}/%{name}-script-check

%{_datadir}/man/man?/*

# exclude man pages from tools-extra

%exclude %{_datadir}/man/man8/%{name}-sparc64-setup*

%exclude %{_datadir}/man/man8/%{name}-install*

%exclude %{_datadir}/man/man1/%{name}-fstest*

%exclude %{_datadir}/man/man1/%{name}-glue-efi*

%exclude %{_datadir}/man/man1/%{name}-kbdcomp*

%exclude %{_datadir}/man/man1/%{name}-mkfont*

%exclude %{_datadir}/man/man1/%{name}-mklayout*

%exclude %{_datadir}/man/man1/%{name}-mknetdir*

%exclude %{_datadir}/man/man1/%{name}-mkrescue*

%exclude %{_datadir}/man/man1/%{name}-mkstandalone*

%exclude %{_datadir}/man/man1/%{name}-syslinux2cfg*

# exclude man pages from tools-minimal

%exclude %{_datadir}/man/man3/%{name}-get-kernel-settings*

%exclude %{_datadir}/man/man8/%{name}-set-default*

%exclude %{_datadir}/man/man8/%{name}-set*password*

%exclude %{_datadir}/man/man1/%{name}-editenv*

%exclude %{_datadir}/man/man1/%{name}-mkpasswd-*

%exclude %{_datadir}/man/man8/%{name}-macbless*

%exclude %{_datadir}/man/man1/%{name}-render-label*

%if %{with_legacy_arch}

%{_sbindir}/%{name}-install

%ifarch x86_64

%{_sbindir}/%{name}-bios-setup

%else

%exclude %{_sbindir}/%{name}-bios-setup

%exclude %{_datadir}/man/man8/%{name}-bios-setup*

%endif

%ifarch %{sparc}

%{_sbindir}/%{name}-sparc64-setup

%else

%exclude %{_sbindir}/%{name}-sparc64-setup

%exclude %{_datadir}/man/man8/%{name}-sparc64-setup*

%endif

%ifarch %{sparc} ppc ppc64 ppc64le

%{_sbindir}/%{name}-ofpathname

%else

%exclude %{_sbindir}/%{name}-ofpathname

%exclude %{_datadir}/man/man8/%{name}-ofpathname*

%endif

%endif

%files tools-extra

%{_sbindir}/%{name}-sparc64-setup

%{_sbindir}/%{name}-ofpathname

%{_bindir}/%{name}-fstest

%{_bindir}/%{name}-glue-efi

%{_bindir}/%{name}-kbdcomp

%{_bindir}/%{name}-mkfont

%{_bindir}/%{name}-mklayout

%{_bindir}/%{name}-mknetdir

%ifnarch %{sparc}

%{_bindir}/%{name}-mkrescue

%endif

%{_bindir}/%{name}-mkstandalone

%{_bindir}/%{name}-syslinux2cfg

%{_sysconfdir}/sysconfig/grub

%{_datadir}/man/man8/%{name}-sparc64-setup*

%{_datadir}/man/man8/%{name}-install*

%{_datadir}/man/man1/%{name}-fstest*

%{_datadir}/man/man1/%{name}-glue-efi*

%{_datadir}/man/man1/%{name}-kbdcomp*

%{_datadir}/man/man1/%{name}-mkfont*

%{_datadir}/man/man1/%{name}-mklayout*

%{_datadir}/man/man1/%{name}-mknetdir*

%{_datadir}/man/man1/%{name}-mkrescue*

%{_datadir}/man/man1/%{name}-mkstandalone*

%{_datadir}/man/man8/%{name}-ofpathname*

%{_datadir}/man/man1/%{name}-syslinux2cfg*

%exclude %{_datarootdir}/grub/themes/starfield

%if 0%{with_efi_arch}

%{expand:%define_efi_variant_files %%{package_arch} %%{grubefiname} %%{grubeficdname} %%{grubefiarch} %%{target_cpu_name} %%{grub_target_name}}

%endif

%if 0%{with_alt_efi_arch}

%{expand:%define_efi_variant_files %%{alt_package_arch} %%{grubaltefiname} %%{grubalteficdname} %%{grubaltefiarch} %%{alt_target_cpu_name} %%{alt_grub_target_name}}

%endif

%if 0%{with_legacy_arch}

%{expand:%define_legacy_variant_files %%{legacy_package_arch} %%{grublegacyarch}}

%endif

%changelog

* Mon May 17 2021 Javier Martinez Canillas <javierm@redhat.com> - 2.02-99.el8_4.1

- Fix boot failures in ppc64le caused by storage race condition (diegodo)

  Resolves: rhbz#1961265

* Thu Feb 25 2021 Javier Martinez Canillas <javierm@redhat.com> - 2.02-99

- Fix bug of grub2-install not checking for the SBAT option

  Resolves: CVE-2020-14372

  Resolves: CVE-2020-25632

  Resolves: CVE-2020-25647

  Resolves: CVE-2020-27749

  Resolves: CVE-2020-27779

  Resolves: CVE-2021-20225

  Resolves: CVE-2021-20233

* Thu Feb 25 2021 Javier Martinez Canillas <javierm@redhat.com> - 2.02-98

- Fix another batch of CVEs

  Resolves: CVE-2020-14372

  Resolves: CVE-2020-25632

  Resolves: CVE-2020-25647

  Resolves: CVE-2020-27749

  Resolves: CVE-2020-27779

  Resolves: CVE-2021-20225

  Resolves: CVE-2021-20233

* Tue Feb 23 2021 Javier Martinez Canillas <javierm@redhat.com> - 2.02-97

- Fix keylayouts module listed twice in GRUB_MODULES variable

  Related: rhbz#1897587

* Tue Feb 23 2021 Javier Martinez Canillas <javierm@redhat.com> - 2.02-96

- Fix "Add 'at_keyboard_fallback_set' var to force the set manually"

  Related: rhbz#1897587

- Fix a boot failure due patch "ieee1275: claim up to 256MB memory"

  Resolves: rhbz#1929111

* Tue Jan 26 2021 Javier Martinez Canillas <javierm@redhat.com> - 2.02-95

- Add appended signatures support for ppc64le LPAR Secure Boot (daxtens)

  Resolves: rhbz#1853410

* Wed Jan 20 2021 Renaud Métrich <rmetrich@redhat.com> - 2.02-94

- Add 'at_keyboard_fallback_set' var to force the set manually

- Related: rhbz#1897587

* Mon Dec 14 2020 Javier Martinez Canillas <javierm@redhat.com> - 2.02-93

- add keylayouts and at_keyboard modules to UEFI Grub2 (rmetrich)

  Related: rhbz#1897587

- at_keyboard: use set 1 when keyboard is in Translate mode (rmetrich)

  Resolves: rhbz#1897587

- add GRUB enhanced debugging features (rmetrich)

  Resolves: rhbz#1776249

- ieee1275: Avoiding many unecessary open/close (diegodo)

  Resolves: rhbz#1862632

- ieee1275: device mapper and fibre channel discovery support (diegodo)

  Resolves: rhbz#1873724

* Mon Nov 23 2020 Jan Hlavac <jhlavac@redhat.com> - 2.02-92

- grub2-install: disable support for EFI platforms

  Resolves: rhbz#1737444

- Include a few more modules to EFI build needed for LUKS support (javierm)

  Related: rhbz#1873725

* Mon Nov 16 2020 Javier Martinez Canillas <javierm@redhat.com> - 2.02-91

- Fix tps-rpmtest failing due /boot/grub2/grubenv attributes mismatch

  Resolves: rhbz#1813959

- Include in EFI build the modules needed for LUKS support

  Resolves: rhbz#1873725

- Fix keyboards that report IBM PC AT scan codes

  Resolves: rhbz#1897587

* Mon Aug 31 2020 Javier Martinez Canillas <javierm@redhat.com> - 2.02-90

- Roll over TFTP block counter to prevent timeouts with data packets

  Resolves: rhbz#1871034

* Fri Aug 21 2020 Javier Martinez Canillas <javierm@redhat.com> - 2.02-89

- Fix TFTP timeouts when trying to fetch files larger than 65535 KiB

  Resolves: rhbz#1871034

* Tue Aug 11 2020 Javier Martinez Canillas <javierm@redhat.com> - 2.02-88

- Fix a legacy BIOS boot issue when a using config file shared with EFI

  Resolves: rhbz#1850193

* Mon Jul 27 2020 Peter Jones <pjones@redhat.com> - 2.02-87

- Couple more late fixes.

  Resolves: CVE-2020-15705

* Sun Jul 26 2020 Peter Jones <pjones@redhat.com> - 2.02-86

- Couple more late fixes.

  Resolves: CVE-2020-10713

  Resolves: CVE-2020-14308

  Resolves: CVE-2020-14309

  Resolves: CVE-2020-14310

  Resolves: CVE-2020-14311

* Mon Jul 20 2020 Peter Jones <pjones@redhat.com> - 2.02-85

- Fix several CVEs

  Resolves: CVE-2020-10713

  Resolves: CVE-2020-14308

  Resolves: CVE-2020-14309

  Resolves: CVE-2020-14310

  Resolves: CVE-2020-14311

* Tue May 19 2020 Javier Martinez Canillas <javierm@redhat.com> - 2.02-84

- Add fixes for greenboot support

  Resolves: rhbz#1832336

* Mon May 18 2020 Javier Martinez Canillas <javierm@redhat.com> - 2.02-83

- Fix a segfault in grub2-editenv when attempting to shrink a variable

  Resolves: rhbz#1761496

* Mon Apr 27 2020 Javier Martinez Canillas <javierm@redhat.com> - 2.02-82

- Drop "Disable multiboot, multiboot2, and linux16 modules on EFI builds"

  Resolves: rhbz#1779480

- efi/http: Export {fw,http}_path variables to make them global

  Resolves: rhbz#1811561

- efi/http: Enclose literal IPv6 addresses in square brackets

- efi/net: Allow to specify a port number in addresses

- efi/ip4_config: Improve check to detect literal IPv6 addresses

- efi/net: Print a debug message if parsing the address fails

  Resolves: rhbz#1811560

- Set image base address before jumping to the PE/COFF entry point

  Resolves: rhbz#1819624

* Thu Dec 05 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-81

- Another fix for blscfg variable expansion support

  Related: rhbz#1669252

* Thu Nov 28 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-80

- Fix PRIxGRUB_EFI_STATUS definition

  Related: rhbz#1761811

- TPM: Print messages if measuraments fail as debug instead of error

  Resolves: rhbz#1761811

- unix/platform: Initialize variable to fix grub-install on UEFI system

  Resolves: rhbz#1768689

- blscfg: add a space char when appending fields for variable expansion

  Resolves: rhbz#1669252

* Fri Nov 22 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-79

- grub-set-bootflag: Write new env to tmpfile and then rename (hdegoede)

  Resolves: CVE-2019-14865

* Thu Sep 26 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-77

- 10_linux_bls: don't add --users option to generated menu entries

  Resolves: rhbz#1755815

* Fri Aug 09 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-76

- Include regexp module in EFI builds

  Resolves: rhbz#1737670

* Wed Jun 19 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-75

- Fix setting default entry on ppc64le when using OPAL

  Resolves: rhbz#1721815

* Tue Jun 04 2019 Sergio Durigan Junior <sergiodj@redhat.com> - 2.02-74

- Use '-g' instead of '-g3' when compiling grub2.

  Related: rhbz#1653961

* Wed May 29 2019 Peter Jones <pjones@redhat.com> - 2.02-73

- Rebuild once again to try to get rpmdiff happy.

  Related: rhbz#1653961

* Mon May 27 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-72

- Build with the correct target

  Related: rhbz#1653961

* Fri May 24 2019 Peter Jones <pjones@redhat.com> - 2.02-71

- Fix (a fourth time, due to a typo) how LDFLAGS works on non-efi platforms.

  Related: rhbz#1653961

* Thu May 23 2019 Peter Jones <pjones@redhat.com> - 2.02-70

- Fix (once again) how CFLAGS and LDFLAGS propogate the settings for hardened

  builds, because rpmdiff doesn't like the current way failing.

  Related: rhbz#1653961

* Tue May 21 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-69

- Enable package gating

  Resolves: rhbz#1653961

* Mon May 20 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-68

- Avoid grub2-efi package to overwrite existing /boot/grub2/grubenv file

  Resolves: rhbz#1680572

- Try to set -fPIE and friends on libgnu.a (pjones)

- blscfg: fallback to default_kernelopts if BLS option field isn't set

  Related: rhbz#1680572

- Remove bogus load_env after blscfg command in 10_linux

* Mon Apr 29 2019 Javier Martinez Canillas <javierm@redhat.com> - 2.02-67

- Fix failure to request grub.cfg over HTTP

  Resolves: rhbz#1490991

* Wed Dec 19 2018 Javier Martinez Canillas <javierm@redhat.com> - 2.02-66

- Fix grub.cfg-XXX look up when booting over TFTP

  Resolves: rhbz#1658500

* Mon Dec 17 2018 Peter Jones <pjones@redhat.com> - 2.02-65

- Don't build the grub2-efi-ia32-* packages on i686; it causes multilib

  errors and we don't ship the result anyway.

  Related: rhbz#1637875

* Tue Dec 11 2018 Javier Martinez Canillas <javierm@redhat.com> - 2.02-64

- Make grub2-mkconfig to honour GRUB_CMDLINE_LINUX in /etc/default/grub

  Resolves: rhbz#1637875

- docs: Stop using polkit / pkexec for grub-boot-success.timer / service

  Resolves: rhbz#1655687

* Tue Dec 04 2018 Javier Martinez Canillas <javierm@redhat.com> - 2.02-63

- BLS files should only be copied by grub-switch-to-blscfg if BLS isn't set

  Related: rhbz#1638117

- Fix get_entry_number() wrongly dereferencing the tail pointer

  Resolves: rhbz#1654936

* Fri Nov 30 2018 Javier Martinez Canillas <javierm@redhat.com> - 2.02-62

- Drop "Be more aggro about actually using the *configured* network device."

  Resolves: rhbz#1654388

- Fix menu entry selection based on title

  Resolves: rhbz#1654936