import grub2-2.02-148.el8

.gitignore

 SOURCES/grub-2.02.tar.xz
 SOURCES/theme.tar.bz2
 SOURCES/unifont-5.1.20080820.pcf.gz
-/grub-2.02.tar.xz
-/theme.tar.bz2
-/unifont-5.1.20080820.pcf.gz
-SOURCES/grub-2.02.tar.xz
-SOURCES/theme.tar.bz2
-SOURCES/unifont-5.1.20080820.pcf.gz

.grub2.metadata

-cc6eb0a42b5c8df2f671cc128ff725afb3ff1f8832a196022e433cf0d3b75decfca2316d0aa5fabea75747d55e88f3d021dd93508563f8ca80fd7b9e7fe1f088 SOURCES/grub-2.02.tar.xz
-0f6f914d5f801509403094b28b8cfe5169cb56ae9bdd808ae21a6780a8236b434161a068351508dd78729c25ee2fed066c124c1eef9e15102750b409b4576a5c SOURCES/theme.tar.bz2
-8939e2bc82ca97b60e6678f3ff079a2be7ba9b702f2e8ee289e853af5823695f7baafbf14b674fc5e41071f2a6de4f2dadd56bf8b4653849dd756d59622f1649 SOURCES/unifont-5.1.20080820.pcf.gz
+3d7eb6eaab28b88cb969ba9ab24af959f4d1b178 SOURCES/grub-2.02.tar.xz
+cf0b7763c528902da7e8b05cfa248f20c8825ce5 SOURCES/theme.tar.bz2
+87f8600ba24e521b5d20bdf6c4b71af8ae861e3a SOURCES/unifont-5.1.20080820.pcf.gz

SOURCES/grub.patches

@@ -573,6 +573,3 @@ Patch0572: 0572-font-Assign-null_font-to-glyphs-in-ascii_font_glyph.patch
 Patch0573: 0573-normal-charset-Fix-an-integer-overflow-in-grub_unico.patch
 Patch0574: 0574-Enable-TDX-measurement-to-RTMR-register.patch
 Patch0575: 0575-Enable-shared-processor-mode-in-vector-5.patch
-Patch0576: 0576-efi-http-change-uint32_t-to-uintn_t-for-grub_efi_htt.patch
-Patch0577: 0577-ieee1275-Converting-plain-numbers-to-constants-in-Ve.patch
-Patch0578: 0578-ieee1275-extended-support-in-options-vector5.patch

SOURCES/sbat.csv.in

 sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
-grub,3,Free Software Foundation,grub,2.02,https://www.gnu.org/software/grub/
-grub.rhel8,2,Red Hat Enterprise Linux 8,grub2,@@VERSION_RELEASE@@,mail:secalert@redhat.com
-grub.rocky8,2,Rocky Linux 8,grub2,@@VERSION_RELEASE@@,mail:security@rockylinux.org
+grub,3,Free Software Foundation,grub,@@VERSION@@,https//www.gnu.org/software/grub/
+grub.rh,2,Red Hat,grub2,@@VERSION_RELEASE@@,mailto:secalert@redhat.com
+grub.rocky,2,Rocky Linux,grub2,@@VERSION_RELEASE@@,mail:security@rockylinux.org

SPECS/grub2.spec

@@ -7,7 +7,7 @@
 Name:                 grub2
 Epoch:                1
 Version:              2.02
-Release:              150%{?dist}.rocky.0.1
+Release:              148%{?dist}.rocky.0.1
 Summary:              Bootloader with support for Linux, Multiboot and more
 Group:                System Environment/Base
 License:              GPLv3+
@@ -24,27 +24,27 @@ Source6:              gitignore
 Source8:              strtoull_test.c
 Source9:              20-grub.install
 Source12:             99-grub-mkconfig.install
+Source14:             rockybootsigningcert.cer
+Source16:             rockybootsigningcert.cer
 Source19:             sbat.csv.in
-
-Source90000:          rocky-root-ca.cer
-Source90001:          rocky-grub2.cer
+BuildRequires: system-sb-certs
 
 
 %include %{SOURCE1}
 
 %if 0%{with_efi_arch}
-%define old_sb_ca	%{SOURCE90000}
-%define old_sb_cer	%{SOURCE90001}
-%define old_sb_key	rockylinuxsecurebootkey
-%define sb_ca		%{SOURCE90000}
-%define sb_cer		%{SOURCE90001}
-%define sb_key		rockylinuxsecurebootkey
+%define old_sb_ca	%{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer
+%define old_sb_cer	%{_datadir}/pki/sb-certs/secureboot-grub2-%{_arch}.cer
+%define old_sb_key	rockybootsigningcert
+%define sb_ca		%{_datadir}/pki/sb-certs/secureboot-ca-%{_arch}.cer
+%define sb_cer		%{_datadir}/pki/sb-certs/secureboot-grub2-%{_arch}.cer
+%define sb_key		rockybootsigningcert
 %endif
 
 %ifarch ppc64le
-%define old_sb_cer	%{SOURCE90000}
-%define sb_cer		%{SOURCE90001}
-%define sb_key		rockylinuxsecurebootkey
+%define old_sb_cer	%{_datadir}/pki/sb-certs/secureboot-grub2-%{_arch}.cer
+%define sb_cer		%{_datadir}/pki/sb-certs/secureboot-grub2-%{_arch}.cer
+%define sb_key		rockybootsigningcert
 %endif
 
 # generate with do-rebase
@@ -165,7 +165,7 @@ mkdir grub-%{grubefiarch}-%{tarversion}
 grep -A100000 '# stuff "make" creates' .gitignore > grub-%{grubefiarch}-%{tarversion}/.gitignore
 cp %{SOURCE4} grub-%{grubefiarch}-%{tarversion}/unifont.pcf.gz
 sed -e "s,@@VERSION@@,%{version},g" -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \
-    %{SOURCE19} > grub-%{grubefiarch}-%{tarversion}/sbat.csv
+    -e '/,Red Hat,/ s,\.rocky\.[0-9]\.[0-9],,g' %{SOURCE19} > grub-%{grubefiarch}-%{tarversion}/sbat.csv
 git add grub-%{grubefiarch}-%{tarversion}
 %endif
 %if 0%{with_alt_efi_arch}
@@ -184,10 +184,10 @@ git commit -m "After making subdirs"
 
 %build
 %if 0%{with_efi_arch}
-%{expand:%do_primary_efi_build %%{grubefiarch} %%{grubefiname} %%{grubeficdname} %%{_target_platform} %%{efi_target_cflags} %%{efi_host_cflags} %{SOURCE90000} %{SOURCE90001} rockybootsigningcert}
+%{expand:%do_primary_efi_build %%{grubefiarch} %%{grubefiname} %%{grubeficdname} %%{_target_platform} %%{efi_target_cflags} %%{efi_host_cflags} %{sb_ca} %{sb_cer} %{sb_key}}
 %endif
 %if 0%{with_alt_efi_arch}
-%{expand:%do_alt_efi_build %%{grubaltefiarch} %%{grubaltefiname} %%{grubalteficdname} %%{_alt_target_platform} %%{alt_efi_target_cflags} %%{alt_efi_host_cflags} %{SOURCE90000} %{SOURCE90001} rockybootsigningcert}
+%{expand:%do_alt_efi_build %%{grubaltefiarch} %%{grubaltefiname} %%{grubalteficdname} %%{_alt_target_platform} %%{alt_efi_target_cflags} %%{alt_efi_host_cflags} %{sb_ca} %{sb_cer} %{sb_key}}
 %endif
 %if 0%{with_legacy_arch}
 %{expand:%do_legacy_build %%{grublegacyarch}}
@@ -508,22 +508,13 @@ fi
 %endif
 
 %changelog
-* Mon Jun 19 2023 Release Engineering <releng@rockylinux.org> - 2.02.rocky.0.1
+* Fri Nov 17 2023 Release Engineering <releng@rockylinux.org> - 2.02-148.rocky.0.1
 - Removing redhat old cert sources entries (Sherif Nagy)
 - Preserving rhel8 sbat entry based on shim-review feedback ticket no. 194
-- Adding prod cert
 - Porting to 8.9
 - Cleaning up grup.macro extra signing certs and updating rocky test CA and CERT
 - Cleaning up grup.macro extra signing certs
-- Adding Rocky testing CA, CERT and sbat files
-
-* Fri Jun 16 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.02-150
-- kern/ieee1275/init: sync vec5 patchset with upstream
-- Resolves: #2172111
-
-* Wed Jun 14 2023 Nicolas Frayer <nfrayer@redhat.com> - 2.02-149
-- efi/http: change uint32_t to uintn_t for grub_efi_http_message_t
-- Resolves: #2178388
+- Use rocky-sb-certs for secure boot signing
 
 * Mon Feb 06 2023 Robbie Harwood <rharwood@redhat.com> - 2.02-148
 - ppc64le: cas5, take 3