import shim-unsigned-x64-15.4-4.el8_1

.gitignore

-SOURCES/shim-15.tar.bz2
+SOURCES/shim-15.4.tar.bz2

.shim-unsigned-x64.metadata

-2dc6308584187bf3ee88bf9b119938c72c5a5088 SOURCES/shim-15.tar.bz2
+d70485792a300bfa66f551adf7ae766451dfe7c0 SOURCES/shim-15.4.tar.bz2

SOURCES/0001-Fix-a-broken-file-header-on-ia32.patch

+From 1bea91ba72165d97c3b453cf769cb4bc5c07207a Mon Sep 17 00:00:00 2001
+From: Peter Jones <pjones@redhat.com>
+Date: Wed, 31 Mar 2021 14:54:52 -0400
+Subject: [PATCH] Fix a broken file header on ia32
+
+Commit c6281c6a195edee61185 needs to have included a ". = ALIGN(4096)"
+directive before .reloc, but fails to do so.
+
+As a result, binutils, which does not care about the actual binary
+format's constraints in any way, does not enforce the section alignment,
+and it will not load.
+
+Signed-off-by: Peter Jones <pjones@redhat.com>
+---
+ elf_ia32_efi.lds | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/elf_ia32_efi.lds b/elf_ia32_efi.lds
+index 742e0a47a73..497a3a15265 100644
+--- a/elf_ia32_efi.lds
++++ b/elf_ia32_efi.lds
+@@ -15,6 +15,7 @@ SECTIONS
+    *(.gnu.linkonce.t.*)
+    _etext = .;
+   }
++  . = ALIGN(4096);
+   .reloc :
+   {
+    *(.reloc)
+-- 
+2.30.2
+

SOURCES/sbat.redhat.csv

+shim.redhat,1,Red Hat,shim,15.4-4,secalert@redhat.com

SOURCES/shim-find-debuginfo.sh

@@ -20,9 +20,9 @@ fi
 findsource()
 {
     (
-        cd ${RPM_BUILD_ROOT}
-        find usr/src/debug/ -type d | sed "s,^,%dir /,"
-        find usr/src/debug/ -type f | sed "s,^,/,"
+        cd "${RPM_BUILD_ROOT}"
+        find usr/src/debug/ -type d | sed -e "s,^,%dir /," | sort -u | tac
+        find usr/src/debug/ -type f | sed -e "s,^,/," | sort -u | tac
     )
 }
 
@@ -32,9 +32,12 @@ finddebug()
     declare -a dirs=()
     declare -a files=()
     declare -a excludes=()
+    declare -a tmp=()
 
-    pushd ${RPM_BUILD_ROOT} >/dev/null 2>&1
-    for x in $(find usr/lib/debug/ -type f -iname *.efi.debug); do
+    pushd "${RPM_BUILD_ROOT}" >/dev/null 2>&1
+
+    mapfile -t tmp < <(find usr/lib/debug/ -type f -iname "*.efi.debug")
+    for x in "${tmp[@]}" ; do
         if ! [ -e "${x}" ]; then
             break
         fi
@@ -57,8 +60,10 @@ finddebug()
             excludes[${#excludes[@]}]=${x%%.debug}
         fi
     done
-    for x in ${files[@]} ; do
-        declare name=$(dirname /${x})
+    for x in "${files[@]}" ; do
+        declare name
+
+        name=$(dirname "/${x}")
         while [ "${name}" != "/" ]; do
             case "${name}" in
             "/usr/lib/debug"|"/usr/lib"|"/usr")
@@ -67,24 +72,24 @@ finddebug()
                 dirs[${#dirs[@]}]=${name}
                 ;;
             esac
-            name=$(dirname ${name})
+            name=$(dirname "${name}")
         done
     done
 
     popd >/dev/null 2>&1
-    for x in ${dirs[@]} ; do
+    for x in "${dirs[@]}" ; do
         echo "%dir ${x}"
     done | sort | uniq
-    for x in ${files[@]} ; do
+    for x in "${files[@]}" ; do
         echo "/${x}"
     done | sort | uniq
-    for x in ${excludes[@]} ; do
+    for x in "${excludes[@]}" ; do
         echo "%exclude /${x}"
     done
 }
 
-findsource > build-${mainarch}/debugsource.list
-finddebug ${mainarch} > build-${mainarch}/debugfiles.list
+findsource > "build-${mainarch}/debugsource.list"
+finddebug "${mainarch}" > "build-${mainarch}/debugfiles.list"
 if [ -v altarch ]; then
-    finddebug ${altarch} > build-${altarch}/debugfiles.list
+    finddebug "${altarch}" > "build-${altarch}/debugfiles.list"
 fi