From d71506e76c5c7fbe925affff58093d574b6c0cf0 Mon Sep 17 00:00:00 2001
From: Sayan Chowdhury <schowdhury@microsoft.com>
Date: Fri, 24 Nov 2023 04:50:43 +0530
Subject: [PATCH] fix

Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com>
---
 .../coreos-sb-keys-0.0.1.ebuild               |   1 +
 .../coreos-base/coreos-sb-keys/files/DB.der   | Bin 0 -> 777 bytes
 .../coreos-base/coreos-sb-keys/files/DB.pem   |  19 ++++++++++++++++++
 .../sys-boot/shim/shim-9999.ebuild            |   3 ++-
 4 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-sb-keys/files/DB.der
 create mode 100644 sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-sb-keys/files/DB.pem

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-sb-keys/coreos-sb-keys-0.0.1.ebuild b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-sb-keys/coreos-sb-keys-0.0.1.ebuild
index 9ff15fdf5d..00e8978a6c 100644
--- a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-sb-keys/coreos-sb-keys-0.0.1.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-sb-keys/coreos-sb-keys-0.0.1.ebuild
@@ -21,4 +21,5 @@ src_install() {
 	newins "${FILESDIR}/KEK.crt" KEK.crt
 	newins "${FILESDIR}/DB.key" DB.key
 	newins "${FILESDIR}/DB.crt" DB.crt
+	newins "${FILESDIR}/DB.crt" DB.der
 }
diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-sb-keys/files/DB.der b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-sb-keys/files/DB.der
new file mode 100644
index 0000000000000000000000000000000000000000..2ec1eaf3c3f8dd2712cd9bb7947131380abaa6b9
GIT binary patch
literal 777
zcmXqLVrDgHVtl)RnTe5!iIZV#n2$+d`9^gEUN%mxHjlRNyo`+8tPBQ{hT;aIY|No7
z%shO~`9-Pz!3rg*#U%<ZP6l$~yoRO*CWgj_7RJUVW>H|SDV&Q>YZIdqvPF!n49rc8
z{0u+`aWOS9GBRv%YT-Td@oSa-L=$(znK%CwD98M}Ccb0yY(~eoe)AnxsA;pgC5g`6
z>6X2?F3GuMoxII`(`}QTE-va?zc(a_UHN+D3%TS4?pN~fZ7Dn;G5cQKCGD2vc~f_V
zr%mK-&bT1>?OCM#lk*(HOQv5`(vyxpB)a-Q|7?>ozM_JUPxx#jmhN2dy!`cocBjzV
z`yN*>HGH$Vo+y2PP4CHxMY*p7c1^$PcCsYv!4xyuTXQa*=ZLy@tu20<PhD_<Ym8aR
z<b%nppMT!7Chy_%zj4#j;?!3hp2l?WWs^&H>d)Vfl?nf?OkbE51a8v!?r>v2x74}k
z7amQDa$6L9i!;Dv!89@bsZS#M?=mqnGB7R<Fz_>w1%|yWABz}^NSY1*2e#wKlndE!
zfBhN#W!=GEUuy$-khC(3gn?KCb_F~j1;Q+>2F#3%|B=HS7`ebOXJnZ6)$FB|;QEx$
zPxD>BJZHTz-)KtEx+!-$3ne2I4;kGPUVlQ7``Y~1s_)|cO;;>G^FjD{#Lc%Y6J-si
zw_U$I=X{ug^3;EFqUUZ`r)TbZ#&GNRzpD3FGaY}ulAa~{CL*sW`H{i3N2l-35TCM`
z{o^y&CG)$|H{6w6ZW$^UtTOG*9qTQ8DcL`dUGz_ky}S3d-Gi2ykxsT*zTMeZdpGTG
z5$Y7}O+6H3weIiMi?bPKEm@`Z;{Co5`PIsQ-H#hJT=4rKHz%I`e`C$1{k!6`66V%d
zbxA9#Co{xyKFrzl%<k&*e^X0u=Ok_ZTm4?^UhV4RqE@937T=!h>vhk3T3ge})^<tF
G@?rpVkxPXD

literal 0
HcmV?d00001

diff --git a/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-sb-keys/files/DB.pem b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-sb-keys/files/DB.pem
new file mode 100644
index 0000000000..e621892143
--- /dev/null
+++ b/sdk_container/src/third_party/coreos-overlay/coreos-base/coreos-sb-keys/files/DB.pem
@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDBTCCAe2gAwIBAgIJALVWTDRRd7EnMA0GCSqGSIb3DQEBCwUAMBkxFzAVBgNV
+BAMMDkNvcmVPUyB0ZXN0IERCMB4XDTE1MDQxMzE4MzM0NloXDTE1MDUxMzE4MzM0
+NlowGTEXMBUGA1UEAwwOQ29yZU9TIHRlc3QgREIwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQCwQoQNxPH1ei+RNEcxmdn8cCNc/tYXuLObAUHtTp9AqCYr
+BkZiFZ25RmujfmJDdK4fPN81tpNC0aKKr71UYgcj13noHmOgR9Rv3rRxwBib3n7S
+K4RjnpW6V2aRDYNo0BH25lk/5M8IE6SX0SIuG1vCFavAj5s0dg5ycPHkDj1Ypbmv
+Q6froIdCVX3fSNXSgPY812Eb36yNyZFybetQupfVRsl0auCUNh3anNLPCFre1oZf
+lkx+U3BFXDZ0k8Fjq+fzvKxu4ef9XpZmXieow5YCwemCRItl+ftBeWD/OjXoNXBR
+sij3QNi/CxrO59DiklpGolPaCVA0oJYWL5XkWI/dAgMBAAGjUDBOMB0GA1UdDgQW
+BBRmPA/wBsfGI3EH2/X5W/SuwY1NOzAfBgNVHSMEGDAWgBRmPA/wBsfGI3EH2/X5
+W/SuwY1NOzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCW9TbpGhGv
+ZPPlb0X05wXYnzKUUq6U3IlxGVghwjLeE6/IIQvWn+sl7l9PNainzPATx1jZ7YSR
+HTCXhtfbnM9WICOV/h4Vztt7Z2m65gDa+/5679VpQfrqG5oV7FhucmPiMNbiy92Y
+F5SjB/HmRaSfimew3RmnOVUeUySW7Nw7tA5ka/nG0U9hXd296z7ghJlZQj1qTYtr
+1Y2yv4QSiRWNZcJSOq79tdGbAJqkqibo775UH6sj/UfHMoDQTvAenF8H/4F80r+6
+X2pgnX96ihshJ2MAXQnhbLLmPtXn/pV122xis/177yrefavHFTp14KPbnU1K3jeW
+hoLJhYcZKXdz
+-----END CERTIFICATE-----
diff --git a/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-9999.ebuild b/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-9999.ebuild
index 6c29fa7e6f..85d73be186 100644
--- a/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-9999.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-9999.ebuild
@@ -21,6 +21,7 @@ LICENSE="BSD"
 SLOT="0"
 IUSE=""
 
+BDEPEND="coreos-base/coreos-sb-keys"
 RDEPEND=""
 # TODO: Would be ideal to depend on sys-boot/gnu-efi package, but
 # currently the shim insists on using the bundled copy. This will need
@@ -50,7 +51,7 @@ src_compile() {
 		emake_args+=( ARCH=aarch64 )
 	fi
   emake_args+= ( ENABLE_SBSIGN=1 )
-  emake_args+=( VENDOR_CERT_FILE="/usr/share/sb_keys/shim.der" )
+  emake_args+=( VENDOR_CERT_FILE="/usr/share/sb_keys/DB.der" )
 	emake "${emake_args[@]}" || die
 }