From 693935caddefa264c071f8cf074521d7d9208cd1 Mon Sep 17 00:00:00 2001
From: Lynsey Rydberg <lyrydber@microsoft.com>
Date: Mon, 3 Aug 2026 21:26:44 +0000
Subject: [PATCH 1/5] fix(shim): omit unsupported ia32 package

---
 .../shim-unsigned-x64.comp.toml               | 14 ++++++--
 locks/shim-unsigned-x64.lock                  |  2 +-
 .../shim-unsigned-x64/shim-unsigned-x64.spec  | 36 ++++---------------
 3 files changed, 20 insertions(+), 32 deletions(-)

diff --git a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
index be76c19f3c6..2d3fccdb8e4 100644
--- a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
+++ b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
@@ -7,6 +7,16 @@ overlays = [
     { type = "spec-update-tag", tag = "Release", value = "2%{?dist}" },
 
     # Workaround: create a compat symlink that does not include the dist tag.
-    { type = "spec-append-lines", section = "%install", lines = ["ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] },
-    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] }
+    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] },
+
+    # Azure Linux does not support IA32. Omit its packages and skip its build
+    # and installation paths, which require the unsupported setarch -B call.
+    { description = "Remove the unsupported IA32 shim-unsigned subpackage", type = "spec-remove-subpackage", package = "shim-unsigned-%{efialtarch}" },
+    { description = "Remove the unsupported IA32 shim-unsigned debuginfo subpackage", type = "spec-remove-subpackage", package = "shim-unsigned-%{efialtarch}-debuginfo" },
+    { description = "Do not run the debug-install helper for the IA32 build", type = "spec-search-replace", regex = '^%global __debug_install_post %{SOURCE100} %{efiarch} %{efialtarch}$', replacement = "%global __debug_install_post %{SOURCE100} %{efiarch}" },
+    { description = "Skip creating the unsupported IA32 build directory", type = "spec-search-replace", section = "%prep", regex = '^mkdir build-%{efialtarch}$', replacement = "" },
+    { description = "Skip the unsupported IA32 build commands", type = "spec-search-replace", section = "%build", regex = '^cd build-%{efialtarch}$', replacement = "%if 0\ncd build-%{efialtarch}" },
+    { description = "Close the conditional that skips the IA32 build", type = "spec-append-lines", section = "%build", lines = ["%endif"] },
+    { description = "Skip the unsupported IA32 installation commands", type = "spec-search-replace", section = "%install", regex = '^cd build-%{efialtarch}$', replacement = "%if 0\ncd build-%{efialtarch}" },
+    { description = "Close the IA32 install conditional and add the compatibility symlink", type = "spec-append-lines", section = "%install", lines = ["%endif", "ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] }
 ]
diff --git a/locks/shim-unsigned-x64.lock b/locks/shim-unsigned-x64.lock
index 3bcbb78ed11..b5895c6c284 100644
--- a/locks/shim-unsigned-x64.lock
+++ b/locks/shim-unsigned-x64.lock
@@ -3,5 +3,5 @@ version = 1
 import-commit = 'bacb81905ea6806b97b968527e5ca9b2e3f0f7b4'
 upstream-commit = 'bacb81905ea6806b97b968527e5ca9b2e3f0f7b4'
 manual-bump = 1
-input-fingerprint = 'sha256:ed3e699d4749fb506ed795fcfaa4e2b5bb892af8a44434a3c62455f9d9353437'
+input-fingerprint = 'sha256:964ef7ad8a8a7fa56cb318384daaf13721261a7681bdd586f97a72564bfa8c2a'
 resolution-input-hash = 'sha256:0adce686885cc21f043cfebaaeef82b40a1710bbb0bb74b6de645c60e147a54d'
diff --git a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
index b26c1bdc44a..307de5f9d3c 100644
--- a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
+++ b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
@@ -23,7 +23,7 @@
 %global debug_package %{nil}
 %global __debug_package 1
 %global _binaries_in_noarch_packages_terminate_build 0
-%global __debug_install_post %{SOURCE100} %{efiarch} %{efialtarch}
+%global __debug_install_post %{SOURCE100} %{efiarch}
 %undefine _debuginfo_subpackages
 
 # currently here's what's in our dbx: nothing
@@ -31,7 +31,7 @@
 
 Name:		shim-unsigned-%{efiarch}
 Version:	15.8
-Release: 4%{?dist}
+Release: 5%{?dist}
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	x86_64
 License:	BSD-2-Clause AND OpenSSL
@@ -71,13 +71,6 @@ use this package or when debugging this package.
 %description
 %desc
 
-%package -n shim-unsigned-%{efialtarch}
-Summary:	First-stage UEFI bootloader (unsigned data)
-Provides:	bundled(openssl) = %{openssl_vre}
-
-%description -n shim-unsigned-%{efialtarch}
-%desc
-
 %package debuginfo
 Summary:	Debug information for shim-unsigned-%{efiarch}
 AutoReqProv:	0
@@ -86,14 +79,6 @@ BuildArch:	noarch
 %description debuginfo
 %debug_desc
 
-%package -n shim-unsigned-%{efialtarch}-debuginfo
-Summary:	Debug information for shim-unsigned-%{efialtarch}
-AutoReqProv:	0
-BuildArch:	noarch
-
-%description -n shim-unsigned-%{efialtarch}-debuginfo
-%debug_desc
-
 %package debugsource
 Summary:	Debug Source for shim-unsigned
 AutoReqProv:	0
@@ -107,7 +92,7 @@ BuildArch:	noarch
 git config --unset user.email
 git config --unset user.name
 mkdir build-%{efiarch}
-mkdir build-%{efialtarch}
+
 cp %{SOURCE3} data/
 
 %build
@@ -131,6 +116,7 @@ make ${MAKEFLAGS} \
 	all
 cd ..
 
+%if 0
 cd build-%{efialtarch}
 setarch linux32 -B make ${MAKEFLAGS} \
 	ARCH=%{efialtarch} \
@@ -138,6 +124,7 @@ setarch linux32 -B make ${MAKEFLAGS} \
 	all
 cd ..
 
+%endif
 %install
 COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
@@ -160,6 +147,7 @@ make ${MAKEFLAGS} \
 install -m 0644 BOOT*.CSV "${RPM_BUILD_ROOT}/%{shimdir}/"
 cd ..
 
+%if 0
 cd build-%{efialtarch}
 setarch linux32 make ${MAKEFLAGS} \
 	ARCH=%{efialtarch} \
@@ -169,6 +157,7 @@ setarch linux32 make ${MAKEFLAGS} \
 install -m 0644 BOOT*.CSV "${RPM_BUILD_ROOT}/%{shimaltdir}/"
 cd ..
 
+%endif
 ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2
 %files
 %license COPYRIGHT
@@ -180,19 +169,8 @@ ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2
 %{shimdir}/*.CSV
 
 %{_datadir}/shim/%{version}-2
-%files -n shim-unsigned-%{efialtarch}
-%license COPYRIGHT
-%dir %{shimrootdir}
-%dir %{shimversiondir}
-%dir %{shimaltdir}
-%{shimaltdir}/*.efi
-%{shimaltdir}/*.hash
-%{shimaltdir}/*.CSV
-
 %files debuginfo -f build-%{efiarch}/debugfiles.list
 
-%files -n shim-unsigned-%{efialtarch}-debuginfo -f build-%{efialtarch}/debugfiles.list
-
 %files debugsource -f build-%{efiarch}/debugsource.list
 
 %changelog

From 5cb3961434b6aca05a76c7728576bdd850423554 Mon Sep 17 00:00:00 2001
From: Lynsey Rydberg <lyrydber@microsoft.com>
Date: Thu, 6 Aug 2026 21:53:59 +0000
Subject: [PATCH 2/5] chore(shim): update unsigned packages to 16.1

---
 .../shim-unsigned-aarch64.comp.toml            |  8 +++++---
 .../shim-unsigned-x64.comp.toml                |  8 +++++---
 locks/shim-unsigned-aarch64.lock               |  6 +++---
 locks/shim-unsigned-x64.lock                   |  6 +++---
 specs/s/shim-unsigned-aarch64/sbat.redhat.csv  |  3 ---
 .../s/shim-unsigned-aarch64/sbat.redhat.csv.in |  3 +++
 .../shim-unsigned-aarch64.spec                 | 18 +++++++++++++-----
 specs/s/shim-unsigned-aarch64/sources          |  2 +-
 specs/s/shim-unsigned-x64/sbat.redhat.csv      |  3 ---
 specs/s/shim-unsigned-x64/sbat.redhat.csv.in   |  3 +++
 .../s/shim-unsigned-x64/shim-unsigned-x64.spec | 18 +++++++++++++-----
 specs/s/shim-unsigned-x64/sources              |  2 +-
 12 files changed, 50 insertions(+), 30 deletions(-)
 delete mode 100644 specs/s/shim-unsigned-aarch64/sbat.redhat.csv
 create mode 100644 specs/s/shim-unsigned-aarch64/sbat.redhat.csv.in
 delete mode 100644 specs/s/shim-unsigned-x64/sbat.redhat.csv
 create mode 100644 specs/s/shim-unsigned-x64/sbat.redhat.csv.in

diff --git a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
index e0fa86020dd..4e46e1d390b 100644
--- a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
+++ b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
@@ -1,12 +1,14 @@
 [components.shim-unsigned-aarch64]
-spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "67c1d520f9a8080f6b689714099f813f23154c8f" }
+# Pin shim 16.1 to Fedora dist-git commit 4db14e5ed7d3bdb7fda97f62c93e612435f2cce9.
+spec = { type = "upstream", upstream-distro = { name = "fedora", version = "44" }, upstream-commit = "4db14e5ed7d3bdb7fda97f62c93e612435f2cce9" }
 
 overlays = [
     # Workaround: add dist tag to the release to avoid NEVR conflicts
     # while we are still rebuilding all packages in new tags nightly.
-    { type = "spec-update-tag", tag = "Release", value = "2%{?dist}" },
+    { type = "spec-update-tag", tag = "Release", value = "1%{?dist}" },
 
     # Workaround: create a compat symlink that does not include the dist tag.
     { type = "spec-append-lines", section = "%install", lines = ["ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] },
-    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] }
+    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] },
+    { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" }
 ]
diff --git a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
index 2d3fccdb8e4..7f49452db86 100644
--- a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
+++ b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
@@ -1,10 +1,11 @@
 [components.shim-unsigned-x64]
-spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "bacb81905ea6806b97b968527e5ca9b2e3f0f7b4" }
+# Pin shim 16.1 to Fedora dist-git commit d355c62164bd48c6f47774fe04b0d730d892e006.
+spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "d355c62164bd48c6f47774fe04b0d730d892e006" }
 
 overlays = [
     # Workaround: add dist tag to the release to avoid NEVR conflicts
     # while we are still rebuilding all packages in new tags nightly.
-    { type = "spec-update-tag", tag = "Release", value = "2%{?dist}" },
+    { type = "spec-update-tag", tag = "Release", value = "1%{?dist}" },
 
     # Workaround: create a compat symlink that does not include the dist tag.
     { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] },
@@ -18,5 +19,6 @@ overlays = [
     { description = "Skip the unsupported IA32 build commands", type = "spec-search-replace", section = "%build", regex = '^cd build-%{efialtarch}$', replacement = "%if 0\ncd build-%{efialtarch}" },
     { description = "Close the conditional that skips the IA32 build", type = "spec-append-lines", section = "%build", lines = ["%endif"] },
     { description = "Skip the unsupported IA32 installation commands", type = "spec-search-replace", section = "%install", regex = '^cd build-%{efialtarch}$', replacement = "%if 0\ncd build-%{efialtarch}" },
-    { description = "Close the IA32 install conditional and add the compatibility symlink", type = "spec-append-lines", section = "%install", lines = ["%endif", "ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] }
+    { description = "Close the IA32 install conditional and add the compatibility symlink", type = "spec-append-lines", section = "%install", lines = ["%endif", "ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] },
+    { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" }
 ]
diff --git a/locks/shim-unsigned-aarch64.lock b/locks/shim-unsigned-aarch64.lock
index b0c74d5cbe3..da69075e1cc 100644
--- a/locks/shim-unsigned-aarch64.lock
+++ b/locks/shim-unsigned-aarch64.lock
@@ -1,7 +1,7 @@
 # Managed by azldev component update. Do not edit manually.
 version = 1
 import-commit = '67c1d520f9a8080f6b689714099f813f23154c8f'
-upstream-commit = '67c1d520f9a8080f6b689714099f813f23154c8f'
+upstream-commit = '4db14e5ed7d3bdb7fda97f62c93e612435f2cce9'
 manual-bump = 1
-input-fingerprint = 'sha256:92d811b89ae5c9b28746a1b96deecf6d971d413071837f5cbdc17655206a9c7f'
-resolution-input-hash = 'sha256:6db1df0efaeaeb4976389f097ed39c6342b172f973c7a4ae1c93e814c760989b'
+input-fingerprint = 'sha256:fe0a56e2812f98bd3b0890154efb20f42f22cd050e51f06fb95096d97cb30e9e'
+resolution-input-hash = 'sha256:39a1f518415c394ca2aa046131b78bcd040da96a67ceab16974895aaf79e77bf'
diff --git a/locks/shim-unsigned-x64.lock b/locks/shim-unsigned-x64.lock
index b5895c6c284..92328891ecf 100644
--- a/locks/shim-unsigned-x64.lock
+++ b/locks/shim-unsigned-x64.lock
@@ -1,7 +1,7 @@
 # Managed by azldev component update. Do not edit manually.
 version = 1
 import-commit = 'bacb81905ea6806b97b968527e5ca9b2e3f0f7b4'
-upstream-commit = 'bacb81905ea6806b97b968527e5ca9b2e3f0f7b4'
+upstream-commit = 'd355c62164bd48c6f47774fe04b0d730d892e006'
 manual-bump = 1
-input-fingerprint = 'sha256:964ef7ad8a8a7fa56cb318384daaf13721261a7681bdd586f97a72564bfa8c2a'
-resolution-input-hash = 'sha256:0adce686885cc21f043cfebaaeef82b40a1710bbb0bb74b6de645c60e147a54d'
+input-fingerprint = 'sha256:fad1833a4906fabbbb976313e63b81bfe2690141f146a6d967ac89ad94b31a06'
+resolution-input-hash = 'sha256:6a1f2c11ed902ea756be8655161d7eadfb498d8b65a4633f896d278d663f7ed6'
diff --git a/specs/s/shim-unsigned-aarch64/sbat.redhat.csv b/specs/s/shim-unsigned-aarch64/sbat.redhat.csv
deleted file mode 100644
index cfcf0130fc6..00000000000
--- a/specs/s/shim-unsigned-aarch64/sbat.redhat.csv
+++ /dev/null
@@ -1,3 +0,0 @@
-shim.rh,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
-shim.redhat,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
-shim.fedora,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
diff --git a/specs/s/shim-unsigned-aarch64/sbat.redhat.csv.in b/specs/s/shim-unsigned-aarch64/sbat.redhat.csv.in
new file mode 100644
index 00000000000..eb2203f11ea
--- /dev/null
+++ b/specs/s/shim-unsigned-aarch64/sbat.redhat.csv.in
@@ -0,0 +1,3 @@
+shim.rh,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
+shim.redhat,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
+shim.fedora,3,The Fedora Project,shim,@@VERSION@@-@@RELEASE@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
diff --git a/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec b/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
index 6b27b540818..a409b686da3 100644
--- a/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
+++ b/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
@@ -3,6 +3,7 @@
 
 %global pesign_vre 0.106-1
 %global openssl_vre 1.0.2j
+%global shim_commit_id afc49558b34548644c1cd0ad1b6526a9470182ed
 
 # For prereleases, % global prerelease rc2, and downpatch Makefile
 %if %{defined prerelease}
@@ -28,7 +29,7 @@
 %global dbxfile %{nil}
 
 Name:		shim-unsigned-aarch64
-Version:	15.8
+Version:	16.1
 Release: 4%{?dist}
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	aarch64
@@ -39,7 +40,7 @@ Source1:	fedora-ca-20200709.cer
 %if 0%{?dbxfile}
 Source2:	%{dbxfile}
 %endif
-Source3:	sbat.redhat.csv
+Source3:	sbat.redhat.csv.in
 Source4:	shim.patches
 
 Source100:	shim-find-debuginfo.sh
@@ -51,6 +52,7 @@ BuildRequires:	elfutils-libelf-devel
 BuildRequires:	git openssl-devel openssl
 BuildRequires:	pesign >= %{pesign_vre}
 BuildRequires:	dos2unix findutils
+BuildRequires:	sed
 
 # Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not
 # compatible with SysV (there's no red zone under UEFI) and there isn't a
@@ -90,13 +92,16 @@ BuildArch:	noarch
 git config --unset user.email
 git config --unset user.name
 mkdir build-%{efiarch}
-cp %{SOURCE3} data/
+sed -e 's/@@VERSION@@/%{version}/g' \
+    -e 's/@@RELEASE@@/%{release}/g' \
+    < %{SOURCE3} > data/sbat.redhat.csv
 
 %build
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
+MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2025021800 "
 MAKEFLAGS+=" %{_smp_mflags} "
 if [ -f "%{SOURCE1}" ]; then
 	MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "
@@ -114,7 +119,7 @@ make ${MAKEFLAGS} \
 cd ..
 
 %install
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
@@ -151,6 +156,9 @@ ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2
 %files debugsource -f build-%{efiarch}/debugsource.list
 
 %changelog
+* Wed Sep 03 2025 Peter Jones <pjones@redhat.com> - 16.1-1
+- Update to shim-16.1
+
 * Fri Mar 22 2024 Nicolas Frayer <nfrayer@redhat.com>
 - Migrate to SPDX license
 - Please refer to https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2
diff --git a/specs/s/shim-unsigned-aarch64/sources b/specs/s/shim-unsigned-aarch64/sources
index 5428b758ad0..e96df6e1d7e 100644
--- a/specs/s/shim-unsigned-aarch64/sources
+++ b/specs/s/shim-unsigned-aarch64/sources
@@ -1 +1 @@
-SHA512 (shim-15.8.tar.bz2) = 30b3390ae935121ea6fe728d8f59d37ded7b918ad81bea06e213464298b4bdabbca881b30817965bd397facc596db1ad0b8462a84c87896ce6c1204b19371cd1
+SHA512 (shim-16.1.tar.bz2) = ca5f80e82f3b80b622028f03ef23105c98ee1b6a25f52a59c823080a3202dd4b9962266489296e99f955eb92e36ce13e0b1d57f688350006bba45f2718f159fb
diff --git a/specs/s/shim-unsigned-x64/sbat.redhat.csv b/specs/s/shim-unsigned-x64/sbat.redhat.csv
deleted file mode 100644
index cfcf0130fc6..00000000000
--- a/specs/s/shim-unsigned-x64/sbat.redhat.csv
+++ /dev/null
@@ -1,3 +0,0 @@
-shim.rh,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
-shim.redhat,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
-shim.fedora,3,The Fedora Project,shim,15.8,https://src.fedoraproject.org/rpms/shim-unsigned-x64
diff --git a/specs/s/shim-unsigned-x64/sbat.redhat.csv.in b/specs/s/shim-unsigned-x64/sbat.redhat.csv.in
new file mode 100644
index 00000000000..55dba1f876c
--- /dev/null
+++ b/specs/s/shim-unsigned-x64/sbat.redhat.csv.in
@@ -0,0 +1,3 @@
+shim.rh,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
+shim.redhat,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
+shim.fedora,3,The Fedora Project,shim,@@VERSION@@-@@RELEASE@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
diff --git a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
index 307de5f9d3c..63eab961d64 100644
--- a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
+++ b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
@@ -3,6 +3,7 @@
 
 %global pesign_vre 0.106-1
 %global openssl_vre 1.0.2j
+%global shim_commit_id afc49558b34548644c1cd0ad1b6526a9470182ed
 
 # For prereleases, % global prerelease rc2, and downpatch Makefile
 %if %{defined prerelease}
@@ -30,7 +31,7 @@
 %global dbxfile %{nil}
 
 Name:		shim-unsigned-%{efiarch}
-Version:	15.8
+Version:	16.1
 Release: 5%{?dist}
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	x86_64
@@ -41,7 +42,7 @@ Source1:	fedora-ca-20200709.cer
 %if 0%{?dbxfile}
 Source2:	%{dbxfile}
 %endif
-Source3:	sbat.redhat.csv
+Source3:	sbat.redhat.csv.in
 Source4:	shim.patches
 
 Source100:	shim-find-debuginfo.sh
@@ -53,6 +54,7 @@ BuildRequires:	elfutils-libelf-devel
 BuildRequires:	git openssl-devel openssl
 BuildRequires:	pesign >= %{pesign_vre}
 BuildRequires:	dos2unix findutils
+BuildRequires:	sed
 
 # Shim uses OpenSSL, but cannot use the system copy as the UEFI ABI is not
 # compatible with SysV (there's no red zone under UEFI) and there isn't a
@@ -93,13 +95,16 @@ git config --unset user.email
 git config --unset user.name
 mkdir build-%{efiarch}
 
-cp %{SOURCE3} data/
+sed -e 's/@@VERSION@@/%{version}/g' \
+    -e 's/@@RELEASE@@/%{release}/g' \
+    < %{SOURCE3} > data/sbat.redhat.csv
 
 %build
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
+MAKEFLAGS+="SBAT_AUTOMATIC_DATE=2025021800 "
 MAKEFLAGS+=" %{_smp_mflags} "
 if [ -f "%{SOURCE1}" ]; then
 	MAKEFLAGS="$MAKEFLAGS VENDOR_CERT_FILE=%{SOURCE1} "
@@ -126,7 +131,7 @@ cd ..
 
 %endif
 %install
-COMMIT_ID=5914984a1ffeab841f482c791426d7ca9935a5e6
+COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
 MAKEFLAGS+="EFIDIR=%{efidir} PKGNAME=shim RELEASE=%{release} "
 MAKEFLAGS+="ENABLE_SHIM_HASH=true "
@@ -174,6 +179,9 @@ ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2
 %files debugsource -f build-%{efiarch}/debugsource.list
 
 %changelog
+* Wed Sep 03 2025 Peter Jones <pjones@redhat.com> - 16.1-1
+- Update to shim-16.1
+
 * Fri Mar 22 2024 Nicolas Frayer <nfrayer@redhat.com>
 - Migrate to SPDX license
 - Please refer to https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2
diff --git a/specs/s/shim-unsigned-x64/sources b/specs/s/shim-unsigned-x64/sources
index 5428b758ad0..e96df6e1d7e 100644
--- a/specs/s/shim-unsigned-x64/sources
+++ b/specs/s/shim-unsigned-x64/sources
@@ -1 +1 @@
-SHA512 (shim-15.8.tar.bz2) = 30b3390ae935121ea6fe728d8f59d37ded7b918ad81bea06e213464298b4bdabbca881b30817965bd397facc596db1ad0b8462a84c87896ce6c1204b19371cd1
+SHA512 (shim-16.1.tar.bz2) = ca5f80e82f3b80b622028f03ef23105c98ee1b6a25f52a59c823080a3202dd4b9962266489296e99f955eb92e36ce13e0b1d57f688350006bba45f2718f159fb

From 44bd1a2bbd8bee4b190c046fc4f5f4cdb34f2997 Mon Sep 17 00:00:00 2001
From: Lynsey Rydberg <lyrydber@microsoft.com>
Date: Fri, 7 Aug 2026 04:50:31 +0000
Subject: [PATCH 3/5] feat(shim): add Azure Linux SBAT provenance

---
 .../shim-unsigned-aarch64.comp.toml                      | 9 +++++++++
 base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml | 9 +++++++++
 locks/shim-unsigned-aarch64.lock                         | 2 +-
 locks/shim-unsigned-x64.lock                             | 2 +-
 specs/s/shim-unsigned-aarch64/sbat.azurelinux.csv.in     | 4 ++++
 specs/s/shim-unsigned-aarch64/sbat.redhat.csv.in         | 3 ---
 specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec | 7 +++++--
 specs/s/shim-unsigned-x64/sbat.azurelinux.csv.in         | 4 ++++
 specs/s/shim-unsigned-x64/sbat.redhat.csv.in             | 3 ---
 specs/s/shim-unsigned-x64/shim-unsigned-x64.spec         | 7 +++++--
 10 files changed, 38 insertions(+), 12 deletions(-)
 create mode 100644 specs/s/shim-unsigned-aarch64/sbat.azurelinux.csv.in
 delete mode 100644 specs/s/shim-unsigned-aarch64/sbat.redhat.csv.in
 create mode 100644 specs/s/shim-unsigned-x64/sbat.azurelinux.csv.in
 delete mode 100644 specs/s/shim-unsigned-x64/sbat.redhat.csv.in

diff --git a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
index 4e46e1d390b..ac4b3af87a4 100644
--- a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
+++ b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
@@ -10,5 +10,14 @@ overlays = [
     # Workaround: create a compat symlink that does not include the dist tag.
     { type = "spec-append-lines", section = "%install", lines = ["ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] },
     { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] },
+
+    # Preserve the Fedora SBAT EVR and append the Azure Linux SBAT EVR.
+    { description = "Use the Fedora 16.1-1.fc44 EVR in the shim.fedora SBAT record", type = "file-search-replace", file = "sbat.redhat.csv.in", regex = '@@VERSION@@-@@RELEASE@@', replacement = '@@UPSTREAM_VERSION_RELEASE@@', metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Add the Azure Linux shim SBAT record", type = "file-search-replace", file = "sbat.redhat.csv.in", regex = '\n\z', replacement = "\nshim.azurelinux,1,Microsoft,shim,@@VERSION@@-@@RELEASE@@,https://github.com/microsoft/azurelinux/issues\n", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Define the upstream Fedora shim EVR for SBAT substitution", type = "spec-prepend-lines", lines = ["%global upstream_version_release 16.1-1.fc44", ""], metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Substitute the upstream Fedora shim EVR into SBAT", type = "spec-search-replace", section = "%prep", regex = '''^    -e 's/@@RELEASE@@/%{release}/g' \\$''', replacement = '''    -e 's/@@RELEASE@@/%{release}/g' \
+    -e 's/@@UPSTREAM_VERSION_RELEASE@@/%{upstream_version_release}/g' \''', metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Rename the Azure Linux shim SBAT template", type = "file-rename", file = "sbat.redhat.csv.in", replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Use the renamed Azure Linux SBAT template as Source3", type = "spec-search-replace", regex = 'sbat\.redhat\.csv\.in', replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
     { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" }
 ]
diff --git a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
index 7f49452db86..ea67e30c4ea 100644
--- a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
+++ b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
@@ -20,5 +20,14 @@ overlays = [
     { description = "Close the conditional that skips the IA32 build", type = "spec-append-lines", section = "%build", lines = ["%endif"] },
     { description = "Skip the unsupported IA32 installation commands", type = "spec-search-replace", section = "%install", regex = '^cd build-%{efialtarch}$', replacement = "%if 0\ncd build-%{efialtarch}" },
     { description = "Close the IA32 install conditional and add the compatibility symlink", type = "spec-append-lines", section = "%install", lines = ["%endif", "ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] },
+
+    # Preserve the Fedora SBAT EVR and append the Azure Linux SBAT EVR.
+    { description = "Use the Fedora 16.1-1.fc43 EVR in the shim.fedora SBAT record", type = "file-search-replace", file = "sbat.redhat.csv.in", regex = '@@VERSION@@-@@RELEASE@@', replacement = '@@UPSTREAM_VERSION_RELEASE@@', metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Add the Azure Linux shim SBAT record", type = "file-search-replace", file = "sbat.redhat.csv.in", regex = '\n\z', replacement = "\nshim.azurelinux,1,Microsoft,shim,@@VERSION@@-@@RELEASE@@,https://github.com/microsoft/azurelinux/issues\n", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Define the upstream Fedora shim EVR for SBAT substitution", type = "spec-prepend-lines", lines = ["%global upstream_version_release 16.1-1.fc43", ""], metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Substitute the upstream Fedora shim EVR into SBAT", type = "spec-search-replace", section = "%prep", regex = '''^    -e 's/@@RELEASE@@/%{release}/g' \\$''', replacement = '''    -e 's/@@RELEASE@@/%{release}/g' \
+    -e 's/@@UPSTREAM_VERSION_RELEASE@@/%{upstream_version_release}/g' \''', metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Rename the Azure Linux shim SBAT template", type = "file-rename", file = "sbat.redhat.csv.in", replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Use the renamed Azure Linux SBAT template as Source3", type = "spec-search-replace", regex = 'sbat\.redhat\.csv\.in', replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
     { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" }
 ]
diff --git a/locks/shim-unsigned-aarch64.lock b/locks/shim-unsigned-aarch64.lock
index da69075e1cc..df90fb3fd93 100644
--- a/locks/shim-unsigned-aarch64.lock
+++ b/locks/shim-unsigned-aarch64.lock
@@ -3,5 +3,5 @@ version = 1
 import-commit = '67c1d520f9a8080f6b689714099f813f23154c8f'
 upstream-commit = '4db14e5ed7d3bdb7fda97f62c93e612435f2cce9'
 manual-bump = 1
-input-fingerprint = 'sha256:fe0a56e2812f98bd3b0890154efb20f42f22cd050e51f06fb95096d97cb30e9e'
+input-fingerprint = 'sha256:59dcfae752858153cc18634c47ba1c269600f174f2682b688af9e0427ae19f6e'
 resolution-input-hash = 'sha256:39a1f518415c394ca2aa046131b78bcd040da96a67ceab16974895aaf79e77bf'
diff --git a/locks/shim-unsigned-x64.lock b/locks/shim-unsigned-x64.lock
index 92328891ecf..98617ef7b3d 100644
--- a/locks/shim-unsigned-x64.lock
+++ b/locks/shim-unsigned-x64.lock
@@ -3,5 +3,5 @@ version = 1
 import-commit = 'bacb81905ea6806b97b968527e5ca9b2e3f0f7b4'
 upstream-commit = 'd355c62164bd48c6f47774fe04b0d730d892e006'
 manual-bump = 1
-input-fingerprint = 'sha256:fad1833a4906fabbbb976313e63b81bfe2690141f146a6d967ac89ad94b31a06'
+input-fingerprint = 'sha256:6501f11d70b14f81664b5556f98326381d5f32ebabe3caf9a766353707d4247d'
 resolution-input-hash = 'sha256:6a1f2c11ed902ea756be8655161d7eadfb498d8b65a4633f896d278d663f7ed6'
diff --git a/specs/s/shim-unsigned-aarch64/sbat.azurelinux.csv.in b/specs/s/shim-unsigned-aarch64/sbat.azurelinux.csv.in
new file mode 100644
index 00000000000..f5d6925b3b6
--- /dev/null
+++ b/specs/s/shim-unsigned-aarch64/sbat.azurelinux.csv.in
@@ -0,0 +1,4 @@
+shim.rh,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
+shim.redhat,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
+shim.fedora,3,The Fedora Project,shim,@@UPSTREAM_VERSION_RELEASE@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
+shim.azurelinux,1,Microsoft,shim,@@VERSION@@-@@RELEASE@@,https://github.com/microsoft/azurelinux/issues
diff --git a/specs/s/shim-unsigned-aarch64/sbat.redhat.csv.in b/specs/s/shim-unsigned-aarch64/sbat.redhat.csv.in
deleted file mode 100644
index eb2203f11ea..00000000000
--- a/specs/s/shim-unsigned-aarch64/sbat.redhat.csv.in
+++ /dev/null
@@ -1,3 +0,0 @@
-shim.rh,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
-shim.redhat,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
-shim.fedora,3,The Fedora Project,shim,@@VERSION@@-@@RELEASE@@,https://src.fedoraproject.org/rpms/shim-unsigned-aarch64
diff --git a/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec b/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
index a409b686da3..0c03cbed0f2 100644
--- a/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
+++ b/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
@@ -1,6 +1,8 @@
 # This spec file has been modified by azldev to include build configuration overlays.
 # Do not edit manually; changes may be overwritten.
 
+%global upstream_version_release 16.1-1.fc44
+
 %global pesign_vre 0.106-1
 %global openssl_vre 1.0.2j
 %global shim_commit_id afc49558b34548644c1cd0ad1b6526a9470182ed
@@ -30,7 +32,7 @@
 
 Name:		shim-unsigned-aarch64
 Version:	16.1
-Release: 4%{?dist}
+Release: 5%{?dist}
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	aarch64
 License:	BSD-2-Clause AND OpenSSL
@@ -40,7 +42,7 @@ Source1:	fedora-ca-20200709.cer
 %if 0%{?dbxfile}
 Source2:	%{dbxfile}
 %endif
-Source3:	sbat.redhat.csv.in
+Source3:	sbat.azurelinux.csv.in
 Source4:	shim.patches
 
 Source100:	shim-find-debuginfo.sh
@@ -94,6 +96,7 @@ git config --unset user.name
 mkdir build-%{efiarch}
 sed -e 's/@@VERSION@@/%{version}/g' \
     -e 's/@@RELEASE@@/%{release}/g' \
+    -e 's/@@UPSTREAM_VERSION_RELEASE@@/%{upstream_version_release}/g' \
     < %{SOURCE3} > data/sbat.redhat.csv
 
 %build
diff --git a/specs/s/shim-unsigned-x64/sbat.azurelinux.csv.in b/specs/s/shim-unsigned-x64/sbat.azurelinux.csv.in
new file mode 100644
index 00000000000..65e210eaebb
--- /dev/null
+++ b/specs/s/shim-unsigned-x64/sbat.azurelinux.csv.in
@@ -0,0 +1,4 @@
+shim.rh,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
+shim.redhat,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
+shim.fedora,3,The Fedora Project,shim,@@UPSTREAM_VERSION_RELEASE@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
+shim.azurelinux,1,Microsoft,shim,@@VERSION@@-@@RELEASE@@,https://github.com/microsoft/azurelinux/issues
diff --git a/specs/s/shim-unsigned-x64/sbat.redhat.csv.in b/specs/s/shim-unsigned-x64/sbat.redhat.csv.in
deleted file mode 100644
index 55dba1f876c..00000000000
--- a/specs/s/shim-unsigned-x64/sbat.redhat.csv.in
+++ /dev/null
@@ -1,3 +0,0 @@
-shim.rh,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
-shim.redhat,3,The Fedora Project,shim,@@VERSION@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
-shim.fedora,3,The Fedora Project,shim,@@VERSION@@-@@RELEASE@@,https://src.fedoraproject.org/rpms/shim-unsigned-x64
diff --git a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
index 63eab961d64..53b80d36124 100644
--- a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
+++ b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
@@ -1,6 +1,8 @@
 # This spec file has been modified by azldev to include build configuration overlays.
 # Do not edit manually; changes may be overwritten.
 
+%global upstream_version_release 16.1-1.fc43
+
 %global pesign_vre 0.106-1
 %global openssl_vre 1.0.2j
 %global shim_commit_id afc49558b34548644c1cd0ad1b6526a9470182ed
@@ -32,7 +34,7 @@
 
 Name:		shim-unsigned-%{efiarch}
 Version:	16.1
-Release: 5%{?dist}
+Release: 6%{?dist}
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	x86_64
 License:	BSD-2-Clause AND OpenSSL
@@ -42,7 +44,7 @@ Source1:	fedora-ca-20200709.cer
 %if 0%{?dbxfile}
 Source2:	%{dbxfile}
 %endif
-Source3:	sbat.redhat.csv.in
+Source3:	sbat.azurelinux.csv.in
 Source4:	shim.patches
 
 Source100:	shim-find-debuginfo.sh
@@ -97,6 +99,7 @@ mkdir build-%{efiarch}
 
 sed -e 's/@@VERSION@@/%{version}/g' \
     -e 's/@@RELEASE@@/%{release}/g' \
+    -e 's/@@UPSTREAM_VERSION_RELEASE@@/%{upstream_version_release}/g' \
     < %{SOURCE3} > data/sbat.redhat.csv
 
 %build

From 78bdf7aaf28a02051c7dc7362da979203423a39e Mon Sep 17 00:00:00 2001
From: Lynsey Rydberg <lyrydber@microsoft.com>
Date: Fri, 7 Aug 2026 05:59:28 +0000
Subject: [PATCH 4/5] feat(shim): embed Azure Linux vendor certificate

Replace the Fedora Secure Boot CA with the Azure Linux CA in both unsigned shim packages.
---
 .../azurelinux-ca-20230216.der                   | Bin 0 -> 1722 bytes
 .../shim-unsigned-aarch64.comp.toml              |   2 ++
 .../shim-unsigned-x64/azurelinux-ca-20230216.der | Bin 0 -> 1722 bytes
 .../shim-unsigned-x64.comp.toml                  |   2 ++
 locks/shim-unsigned-aarch64.lock                 |   2 +-
 locks/shim-unsigned-x64.lock                     |   2 +-
 .../azurelinux-ca-20230216.der                   | Bin 0 -> 1722 bytes
 .../shim-unsigned-aarch64/fedora-ca-20200709.cer | Bin 1119 -> 0 bytes
 .../shim-unsigned-aarch64.spec                   |   4 ++--
 .../shim-unsigned-x64/azurelinux-ca-20230216.der | Bin 0 -> 1722 bytes
 specs/s/shim-unsigned-x64/fedora-ca-20200709.cer | Bin 1119 -> 0 bytes
 specs/s/shim-unsigned-x64/shim-unsigned-x64.spec |   4 ++--
 12 files changed, 10 insertions(+), 6 deletions(-)
 create mode 100644 base/comps/shim-unsigned-aarch64/azurelinux-ca-20230216.der
 create mode 100644 base/comps/shim-unsigned-x64/azurelinux-ca-20230216.der
 create mode 100644 specs/s/shim-unsigned-aarch64/azurelinux-ca-20230216.der
 delete mode 100644 specs/s/shim-unsigned-aarch64/fedora-ca-20200709.cer
 create mode 100644 specs/s/shim-unsigned-x64/azurelinux-ca-20230216.der
 delete mode 100644 specs/s/shim-unsigned-x64/fedora-ca-20200709.cer

diff --git a/base/comps/shim-unsigned-aarch64/azurelinux-ca-20230216.der b/base/comps/shim-unsigned-aarch64/azurelinux-ca-20230216.der
new file mode 100644
index 0000000000000000000000000000000000000000..7415958d7d4b4884656a3f9aef440404c18ef5e1
GIT binary patch
literal 1722
zcmb7^XH=6{7{}i?iy4Mtib4QUNQB%Z3ZjTWDjS6WiWq@F0!D?vOJZ<fHDYAStm08A
z;#Mdskx`Y=3WBA;0Z|cfA;W<qxEMm;wAK2p$1nF;_qqT3oO6E{NC}ldiYqF{Vqgr0
z#DpLS6IBqu-Js{~ebh%IKqRP9WS+8*L>MOGArMN}0BQtmFpfaN1P9Vh!5n3vPSW=i
zL?OaNVYG<M5+d<JgewvV<LFdiqpV{|7XQ`#xQHN*kC54cu4J}Qh&H&A8GykAriMgx
zWzg;Ej!Z|u2sI=!mjDKEWY8Il7c)aa#P?~_0qq}c>o1Byh&WNi=aJpGiTuCiSwbG4
z94Ls16U4=!*8ozC#kT{)cnB-SXhUdT9V5lSP~A1(b#J_Oog=Zg>(-iy*+^&JkU`~Q
zlUtO=vFA}<qOzAG+ie93gUwDF^X`NXo_XY{RcSTz!xP@qlR+eFNzwJGoZ-q;VfF%J
zxkdV9*F8o$w}Lz#HmUxa6zaY(!H=1-py*2KNy^W**SF+HEE`Mi>Ro;+A+)>M-$qbn
zUZ?6kKR(-~q>=Y#ry&1axxi!HMb?5KYD4Ffftn2dd6iW)!k{F@B|@R?{KwIT4=ax8
z1TTwON@Y~JEAHTF&woqKrRU71B)Cj?XZ2L9xaIont#9Y$I<e~79ZcWpI|@wGB$8h)
zoAqq<ukFhM&kU9IIeK((T`l%x+V701m>!MZr*Y5Yx@w(x&#sla#K@L5Nrk;R>(7jA
zoHJcN;Pk<lM29$E%HTks;L~vbt9N!6`<$u-d$F?q<4M{}FWsygg>p?994Go#{Y<*n
zvof~>AJz~w^FEK(E>ZCwY$iQB+hly%$XJzIxZlY+K%&J8No0;dHa8AUTUy=axf?$}
zHV{;_gKD^8xWiV#Z&`0yp7M6o=)vKbC-sFHgR@)v8XvNGTwZ=Vv0ulx{pv!BdG#lW
zMwq?+AFh3iN?Q}RId0+1iR?CLUDofznqWMR;qM*TN)e9iw>dKql@y3~>)4w4^loam
ztwUwwyTS4sU2GfAVwH^~zl^l?K7+xO=<);%7KY#xQaBb!VFA!WpVwS%7@oo5P<~`U
zhoD9!z&KdypbslE5SXjnp@lQR>4}3bg(t^Py~(Q4KEFxaP%BU0#R0}&8}u+ZO;dF!
z5E4U?5DRhz+R9Fn@@zc7q6U~L6P7q5V6a<nv|>iHdrI?a<J^_+k??r^@#dz}fUn$O
zh6@865Lz5kyhawZQ6!3AN~1|661&(hblOD;V`=f51;Y45S`@N{_7zJj2KW~f)I-r!
zt|*+SVJUqjpmt~jKnSYnka)Zb4CA5!4@7>60Y<jwe--(NDDitWMc*Qc{y`{`FceW@
zmwnQXd&8IHnT>T-FF-bJu1HR58kV(2%H=tq>O)r0HtQ@gu|L$@uE^h1(`B3zYsfli
z*q=Z4^zhz&s}#<U93&6CV!^`7X^z=#>ua2}5a`DT7M9fo=Tq||dUquk0ZUUojtEa=
z*6FrzSqAOn6tPpl@Z}!FKgei&n)Ue{@t|2vLa9$^$65d27Yo_D8THU>mui!-hnwCM
zY$-uzzuK9gd3VSxa|XOnkL-NiGS}fewzToGv0<agh$i1@;pi3+oNChBfORK}n+i7^
z@Le5zRDRPym3rkqzARAErqOn&Y-ac5psm`zdRj=*UU#iic^V^f?n~?3r)PI0Y9l{o
ze115D^Mdd7_yhI!6Ek{YO+MqtdG7guqC2m=(;_@t>-V;)l*#U1bE)jOZC2@&OpUtk
z(zYEcA{*>}m)hmlEw4iOTN~x6Dn1#q7I&Ji%v97-Jw4L%>MmS2Yfs;tTl247Ww?#{
z7lxlx>(*RnG^UR9W)>ak#Cmvr2q+8vIBs%8r)z?pbfK#Ch9bO2tt<Doq4z*owsY2i
z6(udX@*XmjL*KCPd1Xq|q7u8+dDNH3(k6u&ScLP-_T(ivf6s;~xd)CN;xX3X&|k`%
vSo^+fX4~f~s9FDLx*{ct&9Ux?u()vR-BoNG1?h0kOFI=&O{OlkbA<l_lJBhx

literal 0
HcmV?d00001

diff --git a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
index ac4b3af87a4..321f4d439f9 100644
--- a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
+++ b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
@@ -19,5 +19,7 @@ overlays = [
     -e 's/@@UPSTREAM_VERSION_RELEASE@@/%{upstream_version_release}/g' \''', metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
     { description = "Rename the Azure Linux shim SBAT template", type = "file-rename", file = "sbat.redhat.csv.in", replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
     { description = "Use the renamed Azure Linux SBAT template as Source3", type = "spec-search-replace", regex = 'sbat\.redhat\.csv\.in', replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Stage the Azure Linux Secure Boot CA as the shim vendor certificate", type = "file-add", file = "azurelinux-ca-20230216.der", source = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
+    { description = "Use the Azure Linux Secure Boot CA as shim Source1", type = "spec-search-replace", regex = 'fedora-ca-20200709\.cer', replacement = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
     { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" }
 ]
diff --git a/base/comps/shim-unsigned-x64/azurelinux-ca-20230216.der b/base/comps/shim-unsigned-x64/azurelinux-ca-20230216.der
new file mode 100644
index 0000000000000000000000000000000000000000..7415958d7d4b4884656a3f9aef440404c18ef5e1
GIT binary patch
literal 1722
zcmb7^XH=6{7{}i?iy4Mtib4QUNQB%Z3ZjTWDjS6WiWq@F0!D?vOJZ<fHDYAStm08A
z;#Mdskx`Y=3WBA;0Z|cfA;W<qxEMm;wAK2p$1nF;_qqT3oO6E{NC}ldiYqF{Vqgr0
z#DpLS6IBqu-Js{~ebh%IKqRP9WS+8*L>MOGArMN}0BQtmFpfaN1P9Vh!5n3vPSW=i
zL?OaNVYG<M5+d<JgewvV<LFdiqpV{|7XQ`#xQHN*kC54cu4J}Qh&H&A8GykAriMgx
zWzg;Ej!Z|u2sI=!mjDKEWY8Il7c)aa#P?~_0qq}c>o1Byh&WNi=aJpGiTuCiSwbG4
z94Ls16U4=!*8ozC#kT{)cnB-SXhUdT9V5lSP~A1(b#J_Oog=Zg>(-iy*+^&JkU`~Q
zlUtO=vFA}<qOzAG+ie93gUwDF^X`NXo_XY{RcSTz!xP@qlR+eFNzwJGoZ-q;VfF%J
zxkdV9*F8o$w}Lz#HmUxa6zaY(!H=1-py*2KNy^W**SF+HEE`Mi>Ro;+A+)>M-$qbn
zUZ?6kKR(-~q>=Y#ry&1axxi!HMb?5KYD4Ffftn2dd6iW)!k{F@B|@R?{KwIT4=ax8
z1TTwON@Y~JEAHTF&woqKrRU71B)Cj?XZ2L9xaIont#9Y$I<e~79ZcWpI|@wGB$8h)
zoAqq<ukFhM&kU9IIeK((T`l%x+V701m>!MZr*Y5Yx@w(x&#sla#K@L5Nrk;R>(7jA
zoHJcN;Pk<lM29$E%HTks;L~vbt9N!6`<$u-d$F?q<4M{}FWsygg>p?994Go#{Y<*n
zvof~>AJz~w^FEK(E>ZCwY$iQB+hly%$XJzIxZlY+K%&J8No0;dHa8AUTUy=axf?$}
zHV{;_gKD^8xWiV#Z&`0yp7M6o=)vKbC-sFHgR@)v8XvNGTwZ=Vv0ulx{pv!BdG#lW
zMwq?+AFh3iN?Q}RId0+1iR?CLUDofznqWMR;qM*TN)e9iw>dKql@y3~>)4w4^loam
ztwUwwyTS4sU2GfAVwH^~zl^l?K7+xO=<);%7KY#xQaBb!VFA!WpVwS%7@oo5P<~`U
zhoD9!z&KdypbslE5SXjnp@lQR>4}3bg(t^Py~(Q4KEFxaP%BU0#R0}&8}u+ZO;dF!
z5E4U?5DRhz+R9Fn@@zc7q6U~L6P7q5V6a<nv|>iHdrI?a<J^_+k??r^@#dz}fUn$O
zh6@865Lz5kyhawZQ6!3AN~1|661&(hblOD;V`=f51;Y45S`@N{_7zJj2KW~f)I-r!
zt|*+SVJUqjpmt~jKnSYnka)Zb4CA5!4@7>60Y<jwe--(NDDitWMc*Qc{y`{`FceW@
zmwnQXd&8IHnT>T-FF-bJu1HR58kV(2%H=tq>O)r0HtQ@gu|L$@uE^h1(`B3zYsfli
z*q=Z4^zhz&s}#<U93&6CV!^`7X^z=#>ua2}5a`DT7M9fo=Tq||dUquk0ZUUojtEa=
z*6FrzSqAOn6tPpl@Z}!FKgei&n)Ue{@t|2vLa9$^$65d27Yo_D8THU>mui!-hnwCM
zY$-uzzuK9gd3VSxa|XOnkL-NiGS}fewzToGv0<agh$i1@;pi3+oNChBfORK}n+i7^
z@Le5zRDRPym3rkqzARAErqOn&Y-ac5psm`zdRj=*UU#iic^V^f?n~?3r)PI0Y9l{o
ze115D^Mdd7_yhI!6Ek{YO+MqtdG7guqC2m=(;_@t>-V;)l*#U1bE)jOZC2@&OpUtk
z(zYEcA{*>}m)hmlEw4iOTN~x6Dn1#q7I&Ji%v97-Jw4L%>MmS2Yfs;tTl247Ww?#{
z7lxlx>(*RnG^UR9W)>ak#Cmvr2q+8vIBs%8r)z?pbfK#Ch9bO2tt<Doq4z*owsY2i
z6(udX@*XmjL*KCPd1Xq|q7u8+dDNH3(k6u&ScLP-_T(ivf6s;~xd)CN;xX3X&|k`%
vSo^+fX4~f~s9FDLx*{ct&9Ux?u()vR-BoNG1?h0kOFI=&O{OlkbA<l_lJBhx

literal 0
HcmV?d00001

diff --git a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
index ea67e30c4ea..57840664ad5 100644
--- a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
+++ b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
@@ -29,5 +29,7 @@ overlays = [
     -e 's/@@UPSTREAM_VERSION_RELEASE@@/%{upstream_version_release}/g' \''', metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
     { description = "Rename the Azure Linux shim SBAT template", type = "file-rename", file = "sbat.redhat.csv.in", replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
     { description = "Use the renamed Azure Linux SBAT template as Source3", type = "spec-search-replace", regex = 'sbat\.redhat\.csv\.in', replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
+    { description = "Stage the Azure Linux Secure Boot CA as the shim vendor certificate", type = "file-add", file = "azurelinux-ca-20230216.der", source = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
+    { description = "Use the Azure Linux Secure Boot CA as shim Source1", type = "spec-search-replace", regex = 'fedora-ca-20200709\.cer', replacement = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
     { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" }
 ]
diff --git a/locks/shim-unsigned-aarch64.lock b/locks/shim-unsigned-aarch64.lock
index df90fb3fd93..9e1092a9fd3 100644
--- a/locks/shim-unsigned-aarch64.lock
+++ b/locks/shim-unsigned-aarch64.lock
@@ -3,5 +3,5 @@ version = 1
 import-commit = '67c1d520f9a8080f6b689714099f813f23154c8f'
 upstream-commit = '4db14e5ed7d3bdb7fda97f62c93e612435f2cce9'
 manual-bump = 1
-input-fingerprint = 'sha256:59dcfae752858153cc18634c47ba1c269600f174f2682b688af9e0427ae19f6e'
+input-fingerprint = 'sha256:552efc084bda2bf64c65b0f57a9cdffed6d3affc686c945676bef117a671ceef'
 resolution-input-hash = 'sha256:39a1f518415c394ca2aa046131b78bcd040da96a67ceab16974895aaf79e77bf'
diff --git a/locks/shim-unsigned-x64.lock b/locks/shim-unsigned-x64.lock
index 98617ef7b3d..22ed841a0f6 100644
--- a/locks/shim-unsigned-x64.lock
+++ b/locks/shim-unsigned-x64.lock
@@ -3,5 +3,5 @@ version = 1
 import-commit = 'bacb81905ea6806b97b968527e5ca9b2e3f0f7b4'
 upstream-commit = 'd355c62164bd48c6f47774fe04b0d730d892e006'
 manual-bump = 1
-input-fingerprint = 'sha256:6501f11d70b14f81664b5556f98326381d5f32ebabe3caf9a766353707d4247d'
+input-fingerprint = 'sha256:2c48d3925d4f4fd3b8fa23c9028c44ec2fa89acab8f6813fbd46fc623ffe5f7f'
 resolution-input-hash = 'sha256:6a1f2c11ed902ea756be8655161d7eadfb498d8b65a4633f896d278d663f7ed6'
diff --git a/specs/s/shim-unsigned-aarch64/azurelinux-ca-20230216.der b/specs/s/shim-unsigned-aarch64/azurelinux-ca-20230216.der
new file mode 100644
index 0000000000000000000000000000000000000000..7415958d7d4b4884656a3f9aef440404c18ef5e1
GIT binary patch
literal 1722
zcmb7^XH=6{7{}i?iy4Mtib4QUNQB%Z3ZjTWDjS6WiWq@F0!D?vOJZ<fHDYAStm08A
z;#Mdskx`Y=3WBA;0Z|cfA;W<qxEMm;wAK2p$1nF;_qqT3oO6E{NC}ldiYqF{Vqgr0
z#DpLS6IBqu-Js{~ebh%IKqRP9WS+8*L>MOGArMN}0BQtmFpfaN1P9Vh!5n3vPSW=i
zL?OaNVYG<M5+d<JgewvV<LFdiqpV{|7XQ`#xQHN*kC54cu4J}Qh&H&A8GykAriMgx
zWzg;Ej!Z|u2sI=!mjDKEWY8Il7c)aa#P?~_0qq}c>o1Byh&WNi=aJpGiTuCiSwbG4
z94Ls16U4=!*8ozC#kT{)cnB-SXhUdT9V5lSP~A1(b#J_Oog=Zg>(-iy*+^&JkU`~Q
zlUtO=vFA}<qOzAG+ie93gUwDF^X`NXo_XY{RcSTz!xP@qlR+eFNzwJGoZ-q;VfF%J
zxkdV9*F8o$w}Lz#HmUxa6zaY(!H=1-py*2KNy^W**SF+HEE`Mi>Ro;+A+)>M-$qbn
zUZ?6kKR(-~q>=Y#ry&1axxi!HMb?5KYD4Ffftn2dd6iW)!k{F@B|@R?{KwIT4=ax8
z1TTwON@Y~JEAHTF&woqKrRU71B)Cj?XZ2L9xaIont#9Y$I<e~79ZcWpI|@wGB$8h)
zoAqq<ukFhM&kU9IIeK((T`l%x+V701m>!MZr*Y5Yx@w(x&#sla#K@L5Nrk;R>(7jA
zoHJcN;Pk<lM29$E%HTks;L~vbt9N!6`<$u-d$F?q<4M{}FWsygg>p?994Go#{Y<*n
zvof~>AJz~w^FEK(E>ZCwY$iQB+hly%$XJzIxZlY+K%&J8No0;dHa8AUTUy=axf?$}
zHV{;_gKD^8xWiV#Z&`0yp7M6o=)vKbC-sFHgR@)v8XvNGTwZ=Vv0ulx{pv!BdG#lW
zMwq?+AFh3iN?Q}RId0+1iR?CLUDofznqWMR;qM*TN)e9iw>dKql@y3~>)4w4^loam
ztwUwwyTS4sU2GfAVwH^~zl^l?K7+xO=<);%7KY#xQaBb!VFA!WpVwS%7@oo5P<~`U
zhoD9!z&KdypbslE5SXjnp@lQR>4}3bg(t^Py~(Q4KEFxaP%BU0#R0}&8}u+ZO;dF!
z5E4U?5DRhz+R9Fn@@zc7q6U~L6P7q5V6a<nv|>iHdrI?a<J^_+k??r^@#dz}fUn$O
zh6@865Lz5kyhawZQ6!3AN~1|661&(hblOD;V`=f51;Y45S`@N{_7zJj2KW~f)I-r!
zt|*+SVJUqjpmt~jKnSYnka)Zb4CA5!4@7>60Y<jwe--(NDDitWMc*Qc{y`{`FceW@
zmwnQXd&8IHnT>T-FF-bJu1HR58kV(2%H=tq>O)r0HtQ@gu|L$@uE^h1(`B3zYsfli
z*q=Z4^zhz&s}#<U93&6CV!^`7X^z=#>ua2}5a`DT7M9fo=Tq||dUquk0ZUUojtEa=
z*6FrzSqAOn6tPpl@Z}!FKgei&n)Ue{@t|2vLa9$^$65d27Yo_D8THU>mui!-hnwCM
zY$-uzzuK9gd3VSxa|XOnkL-NiGS}fewzToGv0<agh$i1@;pi3+oNChBfORK}n+i7^
z@Le5zRDRPym3rkqzARAErqOn&Y-ac5psm`zdRj=*UU#iic^V^f?n~?3r)PI0Y9l{o
ze115D^Mdd7_yhI!6Ek{YO+MqtdG7guqC2m=(;_@t>-V;)l*#U1bE)jOZC2@&OpUtk
z(zYEcA{*>}m)hmlEw4iOTN~x6Dn1#q7I&Ji%v97-Jw4L%>MmS2Yfs;tTl247Ww?#{
z7lxlx>(*RnG^UR9W)>ak#Cmvr2q+8vIBs%8r)z?pbfK#Ch9bO2tt<Doq4z*owsY2i
z6(udX@*XmjL*KCPd1Xq|q7u8+dDNH3(k6u&ScLP-_T(ivf6s;~xd)CN;xX3X&|k`%
vSo^+fX4~f~s9FDLx*{ct&9Ux?u()vR-BoNG1?h0kOFI=&O{OlkbA<l_lJBhx

literal 0
HcmV?d00001

diff --git a/specs/s/shim-unsigned-aarch64/fedora-ca-20200709.cer b/specs/s/shim-unsigned-aarch64/fedora-ca-20200709.cer
deleted file mode 100644
index 29b3ce38991c3dda1bcd5526575baeb4f4d8994b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1119
zcmXqLVu?0rVs>7@%*4pVB%oxuo<*3)#bxv7^0)h>zPB0hvT<s)d9;1!Wn|=LWiV*$
zHRLwnWMd9xVH0Kw4K@@r5CL&Ggn4}vi;EMJGfIn7OG=6jg$x8h;_Skl&WX86MVTq-
zsW7!%!n{GLDGDBmB{~Y8dC7W)>ISMHwcNsTZmB8xMTrW*smY~9sR~Z{`6UX@jtWKw
zMg|7v29}0`2K*p}%)%ULV1>zv26E!OAW1`GLvv$8L$fGxUSo3uLqkggV?z@I^Qb}R
z-X=yR<RE2aWngY%<YzEwV&r0KVq|1keZ+C?>8gOvwA2rr_ij(r-u|#!&RgTCrs2}t
zq9HE#zn<8%jlW-Fg4U(dZ8CD<(uZ<-JEB89c_gRbaXWeR*sk6Ji}t&7&Q@x_EZNe2
z=0WautG?KXf58Q@rzS2A>eXMP#24GeSNc0}-<Kz+SGwviVv|mpKH=;&{)Nf=T75rP
zp5%OXBp~b2%O{_fvE7?kT^OQ0J^WOzkpXM9!R`E>CsXx!F0NSr?Va^3j%z6?QyOzW
ztt<I_fw?Kp>vR7})}yjB&pG#AoE?9@Pa^j9gKa``8TVf6a<xuN_YU)zHS3APyRQ$5
z%CoN*Ii0PaSIhOx^eexG|3!zdX^TyK;##dg+-O$n-O9ww$iTR`af?CYMgu=K4sA9@
zR#tXKMiwUn2Ln48-+-yjD5IpLpx8=ZACeLZit@8klS}mSi_-PWGqW@G-BJ@vfN7{$
zACi_pNy$JSn0REBStJa^8bmfV9AB5+;m7Z*#oMlOC~kdD>R~klK9B-_M#ldvEWq5*
z22O3V!XQ4Y0W**?kOe8=V-aJ)t{*k803()>A?uak^=X^y->=$XfA@IF$(ZLNUyEap
zY*E_&vFXx(Tkp^Xw+~sx+z?Y`(oZqlnaKXNb}z$)0|(a@dCX}#9yQ%PDDjU~*ZfHj
z1egEqG<fj6$m!;zYR5$J&CfF%D&(wpmj}H*=GU-si|)3xMF(0UAHLqdQBh0kVKG-p
z(hQG0mvarj9!00OTDB$TWjo3nh#m>@&AP5#&)d7EXUQwk1C@&(9<;QxD!9C7|Ha0s
z1=^*DYxX?)m{}Hh>g>scwmnC6RePNqRe0>SpDQm~%h7zpkpFR{?Ayzli7&1nn!EDu
rdH?7{R{8WjdG8JcTyAZ+mpOAug7E~0TE@3cK9fJ6mcJXnV9sFx{V<yg

diff --git a/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec b/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
index 0c03cbed0f2..95e39700d55 100644
--- a/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
+++ b/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
@@ -32,13 +32,13 @@
 
 Name:		shim-unsigned-aarch64
 Version:	16.1
-Release: 5%{?dist}
+Release: 6%{?dist}
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	aarch64
 License:	BSD-2-Clause AND OpenSSL
 URL:		https://github.com/rhboot/shim
 Source0:	https://github.com/rhboot/shim/releases/download/%{version}%{?dashpre}/shim-%{version}%{?dotpre}.tar.bz2
-Source1:	fedora-ca-20200709.cer
+Source1:	azurelinux-ca-20230216.der
 %if 0%{?dbxfile}
 Source2:	%{dbxfile}
 %endif
diff --git a/specs/s/shim-unsigned-x64/azurelinux-ca-20230216.der b/specs/s/shim-unsigned-x64/azurelinux-ca-20230216.der
new file mode 100644
index 0000000000000000000000000000000000000000..7415958d7d4b4884656a3f9aef440404c18ef5e1
GIT binary patch
literal 1722
zcmb7^XH=6{7{}i?iy4Mtib4QUNQB%Z3ZjTWDjS6WiWq@F0!D?vOJZ<fHDYAStm08A
z;#Mdskx`Y=3WBA;0Z|cfA;W<qxEMm;wAK2p$1nF;_qqT3oO6E{NC}ldiYqF{Vqgr0
z#DpLS6IBqu-Js{~ebh%IKqRP9WS+8*L>MOGArMN}0BQtmFpfaN1P9Vh!5n3vPSW=i
zL?OaNVYG<M5+d<JgewvV<LFdiqpV{|7XQ`#xQHN*kC54cu4J}Qh&H&A8GykAriMgx
zWzg;Ej!Z|u2sI=!mjDKEWY8Il7c)aa#P?~_0qq}c>o1Byh&WNi=aJpGiTuCiSwbG4
z94Ls16U4=!*8ozC#kT{)cnB-SXhUdT9V5lSP~A1(b#J_Oog=Zg>(-iy*+^&JkU`~Q
zlUtO=vFA}<qOzAG+ie93gUwDF^X`NXo_XY{RcSTz!xP@qlR+eFNzwJGoZ-q;VfF%J
zxkdV9*F8o$w}Lz#HmUxa6zaY(!H=1-py*2KNy^W**SF+HEE`Mi>Ro;+A+)>M-$qbn
zUZ?6kKR(-~q>=Y#ry&1axxi!HMb?5KYD4Ffftn2dd6iW)!k{F@B|@R?{KwIT4=ax8
z1TTwON@Y~JEAHTF&woqKrRU71B)Cj?XZ2L9xaIont#9Y$I<e~79ZcWpI|@wGB$8h)
zoAqq<ukFhM&kU9IIeK((T`l%x+V701m>!MZr*Y5Yx@w(x&#sla#K@L5Nrk;R>(7jA
zoHJcN;Pk<lM29$E%HTks;L~vbt9N!6`<$u-d$F?q<4M{}FWsygg>p?994Go#{Y<*n
zvof~>AJz~w^FEK(E>ZCwY$iQB+hly%$XJzIxZlY+K%&J8No0;dHa8AUTUy=axf?$}
zHV{;_gKD^8xWiV#Z&`0yp7M6o=)vKbC-sFHgR@)v8XvNGTwZ=Vv0ulx{pv!BdG#lW
zMwq?+AFh3iN?Q}RId0+1iR?CLUDofznqWMR;qM*TN)e9iw>dKql@y3~>)4w4^loam
ztwUwwyTS4sU2GfAVwH^~zl^l?K7+xO=<);%7KY#xQaBb!VFA!WpVwS%7@oo5P<~`U
zhoD9!z&KdypbslE5SXjnp@lQR>4}3bg(t^Py~(Q4KEFxaP%BU0#R0}&8}u+ZO;dF!
z5E4U?5DRhz+R9Fn@@zc7q6U~L6P7q5V6a<nv|>iHdrI?a<J^_+k??r^@#dz}fUn$O
zh6@865Lz5kyhawZQ6!3AN~1|661&(hblOD;V`=f51;Y45S`@N{_7zJj2KW~f)I-r!
zt|*+SVJUqjpmt~jKnSYnka)Zb4CA5!4@7>60Y<jwe--(NDDitWMc*Qc{y`{`FceW@
zmwnQXd&8IHnT>T-FF-bJu1HR58kV(2%H=tq>O)r0HtQ@gu|L$@uE^h1(`B3zYsfli
z*q=Z4^zhz&s}#<U93&6CV!^`7X^z=#>ua2}5a`DT7M9fo=Tq||dUquk0ZUUojtEa=
z*6FrzSqAOn6tPpl@Z}!FKgei&n)Ue{@t|2vLa9$^$65d27Yo_D8THU>mui!-hnwCM
zY$-uzzuK9gd3VSxa|XOnkL-NiGS}fewzToGv0<agh$i1@;pi3+oNChBfORK}n+i7^
z@Le5zRDRPym3rkqzARAErqOn&Y-ac5psm`zdRj=*UU#iic^V^f?n~?3r)PI0Y9l{o
ze115D^Mdd7_yhI!6Ek{YO+MqtdG7guqC2m=(;_@t>-V;)l*#U1bE)jOZC2@&OpUtk
z(zYEcA{*>}m)hmlEw4iOTN~x6Dn1#q7I&Ji%v97-Jw4L%>MmS2Yfs;tTl247Ww?#{
z7lxlx>(*RnG^UR9W)>ak#Cmvr2q+8vIBs%8r)z?pbfK#Ch9bO2tt<Doq4z*owsY2i
z6(udX@*XmjL*KCPd1Xq|q7u8+dDNH3(k6u&ScLP-_T(ivf6s;~xd)CN;xX3X&|k`%
vSo^+fX4~f~s9FDLx*{ct&9Ux?u()vR-BoNG1?h0kOFI=&O{OlkbA<l_lJBhx

literal 0
HcmV?d00001

diff --git a/specs/s/shim-unsigned-x64/fedora-ca-20200709.cer b/specs/s/shim-unsigned-x64/fedora-ca-20200709.cer
deleted file mode 100644
index 29b3ce38991c3dda1bcd5526575baeb4f4d8994b..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1119
zcmXqLVu?0rVs>7@%*4pVB%oxuo<*3)#bxv7^0)h>zPB0hvT<s)d9;1!Wn|=LWiV*$
zHRLwnWMd9xVH0Kw4K@@r5CL&Ggn4}vi;EMJGfIn7OG=6jg$x8h;_Skl&WX86MVTq-
zsW7!%!n{GLDGDBmB{~Y8dC7W)>ISMHwcNsTZmB8xMTrW*smY~9sR~Z{`6UX@jtWKw
zMg|7v29}0`2K*p}%)%ULV1>zv26E!OAW1`GLvv$8L$fGxUSo3uLqkggV?z@I^Qb}R
z-X=yR<RE2aWngY%<YzEwV&r0KVq|1keZ+C?>8gOvwA2rr_ij(r-u|#!&RgTCrs2}t
zq9HE#zn<8%jlW-Fg4U(dZ8CD<(uZ<-JEB89c_gRbaXWeR*sk6Ji}t&7&Q@x_EZNe2
z=0WautG?KXf58Q@rzS2A>eXMP#24GeSNc0}-<Kz+SGwviVv|mpKH=;&{)Nf=T75rP
zp5%OXBp~b2%O{_fvE7?kT^OQ0J^WOzkpXM9!R`E>CsXx!F0NSr?Va^3j%z6?QyOzW
ztt<I_fw?Kp>vR7})}yjB&pG#AoE?9@Pa^j9gKa``8TVf6a<xuN_YU)zHS3APyRQ$5
z%CoN*Ii0PaSIhOx^eexG|3!zdX^TyK;##dg+-O$n-O9ww$iTR`af?CYMgu=K4sA9@
zR#tXKMiwUn2Ln48-+-yjD5IpLpx8=ZACeLZit@8klS}mSi_-PWGqW@G-BJ@vfN7{$
zACi_pNy$JSn0REBStJa^8bmfV9AB5+;m7Z*#oMlOC~kdD>R~klK9B-_M#ldvEWq5*
z22O3V!XQ4Y0W**?kOe8=V-aJ)t{*k803()>A?uak^=X^y->=$XfA@IF$(ZLNUyEap
zY*E_&vFXx(Tkp^Xw+~sx+z?Y`(oZqlnaKXNb}z$)0|(a@dCX}#9yQ%PDDjU~*ZfHj
z1egEqG<fj6$m!;zYR5$J&CfF%D&(wpmj}H*=GU-si|)3xMF(0UAHLqdQBh0kVKG-p
z(hQG0mvarj9!00OTDB$TWjo3nh#m>@&AP5#&)d7EXUQwk1C@&(9<;QxD!9C7|Ha0s
z1=^*DYxX?)m{}Hh>g>scwmnC6RePNqRe0>SpDQm~%h7zpkpFR{?Ayzli7&1nn!EDu
rdH?7{R{8WjdG8JcTyAZ+mpOAug7E~0TE@3cK9fJ6mcJXnV9sFx{V<yg

diff --git a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
index 53b80d36124..834abb6ecda 100644
--- a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
+++ b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
@@ -34,13 +34,13 @@
 
 Name:		shim-unsigned-%{efiarch}
 Version:	16.1
-Release: 6%{?dist}
+Release: 7%{?dist}
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	x86_64
 License:	BSD-2-Clause AND OpenSSL
 URL:		https://github.com/rhboot/shim
 Source0:	https://github.com/rhboot/shim/releases/download/%{version}%{?dashpre}/shim-%{version}%{?dotpre}.tar.bz2
-Source1:	fedora-ca-20200709.cer
+Source1:	azurelinux-ca-20230216.der
 %if 0%{?dbxfile}
 Source2:	%{dbxfile}
 %endif

From 5c32d59b0f7db3b8f6e68ecd6d871177a296e899 Mon Sep 17 00:00:00 2001
From: Lynsey Rydberg <lyrydber@microsoft.com>
Date: Thu, 20 Aug 2026 19:22:56 +0000
Subject: [PATCH 5/5] feat(shim): add NX-compatible EFI binaries

---
 .../shim-unsigned-aarch64.comp.toml               |  4 +++-
 .../shim-unsigned-x64/shim-unsigned-x64.comp.toml |  4 +++-
 locks/shim-unsigned-aarch64.lock                  |  2 +-
 locks/shim-unsigned-x64.lock                      |  2 +-
 .../shim-unsigned-aarch64.spec                    | 15 ++++++++++++++-
 specs/s/shim-unsigned-x64/shim-unsigned-x64.spec  | 15 ++++++++++++++-
 6 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
index 321f4d439f9..0e70aa2c8cf 100644
--- a/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
+++ b/base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml
@@ -21,5 +21,7 @@ overlays = [
     { description = "Use the renamed Azure Linux SBAT template as Source3", type = "spec-search-replace", regex = 'sbat\.redhat\.csv\.in', replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
     { description = "Stage the Azure Linux Secure Boot CA as the shim vendor certificate", type = "file-add", file = "azurelinux-ca-20230216.der", source = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
     { description = "Use the Azure Linux Secure Boot CA as shim Source1", type = "spec-search-replace", regex = 'fedora-ca-20200709\.cer', replacement = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
-    { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" }
+    { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" },
+    { description = "Create NX-compatible EFI variants", type = "spec-append-lines", section = "%build", lines = ["cd build-%{efiarch}", "for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do", "    cp ${efi}.efi ${efi}.nx.efi", "    ./post-process-pe -n -x ${efi}.nx.efi", "done", "pesign -i shim%{efiarch}.nx.efi -P -h > shim%{efiarch}.nx.hash", "cd .."], metadata = { category = "azl-platform-adaptation", upstream-status = "inapplicable" } },
+    { description = "Install NX-compatible EFI variants", type = "spec-append-lines", section = "%install", lines = ["cd build-%{efiarch}", "for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do", "    install -m 0644 ${efi}.nx.efi ${RPM_BUILD_ROOT}/%{shimdir}/", "done", "install -m 0644 shim%{efiarch}.nx.hash ${RPM_BUILD_ROOT}/%{shimdir}/", "cd .."], metadata = { category = "azl-platform-adaptation", upstream-status = "inapplicable" } }
 ]
diff --git a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
index 57840664ad5..d22568bf4d8 100644
--- a/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
+++ b/base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml
@@ -31,5 +31,7 @@ overlays = [
     { description = "Use the renamed Azure Linux SBAT template as Source3", type = "spec-search-replace", regex = 'sbat\.redhat\.csv\.in', replacement = "sbat.azurelinux.csv.in", metadata = { category = "azl-branding-policy", upstream-status = "inapplicable" } },
     { description = "Stage the Azure Linux Secure Boot CA as the shim vendor certificate", type = "file-add", file = "azurelinux-ca-20230216.der", source = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
     { description = "Use the Azure Linux Secure Boot CA as shim Source1", type = "spec-search-replace", regex = 'fedora-ca-20200709\.cer', replacement = "azurelinux-ca-20230216.der", metadata = { category = "azl-security-compliance", upstream-status = "inapplicable" } },
-    { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" }
+    { description = "Use a fixed SBAT build date for deterministic shim binaries", type = "spec-search-replace", section = "%build", regex = '^MAKEFLAGS\+="ENABLE_SHIM_HASH=true "$', replacement = "MAKEFLAGS+=\"ENABLE_SHIM_HASH=true \"\nMAKEFLAGS+=\"SBAT_AUTOMATIC_DATE=2025021800 \"" },
+    { description = "Create NX-compatible EFI variants", type = "spec-append-lines", section = "%build", lines = ["cd build-%{efiarch}", "for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do", "    cp ${efi}.efi ${efi}.nx.efi", "    ./post-process-pe -n -x ${efi}.nx.efi", "done", "pesign -i shim%{efiarch}.nx.efi -P -h > shim%{efiarch}.nx.hash", "cd .."], metadata = { category = "azl-platform-adaptation", upstream-status = "inapplicable" } },
+    { description = "Install NX-compatible EFI variants", type = "spec-append-lines", section = "%install", lines = ["cd build-%{efiarch}", "for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do", "    install -m 0644 ${efi}.nx.efi ${RPM_BUILD_ROOT}/%{shimdir}/", "done", "install -m 0644 shim%{efiarch}.nx.hash ${RPM_BUILD_ROOT}/%{shimdir}/", "cd .."], metadata = { category = "azl-platform-adaptation", upstream-status = "inapplicable" } }
 ]
diff --git a/locks/shim-unsigned-aarch64.lock b/locks/shim-unsigned-aarch64.lock
index 9e1092a9fd3..74f8210091d 100644
--- a/locks/shim-unsigned-aarch64.lock
+++ b/locks/shim-unsigned-aarch64.lock
@@ -3,5 +3,5 @@ version = 1
 import-commit = '67c1d520f9a8080f6b689714099f813f23154c8f'
 upstream-commit = '4db14e5ed7d3bdb7fda97f62c93e612435f2cce9'
 manual-bump = 1
-input-fingerprint = 'sha256:552efc084bda2bf64c65b0f57a9cdffed6d3affc686c945676bef117a671ceef'
+input-fingerprint = 'sha256:5d9c61ed89025802952382f98ef4312d5b12ab3d8d2bbd2e09b8c7567a94d6ea'
 resolution-input-hash = 'sha256:39a1f518415c394ca2aa046131b78bcd040da96a67ceab16974895aaf79e77bf'
diff --git a/locks/shim-unsigned-x64.lock b/locks/shim-unsigned-x64.lock
index 22ed841a0f6..82369c62fad 100644
--- a/locks/shim-unsigned-x64.lock
+++ b/locks/shim-unsigned-x64.lock
@@ -3,5 +3,5 @@ version = 1
 import-commit = 'bacb81905ea6806b97b968527e5ca9b2e3f0f7b4'
 upstream-commit = 'd355c62164bd48c6f47774fe04b0d730d892e006'
 manual-bump = 1
-input-fingerprint = 'sha256:2c48d3925d4f4fd3b8fa23c9028c44ec2fa89acab8f6813fbd46fc623ffe5f7f'
+input-fingerprint = 'sha256:232328f781f65a1e6debb2592acc991dd328d931f8f0d817818f0f88be12271b'
 resolution-input-hash = 'sha256:6a1f2c11ed902ea756be8655161d7eadfb498d8b65a4633f896d278d663f7ed6'
diff --git a/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec b/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
index 95e39700d55..dfdb3795d0f 100644
--- a/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
+++ b/specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec
@@ -32,7 +32,7 @@
 
 Name:		shim-unsigned-aarch64
 Version:	16.1
-Release: 6%{?dist}
+Release: 7%{?dist}
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	aarch64
 License:	BSD-2-Clause AND OpenSSL
@@ -121,6 +121,13 @@ make ${MAKEFLAGS} \
 	all
 cd ..
 
+cd build-%{efiarch}
+for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do
+    cp ${efi}.efi ${efi}.nx.efi
+    ./post-process-pe -n -x ${efi}.nx.efi
+done
+pesign -i shim%{efiarch}.nx.efi -P -h > shim%{efiarch}.nx.hash
+cd ..
 %install
 COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
@@ -144,6 +151,12 @@ install -m 0644 BOOT*.CSV "${RPM_BUILD_ROOT}/%{shimdir}/"
 cd ..
 
 ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2
+cd build-%{efiarch}
+for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do
+    install -m 0644 ${efi}.nx.efi ${RPM_BUILD_ROOT}/%{shimdir}/
+done
+install -m 0644 shim%{efiarch}.nx.hash ${RPM_BUILD_ROOT}/%{shimdir}/
+cd ..
 %files
 %license COPYRIGHT
 %dir %{shimrootdir}
diff --git a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
index 834abb6ecda..b3352f251fc 100644
--- a/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
+++ b/specs/s/shim-unsigned-x64/shim-unsigned-x64.spec
@@ -34,7 +34,7 @@
 
 Name:		shim-unsigned-%{efiarch}
 Version:	16.1
-Release: 7%{?dist}
+Release: 8%{?dist}
 Summary:	First-stage UEFI bootloader
 ExclusiveArch:	x86_64
 License:	BSD-2-Clause AND OpenSSL
@@ -133,6 +133,13 @@ setarch linux32 -B make ${MAKEFLAGS} \
 cd ..
 
 %endif
+cd build-%{efiarch}
+for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do
+    cp ${efi}.efi ${efi}.nx.efi
+    ./post-process-pe -n -x ${efi}.nx.efi
+done
+pesign -i shim%{efiarch}.nx.efi -P -h > shim%{efiarch}.nx.hash
+cd ..
 %install
 COMMIT_ID=%{shim_commit_id}
 MAKEFLAGS="TOPDIR=.. -f ../Makefile COMMIT_ID=${COMMIT_ID} "
@@ -167,6 +174,12 @@ cd ..
 
 %endif
 ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2
+cd build-%{efiarch}
+for efi in shim%{efiarch} mm%{efiarch} fb%{efiarch}; do
+    install -m 0644 ${efi}.nx.efi ${RPM_BUILD_ROOT}/%{shimdir}/
+done
+install -m 0644 shim%{efiarch}.nx.hash ${RPM_BUILD_ROOT}/%{shimdir}/
+cd ..
 %files
 %license COPYRIGHT
 %dir %{shimrootdir}