[do not review] chore(shim): Update shim-unsigned-* to 16.1 by corvus-callidus · Pull Request #18474 · microsoft/azurelinux

Lynsey Rydberg (corvus-callidus) · 2026-08-17T20:14:13Z

No description provided.

Lynsey Rydberg (corvus-callidus) · 2026-08-17T20:15:01Z

/azp run

azure-pipelines · 2026-08-17T20:15:08Z

Azure Pipelines: 2 pipeline(s) were filtered out due to trigger conditions.

github-actions · 2026-08-17T20:16:14Z

Hello, and thank you for opening this pull request! 👋🏼 We appreciate the contribution.

We require pull request titles to follow the Conventional Commits specification and it looks like your proposed title needs to be adjusted.

Commits in this repo will typically be prefixed with fix:, feat:, docs:, chore:, refactor:, test:, or ci: to indicate the type of change being proposed. The linked specification has more details.

Details:

No release type found in pull request title "[do not review] chore(shim): Update shim-unsigned-* to 16.1". Add a prefix to indicate what kind of release this pull request corresponds to. For reference, see https://www.conventionalcommits.org/

Available types:
 - feat: A new feature
 - fix: A bug fix
 - docs: Documentation only changes
 - style: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc)
 - refactor: A code change that neither fixes a bug nor adds a feature
 - perf: A code change that improves performance
 - test: Adding missing tests or correcting existing tests
 - build: Changes that affect the build system or external dependencies (example scopes: gulp, broccoli, npm)
 - ci: Changes to our CI configuration files and scripts (example scopes: Travis, Circle, BrowserStack, SauceLabs)
 - chore: Other changes that don't modify src or test files
 - revert: Reverts a previous commit

Copilot

Pull request overview

Updates x64 and aarch64 unsigned shim packages from 15.8 to 16.1 and adds Azure Linux Secure Boot/SBAT customization.

Changes:

Pins updated Fedora shim sources and refreshes locks.
Adds Azure Linux certificate and SBAT records.
Removes unsupported IA32 output from x64.

Reviewed changes

Copilot reviewed 10 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml`	Defines x64 pin and overlays.
`base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml`	Defines aarch64 pin and overlays.
`locks/shim-unsigned-x64.lock`	Locks updated x64 source.
`locks/shim-unsigned-aarch64.lock`	Locks updated aarch64 source.
`specs/s/shim-unsigned-x64/sources`	Records 16.1 source checksum.
`specs/s/shim-unsigned-x64/shim-unsigned-x64.spec`	Renders x64 package changes.
`specs/s/shim-unsigned-x64/sbat.redhat.csv`	Removes obsolete static SBAT data.
`specs/s/shim-unsigned-x64/sbat.azurelinux.csv.in`	Adds templated x64 SBAT data.
`specs/s/shim-unsigned-aarch64/sources`	Records 16.1 source checksum.
`specs/s/shim-unsigned-aarch64/shim-unsigned-aarch64.spec`	Renders aarch64 package changes.
`specs/s/shim-unsigned-aarch64/sbat.redhat.csv`	Removes obsolete static SBAT data.
`specs/s/shim-unsigned-aarch64/sbat.azurelinux.csv.in`	Adds templated aarch64 SBAT data.

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Lynsey Rydberg (corvus-callidus) · 2026-08-17T21:25:05Z

 [components.shim-unsigned-x64]
-spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "bacb81905ea6806b97b968527e5ca9b2e3f0f7b4" }
+# Pin shim 16.1 to Fedora dist-git commit d355c62164bd48c6f47774fe04b0d730d892e006.
+spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "d355c62164bd48c6f47774fe04b0d730d892e006" }


This is intentional. We'll update the shim package once we have properly signed 16.1 binaries.

Lynsey Rydberg (corvus-callidus) · 2026-08-17T21:25:39Z

 [components.shim-unsigned-aarch64]
-spec = { type = "upstream", upstream-distro = { name = "fedora", version = "43" }, upstream-commit = "67c1d520f9a8080f6b689714099f813f23154c8f" }
+# Pin shim 16.1 to Fedora dist-git commit 4db14e5ed7d3bdb7fda97f62c93e612435f2cce9.
+spec = { type = "upstream", upstream-distro = { name = "fedora", version = "44" }, upstream-commit = "4db14e5ed7d3bdb7fda97f62c93e612435f2cce9" }


This is intentional. We'll update the shim package once we have signed 16.1 binaries.

Copilot

Pull request overview

Copilot reviewed 10 out of 18 changed files in this pull request and generated 4 comments.

    # Workaround: add dist tag to the release to avoid NEVR conflicts
    # while we are still rebuilding all packages in new tags nightly.
-    { type = "spec-update-tag", tag = "Release", value = "2%{?dist}" },
+    { type = "spec-update-tag", tag = "Release", value = "1%{?dist}" },


    # Workaround: add dist tag to the release to avoid NEVR conflicts
    # while we are still rebuilding all packages in new tags nightly.
-    { type = "spec-update-tag", tag = "Release", value = "2%{?dist}" },
+    { type = "spec-update-tag", tag = "Release", value = "1%{?dist}" },


Replace the Fedora Secure Boot CA with the Azure Linux CA in both unsigned shim packages.

Copilot

Pull request overview

Copilot reviewed 10 out of 18 changed files in this pull request and generated 2 comments.

Suppressed comments (2)

base/comps/shim-unsigned-x64/shim-unsigned-x64.comp.toml:8

This modified overlay still omits the required description field. Add a concise description of the nightly-rebuild release workaround, then refresh the component lock because descriptions are part of the component input.

    { type = "spec-update-tag", tag = "Release", value = "1%{?dist}" },

base/comps/shim-unsigned-aarch64/shim-unsigned-aarch64.comp.toml:8

This modified overlay still omits the required description field. Add a concise description of the nightly-rebuild release workaround, then refresh the component lock because descriptions are part of the component input.

    { type = "spec-update-tag", tag = "Release", value = "1%{?dist}" },

    # Workaround: create a compat symlink that does not include the dist tag.
-    { type = "spec-append-lines", section = "%install", lines = ["ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] },
-    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] }
+    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] },


    { type = "spec-append-lines", section = "%install", lines = ["ln -s %{version}-%{release} %{buildroot}%{_datadir}/shim/%{version}-2"] },
-    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] }
+    { type = "spec-append-lines", section = "%files", lines = ["%{_datadir}/shim/%{version}-2"] },


Copilot AI balanced review requested due to automatic review settings August 17, 2026 20:14

Lynsey Rydberg (corvus-callidus) requested a review from a team as a code owner August 17, 2026 20:14

Lynsey Rydberg (corvus-callidus) marked this pull request as draft August 17, 2026 20:14

Copilot started reviewing on behalf of Lynsey Rydberg (corvus-callidus) August 17, 2026 20:16 View session

Copilot AI reviewed Aug 17, 2026

View reviewed changes

Lynsey Rydberg (corvus-callidus) added 2 commits August 20, 2026 15:37

fix(shim): omit unsupported ia32 package

693935c

chore(shim): update unsigned packages to 16.1

5cb3961

Copilot AI review requested due to automatic review settings August 21, 2026 18:08

Lynsey Rydberg (corvus-callidus) force-pushed the lyrydber/shim_16.1_sbat branch from d41a56c to 5c32d59 Compare August 21, 2026 18:08

Copilot started reviewing on behalf of Lynsey Rydberg (corvus-callidus) August 21, 2026 18:10 View session

Copilot AI reviewed Aug 21, 2026

View reviewed changes

Lynsey Rydberg (corvus-callidus) added 3 commits August 21, 2026 19:12

feat(shim): add Azure Linux SBAT provenance

511986b

feat(shim): embed Azure Linux vendor certificate

ce36ca9

Replace the Fedora Secure Boot CA with the Azure Linux CA in both unsigned shim packages.

feat(shim): add NX-compatible EFI binaries

69ef86d

Copilot AI review requested due to automatic review settings August 21, 2026 19:26

Lynsey Rydberg (corvus-callidus) force-pushed the lyrydber/shim_16.1_sbat branch from 5c32d59 to 69ef86d Compare August 21, 2026 19:26

Copilot started reviewing on behalf of Lynsey Rydberg (corvus-callidus) August 21, 2026 19:27 View session

Copilot AI reviewed Aug 21, 2026

View reviewed changes

Navigation Menu

Uh oh!

[do not review] chore(shim): Update shim-unsigned-* to 16.1 - #18474

[do not review] chore(shim): Update shim-unsigned-* to 16.1#18474
Lynsey Rydberg (corvus-callidus) wants to merge 5 commits into
4.0from
lyrydber/shim_16.1_sbat

Lynsey Rydberg (corvus-callidus) commented Aug 17, 2026

Uh oh!

Lynsey Rydberg (corvus-callidus) commented Aug 17, 2026

Uh oh!

azure-pipelines Bot commented Aug 17, 2026

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Lynsey Rydberg (corvus-callidus) Aug 17, 2026

Uh oh!

Lynsey Rydberg (corvus-callidus) Aug 17, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Lynsey Rydberg (corvus-callidus) commented Aug 17, 2026

Uh oh!

Lynsey Rydberg (corvus-callidus) commented Aug 17, 2026

Uh oh!

azure-pipelines Bot commented Aug 17, 2026

Uh oh!

github-actions Bot commented Aug 17, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Lynsey Rydberg (corvus-callidus) Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

Lynsey Rydberg (corvus-callidus) Aug 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants