flatcar · tormath1 · Jul 9, 2026
@@ -1,7 +1,7 @@
 # Bump the flatcar version stated here every time we or Red Hat change patches
 # that modify parts of GRUB that are installed to the boot partition. Reset the
 # version back to 1 when the upstream GRUB version changes.
-FLATCAR_VERSION=flatcar4
+FLATCAR_VERSION=flatcar3
 
 # Gentoo's patches conflict with Red Hat's patches, and none of Gentoo's patches
 # affect Flatcar, so skip them all.
@@ -43,7 +43,7 @@ cros_post_src_install_sbat() {
 	insinto /usr/share/grub
 	newins - sbat.csv <<-EOF
 		sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
-		grub,5,Free Software Foundation,grub,${PV},https://www.gnu.org/software/grub/
+		grub,4,Free Software Foundation,grub,${PV},https://www.gnu.org/software/grub/
 		grub.flatcar,1,Flatcar,grub2,${PV}-${FLATCAR_VERSION},https://github.com/flatcar/Flatcar
 	EOF
 }

@@ -0,0 +1,112 @@
+From 442b676110c35caedb57408c4a27a6ef74f4c7db Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Thu, 24 Oct 2024 14:42:46 +0100
+Subject: [PATCH 1/2] script/execute: Don't let trailing blank lines determine
+ the return code
+
+grub_script_execute_sourcecode() parses and executes code one line at a
+time, updating the return code each time because only the last line
+determines the final status. However, trailing new lines were also
+executed, masking any failure on the previous line. Fix this by only
+trying to execute the command when there is actually one present.
+
+This has presumably never been noticed because this code is not used by
+regular functions, only in special cases like eval and menu entries. The
+latter generally don't return at all, having booted an OS. When failing
+to boot, upstream GRUB triggers the fallback mechanism regardless of the
+return code.
+
+We noticed the problem while using Red Hat's patches, which change this
+behaviour to take account of the return code. In that case, a failure
+takes you back to the menu rather than triggering a fallback.
+
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+---
+ grub-core/script/execute.c |  5 ++++-
+ tests/grub_script_eval.in  | 10 +++++++++-
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/script/execute.c b/grub-core/script/execute.c
+index c19b4bf70..e369e8318 100644
+--- a/grub-core/script/execute.c
++++ b/grub-core/script/execute.c
+@@ -935,7 +935,10 @@ grub_script_execute_sourcecode (const char *source)
+ 	  break;
+ 	}
+
+-      ret = grub_script_execute (parsed_script);
++      /* Don't let trailing blank lines determine the return code.  */
++      if (parsed_script->cmd)
++	ret = grub_script_execute (parsed_script);
++
+       grub_script_free (parsed_script);
+       grub_free (line);
+     }
+diff --git a/tests/grub_script_eval.in b/tests/grub_script_eval.in
+index c97b78d77..9c6211042 100644
+--- a/tests/grub_script_eval.in
++++ b/tests/grub_script_eval.in
+@@ -3,4 +3,12 @@
+ eval echo "Hello world"
+ valname=tst
+ eval $valname=hi
+-echo $tst
+\ No newline at end of file
++echo $tst
++
++if eval "
++false
++"; then
++  echo should have failed
++else
++  echo failed as expected
++fi
+-- 
+2.46.1
+
+
+From 93eedb6cebe758db09066e084ddd2fb659ebc4fb Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Thu, 24 Oct 2024 15:00:26 +0100
+Subject: [PATCH 2/2] normal/menu: Check return code of the script when
+ executing a menu entry
+
+Don't rely on grub_errno here because grub_script_execute_new_scope()
+calls grub_print_error(), which always resets grub_errno back to
+GRUB_ERR_NONE. It may also get reset by grub_wait_after_message().
+
+This problem was observed when a "bad signature" error resulted in the
+menu being redisplayed rather than the fallback mechanism being
+triggered, although another change was also needed to fix it. This only
+happens with Red Hat's patches because upstream GRUB triggers the
+fallback mechanism regardless of the return code.
+
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+---
+ grub-core/normal/menu.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/grub-core/normal/menu.c b/grub-core/normal/menu.c
+index cda10fa8b..fd9b8c6d8 100644
+--- a/grub-core/normal/menu.c
++++ b/grub-core/normal/menu.c
+@@ -376,14 +376,14 @@ grub_menu_execute_entry(grub_menu_entry_t entry, int auto_boot)
+   if (ptr && ptr[0] && ptr[1])
+     grub_env_set ("default", ptr + 1);
+
+-  grub_script_execute_new_scope (entry->sourcecode, entry->argc, entry->args);
++  err = grub_script_execute_new_scope (entry->sourcecode, entry->argc, entry->args);
+
+   if (errs_before != grub_err_printed_errors)
+     grub_wait_after_message ();
+
+   errs_before = grub_err_printed_errors;
+
+-  if (grub_errno == GRUB_ERR_NONE && grub_loader_is_loaded ())
++  if (err == GRUB_ERR_NONE && grub_loader_is_loaded ())
+     /* Implicit execution of boot, only if something is loaded.  */
+     err = grub_command_execute ("boot", 0, 0);
+
+-- 
+2.46.1
+
@@ -7,9 +7,6 @@
 # Gentoo upstream package stabilisation
 # (the following packages are "unstable" upstream; we're stabilising these)
 
-# Chewi maintains edk2 in Gentoo, and we generally want the latest.
-sys-firmware/edk2-bin
-
 # We always want the latest version available.
 =app-containers/containerd-2.2* ~amd64 ~arm64
 

@@ -11,13 +11,27 @@ dev-lang/rust rustfmt
 app-crypt/gnupg smartcard usb
 
 # for qemu
-app-emulation/qemu -doc -jpeg -pin-upstream-blobs ncurses python static-user virtfs qemu_softmmu_targets_aarch64 qemu_softmmu_targets_x86_64 qemu_user_targets_aarch64 qemu_user_targets_x86_64
+app-arch/bzip2 static-libs
+app-emulation/qemu -doc -jpeg ncurses python static-user virtfs qemu_softmmu_targets_aarch64 qemu_softmmu_targets_x86_64 qemu_user_targets_aarch64 qemu_user_targets_x86_64
 dev-libs/glib static-libs
+dev-libs/libaio static-libs
 dev-libs/libpcre2 static-libs
+dev-libs/openssl static-libs
+media-libs/libjpeg-turbo static-libs
+media-libs/libpng static-libs
+net-misc/curl static-libs
 sys-apps/attr static-libs
-sys-firmware/edk2-bin qemu_softmmu_targets_aarch64 qemu_softmmu_targets_x86_64
+sys-apps/dtc static-libs
+sys-libs/libcap-ng static-libs
+sys-libs/libseccomp static-libs
+sys-libs/ncurses static-libs
 sys-libs/zlib static-libs
+virtual/jpeg static-libs
 virtual/zlib static-libs
+x11-libs/pixman static-libs
+
+# Get latest EDK2 firmware for Secure Boot on arm64.
+app-emulation/qemu -pin-upstream-blobs
 
 # Needed for signed sysexts using systemd-repart
 sys-apps/systemd cryptsetup
@@ -1,2 +1,2 @@
-DIST shimaa64-16.1.efi.signed 996872 BLAKE2B 789b04be855cd055bd2e885e5e1207140426622742cd30b6f978a96be85c6c5569f79a59dd9fb000699980b2ea01ecbb9e00085a19303805ebfdbf0ba2dcff62 SHA512 b866da33fde3e35873d212b65a6cecabe3616b2170ac6396ffbe7b4da0a6221d07a3c4a2b7a87df6109c6e4032374537022f7289df9204c284b8ac7c71064d5f
-DIST shimx64-16.1.efi.signed 950088 BLAKE2B 1fe6482af52b4f009f3c9086c4425d0b47fc20334dc8c60f6f55394df9112db7c9d3341c2d26837f296b220756235b5f7ac5465d5751beace08b711c5b629760 SHA512 56152e85ab864979f348a19f2ceef8b39dc4447aa2807e9484a106f0683551ff6014f00bb0bc8c123b3571a696bea41f1525e175e172f554a53bd495151043d6
+DIST shimaa64-15.8-r1.efi.signed 996824 BLAKE2B 2ba906ddb168ec689398e6561d9b01fa2a37d1e7dcb80b86b8d86d46bae5e1600e77bb849ae9678f365051c7ee055d82ec604e3ec2b4433056a2a2f0e50255aa SHA512 7544db5e35d25073331f408fa1e71f6fed1bd27916468f918b48bbb8ac371086d05b4ec6b036be95a30101d0f047f6d7b431e8be401361286ae4a9780966a4cc
+DIST shimx64-15.8-r1.efi.signed 950040 BLAKE2B 90f8acd66b2e80e7b0696ba02522ab520cdec8bd8fc9f2996f26dc456786240b78e7dcf2807bc91530db4ec3425c5eb1355d20dd261ed189eb75ae3867b9a093 SHA512 9eb1468746abdfc62cdcb12b782c9aa775ae9c2c813781e96b44a02847d75eab0f9795a0e0b9ac05969a7712d4e1501102b4d32e9b005c9b8a2e70ab8eff911e
@@ -1 +1 @@
-DIST shim-16.1.tar.bz2 2348998 BLAKE2B f2aef8d1e8cbd65c911133807747b1f654ebbde465db8ed21d39825af4ec898e937bf35e2e77f59a76cdcdaa45873bc0f9dfbfa33f6acbbc6db8e5f689847841 SHA512 ca5f80e82f3b80b622028f03ef23105c98ee1b6a25f52a59c823080a3202dd4b9962266489296e99f955eb92e36ce13e0b1d57f688350006bba45f2718f159fb
+DIST shim-15.8.tar.bz2 2315201 BLAKE2B 24da29cf45a08bceffc15682fcdd16e34e42d3b33f2a0b2e528193d8e3455a034b6242c13cebf43db481f73a83329effd9812f0d1e04861ecf7329e54f9059b9 SHA512 30b3390ae935121ea6fe728d8f59d37ded7b918ad81bea06e213464298b4bdabbca881b30817965bd397facc596db1ad0b8462a84c87896ce6c1204b19371cd1
@@ -0,0 +1,73 @@
+# Copyright 2015 CoreOS, Inc.
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=7
+inherit multilib
+
+DESCRIPTION="UEFI Shim loader"
+HOMEPAGE="https://github.com/rhboot/shim"
+SRC_URI="https://github.com/rhboot/shim/releases/download/${PV}/shim-${PV}.tar.bz2"
+KEYWORDS="amd64 arm64"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="official"
+
+RDEPEND=""
+# TODO: Would be ideal to depend on sys-boot/gnu-efi package, but
+# currently the shim insists on using the bundled copy. This will need
+# to be addressed by patching this check out after making sure that
+# our copy of gnu-efi is as usable as the bundled one.
+DEPEND="
+  dev-libs/openssl
+  coreos-base/coreos-sb-keys
+"
+
+PATCHES=(
+	"${FILESDIR}/0001-Fix-parallel-build-of-gnu-efi.patch"
+	"${FILESDIR}/0002-Fix-build-with-binutils-2-46.patch"
+)
+
+src_compile() {
+  local emake_args=(
+    CROSS_COMPILE="${CHOST}-"
+  )
+
+  sed -e "s/@@VERSION@@/${PVR}/" "${FILESDIR}"/sbat.csv.in >"${WORKDIR}/sbat.csv" || die
+
+  # Apparently our environment already has the ARCH variable in
+  # it, and Makefile picks it up instead of figuring it out
+  # itself with the compiler -dumpmachine flag. But also it
+  # expects a different format of the values. It wants x86_64
+  # instead of amd64, and aarch64 instead of arm64.
+  if use amd64; then
+    emake_args+=( ARCH=x86_64 )
+  elif use arm64; then
+    emake_args+=( ARCH=aarch64 )
+  fi
+  emake_args+=( ENABLE_SBSIGN=1 )
+  emake_args+=( SBATPATH="${WORKDIR}/sbat.csv" )
+
+  if use official; then
+    if [ -z "${SHIM_SIGNING_CERTIFICATE}" ]; then
+      die "use production flag needs env SHIM_SIGNING_CERTIFICATE"
+    fi
+    emake_args+=( VENDOR_CERT_FILE="${SHIM_SIGNING_CERTIFICATE}" )
+  else
+    emake_args+=( VENDOR_CERT_FILE="${SHIM_SIGNING_CERTIFICATE:-/usr/share/sb_keys/shim.der}" )
+  fi
+  emake "${emake_args[@]}" || die
+}
+
+src_install() {
+  local suffix
+  suffix=''
+  if use amd64; then
+    suffix=x64
+  elif use arm64; then
+    suffix=aa64
+  fi
+  insinto /usr/lib/shim
+  newins "shim${suffix}.efi" "shim${suffix}.efi"
+  newins "mm${suffix}.efi" "mm${suffix}.efi"
+}
@@ -7,8 +7,4 @@ DIST edk2-202511-1-qemu-aarch64.xpak 4052801 BLAKE2B 79fb12322613286fc0733da774e
 DIST edk2-202511-1-qemu-loongarch64.xpak 1994972 BLAKE2B 98ef04fa0042f82458b48e5edee4ee271196bdc73ab3e7c0c97397c2a989240881fa1d0d3ed5e24f35731a37be43c1f140914965fb04b2f03aabd00e0615782d SHA512 deac522183b2c2a4ca54dacad087a753866b66cef148b481f77c9a4d163fd972ab043340880d66be523b99ba40e7e7bb0efaf4282cc6cbd41e6f0bdff05fe485
 DIST edk2-202511-1-qemu-riscv64.xpak 1847391 BLAKE2B ef1070607e4e937a211c39e558e7012a02387f29d876680b9b05aaeffb8d7dda9c56a20d05d607319def68e1677a2c8985fb498a2c55bb607251a4fbe6c3d5eb SHA512 e9bdc4141dc0ded6b7620eadfda89fc7009823e7762759cd925cfc6d178a50638aa09f088b7d195b1bf18b70d8e920ee00d4ed35a65fa39b6061729ebd828c66
 DIST edk2-202511-1-qemu-x86_64.xpak 8985483 BLAKE2B 752351a7ccdb7e16274e94bd1d43d605c31b6babe0dbe4af189aeedbb70a0d943c7be8c4b9b1808cf4229603ca2ffeb4e90d6419000fb3691af7fa73e9792881 SHA512 aca265ad79cb0a835e7dc2bbf3fdcdfce43d2f03a5fd9663f0d3b719620ae4adc4f16453759c547adf508d7a549463875788a0913e0fae8b7e630915ad7c33b5
-DIST edk2-202605-1-qemu-aarch64.xpak 4073020 BLAKE2B 00756e94cb7bae3a964f05aa9ef0d28662aecd262abd6e424870f19aa02869e5b7a10883f2325d5b717af7d31b6bf93c2236aab4f04816061a5d096e062044b2 SHA512 237b11036753eaa5529c61ef9c093ca1f394352c67e8695a29ed876a75f903f21583aa3f3f2c088afe84562f0a16d9b19b80206338449af194a25d2258ff62fa
-DIST edk2-202605-1-qemu-loongarch64.xpak 2141697 BLAKE2B 41a28e42a82ee5b40dd9baf196bd7dfe88b016a6a918e88fc685d52480307ebedbbf4fb45b37221165bcccaa35375b49cbc18c99ebfc420f7430837b6eaa7780 SHA512 18f46175aaff2d4b1ee4de133c05180b4e888e0a7d841d88fdbf6e52f2a195371b63c6c6c7868c0c4ab5406feaae40beb460701432f37bf6efa0f7b706851f82
-DIST edk2-202605-1-qemu-riscv64.xpak 1864003 BLAKE2B 458876ccc9efb0259b2f9aced9eeb8aace5a3cd76dac45d724060a06a949d73bde84fd216ebee4345fe6e39edbec96e51e4ac3c37c955ba2725c1991bb17f2a4 SHA512 c665001d0d7e8ec5ac8fb0018905322f74ca192fcbda8d1223e206dd1e01d7e1f78399afba22db37dd46fe8f4798d13deb467d97388d8f969bfa7d24626ac165
-DIST edk2-202605-1-qemu-x86_64.xpak 9018459 BLAKE2B f79e65496247c5b1b2506440b0773800d13392edb8cf1a940a49b39a577eb90cea41f84d6dbb4a70bf240633a87326699c4a9620cd597f450646477cc8983f25 SHA512 19e1d1cbfd66830787c77a3c434907348fcb070c0f423e4d53817f3b18d958e009d7d249b916fe615ecbaef650c3cdc59269168e727deb4025ef32c38489d277
 DIST edk2-ovmf-202202-1.xpak 2672386 BLAKE2B 75c15d4379610ab2af85b78166e350d52f4f1bc1fff5b2eb693ad0d7b1f6648e65d8ae3e2c5467f93f1557ad3b4fa664ab2d76ff10794667de22c2ea8cca6b2d SHA512 06783b89c96bada0fd025ff39eaee501a027abcb03c0bdcf3ff497d52be22927ab03013d90f145ee94a8662cfffe4f8c154dcd06db1bb1acef8a85ae43de14a3
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		DIST shim-16.1.tar.bz2 2348998 BLAKE2B f2aef8d1e8cbd65c911133807747b1f654ebbde465db8ed21d39825af4ec898e937bf35e2e77f59a76cdcdaa45873bc0f9dfbfa33f6acbbc6db8e5f689847841 SHA512 ca5f80e82f3b80b622028f03ef23105c98ee1b6a25f52a59c823080a3202dd4b9962266489296e99f955eb92e36ce13e0b1d57f688350006bba45f2718f159fb
		DIST shim-15.8.tar.bz2 2315201 BLAKE2B 24da29cf45a08bceffc15682fcdd16e34e42d3b33f2a0b2e528193d8e3455a034b6242c13cebf43db481f73a83329effd9812f0d1e04861ecf7329e54f9059b9 SHA512 30b3390ae935121ea6fe728d8f59d37ded7b918ad81bea06e213464298b4bdabbca881b30817965bd397facc596db1ad0b8462a84c87896ce6c1204b19371cd1