feat(grub2): add AZL SBAT line, keep upstream provenance - #18243
Open
corvus-callidus wants to merge 1 commit into
Open
feat(grub2): add AZL SBAT line, keep upstream provenance#18243corvus-callidus wants to merge 1 commit into
corvus-callidus wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds Azure Linux SBAT metadata to GRUB EFI binaries while preserving Fedora provenance.
Changes:
- Adds the
grub.azurelinux,3SBAT entry. - Preserves Fedora’s version-release in
grub.rh. - Corrects the GNU GRUB URL.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
base/comps/grub2/grub2.comp.toml |
Adds SBAT overlays and interim provenance macro. |
specs/g/grub2/grub2.spec |
Renders provenance substitution and release bump. |
specs/g/grub2/sbat.csv.in |
Adds Azure Linux metadata and URL correction. |
locks/grub2.lock |
Refreshes the component fingerprint. |
Add Azure Linux's GRUB SBAT identity while retaining the imported Fedora provenance record. This supports Azure Linux-specific revocation without losing upstream lineage. The Fedora EVR remains temporarily pinned until azldev provides the upstream-EVR macros tracked by AB#21798.
corvus-callidus
force-pushed
the
lyrydber/grub2_sbat
branch
from
July 28, 2026 23:32
dfae30d to
cd5afb6
Compare
Contributor
Author
|
/azp run |
|
Azure Pipelines: 3 pipeline(s) were filtered out due to trigger conditions. |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 4 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
base/comps/grub2/grub2.comp.toml:71
- The new SBAT overlays are non-trivial but have no overlay metadata. Current component guidance requires
categoryandupstream-statusso temporary workarounds and their removal triggers remain discoverable (seebase/comps/qt5-qtmultimedia/qt5-qtmultimedia.comp.toml:9-11). Please add per-overlay metadata—or group overlays with shared provenance in an overlay file—including the linked azldev work for the temporary macro.
# SBAT: edit the upstream sbat.csv.in in place. Swap grub.rh to the
# @@UPSTREAM_VERSION_RELEASE@@ placeholder and append the grub.azurelinux vendor line.
# The placeholder is substituted at build time from an interim spec macro pinned to
# the Fedora grub2 NEVR; swap that macro for the azldev EVR macro when bug 21798 lands.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Azure Linux SBAT metadata to GRUB EFI binaries.
grub.azurelinux,3for the Azure Linux distributor identity. Generation 3 matches the existing Azure Linux 3.0 SBAT record.grub.rhwith its upstream EVR,2.12-40.fc43, rather than substituting the Azure Linux release.https//→https://).Implementation notes
The Fedora provenance EVR is temporarily defined in the component overlay. Azure Linux 4.0 does not yet include the azldev upstream-EVR macros from azure-linux-dev-tools#290. Replace the local macro once that work is available in 4.0.
Validation
.sbatsection fromgrubx64.efi: