From 57cd45b192769204259420807f48cb5d74dc7ed9 Mon Sep 17 00:00:00 2001 From: Jason Rodriguez Date: Tue, 23 Jun 2026 16:38:17 -0400 Subject: [PATCH 1/5] Add ciq-grub2 virtual Provides so shim can require CIQ grub2 The CIQ shim must not boot upstream RESF grub2 (it lacks the grub.ciq_rocky SBAT entry and is not signed by the key the shim trusts). A version pin is unsafe: a newer Rocky grub2 would satisfy the range but still be wrong. Add ciq-grub2 and ciq-grub2- Provides to the EFI variant package so the shim can Requires the token directly. Co-Authored-By: Claude Opus 4.8 (1M context) --- SOURCES/grub.macros | 2 ++ 1 file changed, 2 insertions(+) diff --git a/SOURCES/grub.macros b/SOURCES/grub.macros index 3fac42f..fad38c2 100644 --- a/SOURCES/grub.macros +++ b/SOURCES/grub.macros @@ -289,6 +289,8 @@ Provides: %{name}-efi = %{evr} \ # Add ciq-shim requirement, ONLY on ciq secureboot supported arches \ %ifarch x86_64 aarch64 \ Requires: ciq-shim >= 15.8 \ +Provides: ciq-grub2 = %{evr} \ +Provides: ciq-grub2-%{1} = %{evr} \ %endif \ %{?legacy_provides:Provides: %{name} = %{evr}} \ %{-o:Obsoletes: %{name}-efi < %{evr}} \ From dc265f1f053f5e401f7007d43370747b146f1ab9 Mon Sep 17 00:00:00 2001 From: Jason Rodriguez Date: Fri, 26 Jun 2026 16:44:48 -0400 Subject: [PATCH 2/5] el8 grub2: Epoch 1 -> 5 + Release .ciq.0.1.4 (per release leadership) Bump Release .0.1.3 -> .0.1.4 so the committed branch matches the deployed artifacts and the transfer/sign pipeline (which already reference .0.1.4). Co-Authored-By: Claude Opus 4.8 (1M context) --- SPECS/grub2.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/SPECS/grub2.spec b/SPECS/grub2.spec index af012e0..495c421 100644 --- a/SPECS/grub2.spec +++ b/SPECS/grub2.spec @@ -5,9 +5,9 @@ %global _configure_gnuconfig_hack 0 Name: grub2 -Epoch: 1 +Epoch: 5 Version: 2.02 -Release: 167%{?dist}.ciq.0.1.3 +Release: 167%{?dist}.ciq.0.1.4 Summary: Bootloader with support for Linux, Multiboot and more Group: System Environment/Base License: GPLv3+ @@ -543,6 +543,9 @@ fi %endif %changelog +* Fri Jun 26 2026 Jason Rodriguez - 2.02-167.ciq.0.1.4 +- Epoch 1 -> 5 so CIQ grub2 outranks Rocky's on a plain dnf upgrade (pairs with shim Epoch 5 + kernel Requires ciq-shim). + * Thu Apr 03 2026 Linux Engineering - 2.02-167.3 - Bump SBAT level grub,3 -> grub,5 to reflect CVE patches already present - Port patches 0678-0683 from grub2-rl8 (Rocky Linux 8): From e7d59adda2a67843c894fcd6c0ed208d162b97e9 Mon Sep 17 00:00:00 2001 From: Jason Rodriguez Date: Fri, 26 Jun 2026 18:47:00 -0400 Subject: [PATCH 3/5] el8 grub2: build grub2-pc-modules on x86_64 (with_legacy_modules 1) Same fix as el9: grub2-pc requires grub2-pc-modules of equal EVR, but x86_64 had with_legacy_modules 0, so the modules subpackage was never built -> grub2-pc is uninstallable / blocks dnf upgrade on any box with stock grub2-pc installed. Co-Authored-By: Claude Opus 4.8 (1M context) --- SOURCES/grub.macros | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/SOURCES/grub.macros b/SOURCES/grub.macros index fad38c2..ef7a35c 100644 --- a/SOURCES/grub.macros +++ b/SOURCES/grub.macros @@ -222,7 +222,11 @@ %ifarch x86_64 %global with_efi_common 1 -%global with_legacy_modules 0 +# Build grub2-pc-modules on x86_64 (upstream behavior). Without it, grub2-pc +# requires a sibling that is never built, so it is uninstallable and cannot be +# upgraded in lockstep with the rest of the stack (dnf "protected package" +# removal error on any box that already has the stock grub2-pc). +%global with_legacy_modules 1 %global with_legacy_common 0 %else %global with_efi_common 0 From b4104a38a204c3fb60fee934f59f36be139eba33 Mon Sep 17 00:00:00 2001 From: Jason Rodriguez Date: Tue, 30 Jun 2026 14:19:48 -0400 Subject: [PATCH 4/5] el8 grub2: add changelog entry for with_legacy_modules fix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Addresses josephtate review comment on PR #5 — the .0.1.4 changelog only mentioned the Epoch bump; add the grub2-pc-modules/with_legacy_modules bullet so the change is documented in the spec. Co-Authored-By: Claude Sonnet 4.6 --- SPECS/grub2.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/SPECS/grub2.spec b/SPECS/grub2.spec index 495c421..0f2b4d4 100644 --- a/SPECS/grub2.spec +++ b/SPECS/grub2.spec @@ -545,6 +545,9 @@ fi %changelog * Fri Jun 26 2026 Jason Rodriguez - 2.02-167.ciq.0.1.4 - Epoch 1 -> 5 so CIQ grub2 outranks Rocky's on a plain dnf upgrade (pairs with shim Epoch 5 + kernel Requires ciq-shim). +- Enable with_legacy_modules on x86_64 so grub2-pc-modules is built; without it + grub2-pc (which Requires grub2-pc-modules) is uninstallable and dnf upgrade + fails with "removing protected packages: grub2-pc" on stock-grub2-pc boxes. * Thu Apr 03 2026 Linux Engineering - 2.02-167.3 - Bump SBAT level grub,3 -> grub,5 to reflect CVE patches already present From 1509c26fcd902d53f6dceca3e21859a51a9c9f28 Mon Sep 17 00:00:00 2001 From: Jason Rodriguez Date: Fri, 31 Jul 2026 15:47:50 -0400 Subject: [PATCH 5/5] el8 grub2: Release bump to .ciq.0.1.5 -- .0.1.4 shipped without the fix .0.1.4's changelog entry claims the with_legacy_modules fix (grub2-pc-modules on x86_64), but that fix was edited into the spec in place under the same release number after .0.1.4 had already been published. Real repos and our own reference build both confirm grub2-pc-modules is missing from .0.1.4. Republishing under the same NVR isn't safe, so this is a release bump only -- no other changes; the with_legacy_modules fix itself was already correct. Co-Authored-By: Claude Sonnet 5 --- SPECS/grub2.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/SPECS/grub2.spec b/SPECS/grub2.spec index 0f2b4d4..dad5fb7 100644 --- a/SPECS/grub2.spec +++ b/SPECS/grub2.spec @@ -7,7 +7,7 @@ Name: grub2 Epoch: 5 Version: 2.02 -Release: 167%{?dist}.ciq.0.1.4 +Release: 167%{?dist}.ciq.0.1.5 Summary: Bootloader with support for Linux, Multiboot and more Group: System Environment/Base License: GPLv3+ @@ -543,6 +543,12 @@ fi %endif %changelog +* Fri Jul 31 2026 Jason Rodriguez - 2.02-167.ciq.0.1.5 +- Release bump only: .0.1.4 was already published without the with_legacy_modules + fix below despite the changelog entry claiming it (spec was edited in place + post-publish instead of getting a new release). Republishing under the same + NVR isn't safe, so this rebuild carries no other changes. + * Fri Jun 26 2026 Jason Rodriguez - 2.02-167.ciq.0.1.4 - Epoch 1 -> 5 so CIQ grub2 outranks Rocky's on a plain dnf upgrade (pairs with shim Epoch 5 + kernel Requires ciq-shim). - Enable with_legacy_modules on x86_64 so grub2-pc-modules is built; without it