Bump edk2 to 202605, shim to 16.1, and refresh GRUB 2.12 against Fedora

changelog/updates/2026-06-23-boot-updates.md

@@ -0,0 +1,3 @@
+- grub (2.12-flatcar4, rebased against Fedora 45)
+- shim ([16.1](https://github.com/rhboot/shim/releases/tag/16.1) (includes [16.0](https://github.com/rhboot/shim/releases/tag/16.0)))
+- SDK: edk2-bin ([202605](https://github.com/tianocore/edk2/releases/tag/edk2-stable202605) (includes [202602](https://github.com/tianocore/edk2/releases/tag/edk2-stable202602), [202511](https://github.com/tianocore/edk2/releases/tag/edk2-stable202511), [202508](https://github.com/tianocore/edk2/releases/tag/edk2-stable202508), [202505](https://github.com/tianocore/edk2/releases/tag/edk2-stable202505), [202502](https://github.com/tianocore/edk2/releases/tag/edk2-stable202502), [202411](https://github.com/tianocore/edk2/releases/tag/edk2-stable202411)))

sdk_container/src/third_party/coreos-overlay/coreos/config/env/sys-boot/grub

@@ -1,7 +1,7 @@
 # Bump the flatcar version stated here every time we or Red Hat change patches
 # that modify parts of GRUB that are installed to the boot partition. Reset the
 # version back to 1 when the upstream GRUB version changes.
-FLATCAR_VERSION=flatcar3
+FLATCAR_VERSION=flatcar4
 
 # Gentoo's patches conflict with Red Hat's patches, and none of Gentoo's patches
 # affect Flatcar, so skip them all.
@@ -43,7 +43,7 @@ cros_post_src_install_sbat() {
 	insinto /usr/share/grub
 	newins - sbat.csv <<-EOF
 		sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
-		grub,4,Free Software Foundation,grub,${PV},https://www.gnu.org/software/grub/
+		grub,5,Free Software Foundation,grub,${PV},https://www.gnu.org/software/grub/
 		grub.flatcar,1,Flatcar,grub2,${PV}-${FLATCAR_VERSION},https://github.com/flatcar/Flatcar
 	EOF
 }

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/sys-boot/grub/grub-2.12-verifier-null-file.patch

@@ -0,0 +1,36 @@
+https://src.fedoraproject.org/rpms/grub2/pull-request/238
+
+From db7782da011a39b06fe80282f608390ed76dae1c Mon Sep 17 00:00:00 2001
+From: James Le Cuirot <jlecuirot@microsoft.com>
+Date: Fri, 26 Jun 2026 14:08:05 +0100
+Subject: [PATCH] verifiers: Fix NULL pointer dereference when verification
+ fails on x64
+
+verified_free() references verified->file->size, so verified->file must
+be set before calling this function.
+
+This was noticed after building EDK2 with --pcd
+PcdNullPointerDetectionPropertyMask=0x03.
+
+Signed-off-by: James Le Cuirot <jlecuirot@microsoft.com>
+--- a/grub-core/kern/verifiers.c
++++ b/grub-core/kern/verifiers.c
+@@ -155,6 +155,7 @@ grub_verifiers_open (grub_file_t io, enum grub_file_type type)
+     {
+       goto fail;
+     }
++  verified->file = io;
+ #if defined (GRUB_MACHINE_EFI) && defined (__x86_64__)
+   verified->buf = grub_efi_allocate_any_pages (GRUB_EFI_BYTES_TO_PAGES (ret->size));
+ #else
+@@ -205,7 +206,6 @@ grub_verifiers_open (grub_file_t io, enum grub_file_type type)
+ 	ver->close (context);
+     }
+
+-  verified->file = io;
+   ret->data = verified;
+   return ret;
+
+-- 
+2.54.0
+

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -115,3 +115,6 @@ sys-apps/azure-vm-utils
 # Use unstable version for cross-compile fix. This needs to be at least as new
 # as app-containers/docker.
 =app-containers/docker-cli-29.1.3
+
+# Chewi maintains edk2 in Gentoo, and we generally want the latest.
+sys-firmware/edk2-bin

sdk_container/src/third_party/coreos-overlay/profiles/coreos/targets/sdk/package.use

@@ -11,27 +11,13 @@ dev-lang/rust rustfmt
 app-crypt/gnupg smartcard usb
 
 # for qemu
-app-arch/bzip2 static-libs
-app-emulation/qemu -doc -jpeg ncurses python static-user virtfs qemu_softmmu_targets_aarch64 qemu_softmmu_targets_x86_64 qemu_user_targets_aarch64 qemu_user_targets_x86_64
+app-emulation/qemu -doc -jpeg -pin-upstream-blobs ncurses python static-user virtfs qemu_softmmu_targets_aarch64 qemu_softmmu_targets_x86_64 qemu_user_targets_aarch64 qemu_user_targets_x86_64
 dev-libs/glib static-libs
-dev-libs/libaio static-libs
 dev-libs/libpcre2 static-libs
-dev-libs/openssl static-libs
-media-libs/libjpeg-turbo static-libs
-media-libs/libpng static-libs
-net-misc/curl static-libs
 sys-apps/attr static-libs
-sys-apps/dtc static-libs
-sys-libs/libcap-ng static-libs
-sys-libs/libseccomp static-libs
-sys-libs/ncurses static-libs
+sys-firmware/edk2-bin qemu_softmmu_targets_aarch64 qemu_softmmu_targets_x86_64
 sys-libs/zlib static-libs
-virtual/jpeg static-libs
 virtual/zlib static-libs
-x11-libs/pixman static-libs
-
-# Get latest EDK2 firmware for Secure Boot on arm64.
-app-emulation/qemu -pin-upstream-blobs
 
 # Needed for signed sysexts using systemd-repart
 sys-apps/systemd cryptsetup

sdk_container/src/third_party/coreos-overlay/sys-boot/shim-signed/Manifest

@@ -1,2 +1,2 @@
-DIST shimaa64-15.8-r1.efi.signed 996824 BLAKE2B 2ba906ddb168ec689398e6561d9b01fa2a37d1e7dcb80b86b8d86d46bae5e1600e77bb849ae9678f365051c7ee055d82ec604e3ec2b4433056a2a2f0e50255aa SHA512 7544db5e35d25073331f408fa1e71f6fed1bd27916468f918b48bbb8ac371086d05b4ec6b036be95a30101d0f047f6d7b431e8be401361286ae4a9780966a4cc
-DIST shimx64-15.8-r1.efi.signed 950040 BLAKE2B 90f8acd66b2e80e7b0696ba02522ab520cdec8bd8fc9f2996f26dc456786240b78e7dcf2807bc91530db4ec3425c5eb1355d20dd261ed189eb75ae3867b9a093 SHA512 9eb1468746abdfc62cdcb12b782c9aa775ae9c2c813781e96b44a02847d75eab0f9795a0e0b9ac05969a7712d4e1501102b4d32e9b005c9b8a2e70ab8eff911e
+DIST shimaa64-16.1.efi.signed 996872 BLAKE2B 789b04be855cd055bd2e885e5e1207140426622742cd30b6f978a96be85c6c5569f79a59dd9fb000699980b2ea01ecbb9e00085a19303805ebfdbf0ba2dcff62 SHA512 b866da33fde3e35873d212b65a6cecabe3616b2170ac6396ffbe7b4da0a6221d07a3c4a2b7a87df6109c6e4032374537022f7289df9204c284b8ac7c71064d5f
+DIST shimx64-16.1.efi.signed 950088 BLAKE2B 1fe6482af52b4f009f3c9086c4425d0b47fc20334dc8c60f6f55394df9112db7c9d3341c2d26837f296b220756235b5f7ac5465d5751beace08b711c5b629760 SHA512 56152e85ab864979f348a19f2ceef8b39dc4447aa2807e9484a106f0683551ff6014f00bb0bc8c123b3571a696bea41f1525e175e172f554a53bd495151043d6

sdk_container/src/third_party/coreos-overlay/sys-boot/shim/Manifest

@@ -1 +1 @@
-DIST shim-15.8.tar.bz2 2315201 BLAKE2B 24da29cf45a08bceffc15682fcdd16e34e42d3b33f2a0b2e528193d8e3455a034b6242c13cebf43db481f73a83329effd9812f0d1e04861ecf7329e54f9059b9 SHA512 30b3390ae935121ea6fe728d8f59d37ded7b918ad81bea06e213464298b4bdabbca881b30817965bd397facc596db1ad0b8462a84c87896ce6c1204b19371cd1
+DIST shim-16.1.tar.bz2 2348998 BLAKE2B f2aef8d1e8cbd65c911133807747b1f654ebbde465db8ed21d39825af4ec898e937bf35e2e77f59a76cdcdaa45873bc0f9dfbfa33f6acbbc6db8e5f689847841 SHA512 ca5f80e82f3b80b622028f03ef23105c98ee1b6a25f52a59c823080a3202dd4b9962266489296e99f955eb92e36ce13e0b1d57f688350006bba45f2718f159fb

sdk_container/src/third_party/coreos-overlay/sys-boot/shim/shim-16.1.ebuild

@@ -0,0 +1,48 @@
+# Copyright 2015 CoreOS, Inc.
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DESCRIPTION="UEFI Shim loader"
+HOMEPAGE="https://github.com/rhboot/shim"
+SRC_URI="https://github.com/rhboot/shim/releases/download/${PV}/shim-${PV}.tar.bz2"
+KEYWORDS="amd64 arm64"
+
+LICENSE="BSD"
+SLOT="0"
+IUSE="official"
+
+# TODO: Would be ideal to depend on sys-boot/gnu-efi package, but
+# currently the shim insists on using the bundled copy. This will need
+# to be addressed by patching this check out after making sure that
+# our copy of gnu-efi is as usable as the bundled one.
+DEPEND="
+	dev-libs/openssl
+"
+BDEPEND="
+	coreos-base/coreos-sb-keys
+"
+
+PATCHES=(
+	"${FILESDIR}/0001-Fix-parallel-build-of-gnu-efi.patch"
+	"${FILESDIR}/0002-Fix-build-with-binutils-2-46.patch"
+)
+
+src_compile() {
+	use official && [[ -z ${SHIM_SIGNING_CERTIFICATE} ]] &&
+		die "USE=official but SHIM_SIGNING_CERTIFICATE environment variable is unset"
+
+	sed -e "s/@@VERSION@@/${PVR}/" "${FILESDIR}"/sbat.csv.in >"${WORKDIR}/sbat.csv" || die
+
+	unset ARCH
+	emake \
+		CROSS_COMPILE="${CHOST}-" \
+		ENABLE_SBSIGN=1 \
+		SBATPATH="${WORKDIR}"/sbat.csv \
+		VENDOR_CERT_FILE="${SHIM_SIGNING_CERTIFICATE:-${BROOT}/usr/share/sb_keys/shim.der}"
+}
+
+src_install() {
+	insinto /usr/lib/shim
+	doins shim?*.efi mm?*.efi
+}

sdk_container/src/third_party/portage-stable/sys-firmware/edk2-bin/Manifest

@@ -7,4 +7,8 @@ DIST edk2-202511-1-qemu-aarch64.xpak 4052801 BLAKE2B 79fb12322613286fc0733da774e
 DIST edk2-202511-1-qemu-loongarch64.xpak 1994972 BLAKE2B 98ef04fa0042f82458b48e5edee4ee271196bdc73ab3e7c0c97397c2a989240881fa1d0d3ed5e24f35731a37be43c1f140914965fb04b2f03aabd00e0615782d SHA512 deac522183b2c2a4ca54dacad087a753866b66cef148b481f77c9a4d163fd972ab043340880d66be523b99ba40e7e7bb0efaf4282cc6cbd41e6f0bdff05fe485
 DIST edk2-202511-1-qemu-riscv64.xpak 1847391 BLAKE2B ef1070607e4e937a211c39e558e7012a02387f29d876680b9b05aaeffb8d7dda9c56a20d05d607319def68e1677a2c8985fb498a2c55bb607251a4fbe6c3d5eb SHA512 e9bdc4141dc0ded6b7620eadfda89fc7009823e7762759cd925cfc6d178a50638aa09f088b7d195b1bf18b70d8e920ee00d4ed35a65fa39b6061729ebd828c66
 DIST edk2-202511-1-qemu-x86_64.xpak 8985483 BLAKE2B 752351a7ccdb7e16274e94bd1d43d605c31b6babe0dbe4af189aeedbb70a0d943c7be8c4b9b1808cf4229603ca2ffeb4e90d6419000fb3691af7fa73e9792881 SHA512 aca265ad79cb0a835e7dc2bbf3fdcdfce43d2f03a5fd9663f0d3b719620ae4adc4f16453759c547adf508d7a549463875788a0913e0fae8b7e630915ad7c33b5
+DIST edk2-202605-1-qemu-aarch64.xpak 4073020 BLAKE2B 00756e94cb7bae3a964f05aa9ef0d28662aecd262abd6e424870f19aa02869e5b7a10883f2325d5b717af7d31b6bf93c2236aab4f04816061a5d096e062044b2 SHA512 237b11036753eaa5529c61ef9c093ca1f394352c67e8695a29ed876a75f903f21583aa3f3f2c088afe84562f0a16d9b19b80206338449af194a25d2258ff62fa
+DIST edk2-202605-1-qemu-loongarch64.xpak 2141697 BLAKE2B 41a28e42a82ee5b40dd9baf196bd7dfe88b016a6a918e88fc685d52480307ebedbbf4fb45b37221165bcccaa35375b49cbc18c99ebfc420f7430837b6eaa7780 SHA512 18f46175aaff2d4b1ee4de133c05180b4e888e0a7d841d88fdbf6e52f2a195371b63c6c6c7868c0c4ab5406feaae40beb460701432f37bf6efa0f7b706851f82
+DIST edk2-202605-1-qemu-riscv64.xpak 1864003 BLAKE2B 458876ccc9efb0259b2f9aced9eeb8aace5a3cd76dac45d724060a06a949d73bde84fd216ebee4345fe6e39edbec96e51e4ac3c37c955ba2725c1991bb17f2a4 SHA512 c665001d0d7e8ec5ac8fb0018905322f74ca192fcbda8d1223e206dd1e01d7e1f78399afba22db37dd46fe8f4798d13deb467d97388d8f969bfa7d24626ac165
+DIST edk2-202605-1-qemu-x86_64.xpak 9018459 BLAKE2B f79e65496247c5b1b2506440b0773800d13392edb8cf1a940a49b39a577eb90cea41f84d6dbb4a70bf240633a87326699c4a9620cd597f450646477cc8983f25 SHA512 19e1d1cbfd66830787c77a3c434907348fcb070c0f423e4d53817f3b18d958e009d7d249b916fe615ecbaef650c3cdc59269168e727deb4025ef32c38489d277
 DIST edk2-ovmf-202202-1.xpak 2672386 BLAKE2B 75c15d4379610ab2af85b78166e350d52f4f1bc1fff5b2eb693ad0d7b1f6648e65d8ae3e2c5467f93f1557ad3b4fa664ab2d76ff10794667de22c2ea8cca6b2d SHA512 06783b89c96bada0fd025ff39eaee501a027abcb03c0bdcf3ff497d52be22927ab03013d90f145ee94a8662cfffe4f8c154dcd06db1bb1acef8a85ae43de14a3