Enable systemd boot secure-boot signing by gmileka · Pull Request #20014 · microsoft/azurelinux

George Mileka (gmileka) · 2026-11-06T20:05:45Z

No description provided.

Adding a call to pesign-client with the default upstream Fedora signing parameter values. Those values match what is currently being used by other packages (kernel, grub2, etc.). They do not define what certificate will be used. Instead, the environment and package name decide what certificate will be used as follows: - If this package is being built in the production environment, it will be signed with ESRP production secure boot certificate. - If it is being built in the PME staging environment, it will be signed with the ESRP test secure boot certificate. - Otherwise, it will be signed with a self-issued certificate.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Co-authored-by: gmileka <4400491+gmileka@users.noreply.github.com>

… dedicated cert Co-authored-by: gmileka <4400491+gmileka@users.noreply.github.com>

…tput Co-authored-by: gmileka <4400491+gmileka@users.noreply.github.com>

Co-authored-by: gmileka <4400491+gmileka@users.noreply.github.com>

Copilot

🟡 Changes recommended

The signed EFI payload is still packaged with metadata claiming it cannot support Secure Boot and lacks signed-bootloader Provides, requiring packaging updates that preserve existing dependency compatibility.

1 open issue

Update package metadata and Provides for signed EFI payload · New

What changed in this PR

Enables Secure Boot signing for systemd-boot in non-OBS builds through Azure Linux’s overlay system.

Changes:

Adds pesign as a build dependency when the bootloader is enabled.
Signs the EFI binary using the dedicated systemd-boot-signer certificate.
Refreshes the component lock and rendered spec, including release and changelog updates.

File	Description
`specs/s/systemd/systemd.spec`	Renders the signing dependency and steps; updates release metadata.
`locks/systemd.lock`	Refreshes the component input fingerprint.
`base/comps/systemd/overlays/0008-non-obs-secure-boot-signing.overlay.toml`	Defines bootloader-gated signing for non-OBS builds.

_{Review effort: Balanced}

+SYSTEMD_BOOT_EFI="%{buildroot}/usr/lib/systemd/boot/efi/systemd-boot%{efi_arch}.efi"
+%define __pesign_client_cert systemd-boot-signer
+%pesign -s -i $SYSTEMD_BOOT_EFI -o $SYSTEMD_BOOT_EFI.signed
+mv $SYSTEMD_BOOT_EFI.signed $SYSTEMD_BOOT_EFI'''


Copilot

🟡 Changes recommended

The signing package is absent from the component build configuration, requires an outdated systemd version, and attaches its upgrade scriptlet to the wrong package.

4 open issues

_{Review effort: Balanced}

+# This way we don't need to duplicate the build dependencies and logic
+# that is provided by the main systemd package.
+
+BuildRequires:  version(%{source_rpm_name})%{_isa} = %{version}


+
+install -m0644 -Dt %{buildroot}%{_licensedir}/%{name}/ %{_datadir}/licenses/systemd/LICENSE.LGPL2.1
+
+%postun


+Name:           systemd-boot
+Version:        253~rc1
+Release:        %autorelease


Copilot

🔵 Needs a closer look

The signing package requires unsigned-package version 258 while the tree provides 258.4, making the dependency unresolvable; it also lacks component registration and attaches its bootloader-update scriptlet to a package that is not shipped.

4 open issues

1 previously missed issue

In code that hasn't changed since last review

Signing package version mismatches the unsigned RPM capability

specs/s/systemd-boot/systemd-boot.spec:21

With the top-level Version: 258, this requires version(systemd-boot-unsigned)%{_isa} = 258, but specs/s/systemd/systemd.spec:598-599 provides that capability at version 258.4. These versions are not equal, so the signing package cannot resolve this dependency against the unsigned RPM produced by this tree. Set the signing spec's top-level Version to 258.4 in its authoritative source or overlay, then regenerate the rendered spec.

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

The signing package lacks azldev registration and a lock, and its upgrade hook targets a package that is never emitted, so signed bootloader upgrades will not update the ESP.

4 open issues

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

The spec lacks component registration and a lock, preventing distro builds, and its update scriptlet targets the wrong package, leaving the ESP bootloader unchanged on upgrades.

4 open issues

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

Critical defects include an unsatisfiable systemd version requirement, broken EFI signing paths, an upgrade hook attached to the wrong package, and a missing component lock.

8 open issues

_{Review effort: Balanced}

+description = "Align the systemd-boot package version with the Azure Linux systemd build"
+type = "spec-search-replace"
+regex = '^Version:\s+.*$'
+replacement = 'Version:        258.11'


+replacement = '''SYSTEMD_BOOT_EFI="%{buildroot}%{_prefix}/lib/systemd/boot/efi/systemd-boot%{efi_arch}.efi"
+%define __pesign_client_cert systemd-boot-signer
+%pesign -s -i $SYSTEMD_BOOT_EFI -o $SYSTEMD_BOOT_EFI.signed
+mv $SYSTEMD_BOOT_EFI.signed $SYSTEMD_BOOT_EFI'''


+[components.systemd-boot]
+spec = { type = "local", path = "systemd-boot.spec" }


+
+install -m0644 -Dt %{buildroot}%{_licensedir}/%{name}/ %{_datadir}/licenses/systemd/LICENSE.LGPL2.1
+
+%postun


George Mileka (gmileka) and others added 7 commits September 22, 2026 12:21

Update lock file

483dd36

Install pesign only if 'wantbootloader' is specified.

99e3bdb

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Move systemd pesign overlays into single overlay file with metadata

b471f95

Co-authored-by: gmileka <4400491+gmileka@users.noreply.github.com>

Fix systemd pesign signing: gate on want_bootloader, use %pesign with…

e52cb50

… dedicated cert Co-authored-by: gmileka <4400491+gmileka@users.noreply.github.com>

Fix systemd boot-unsigned package metadata to match signed non-OBS ou…

74668d0

…tput Co-authored-by: gmileka <4400491+gmileka@users.noreply.github.com>

fix(systemd): retain boot unsigned package

c874b33

Co-authored-by: gmileka <4400491+gmileka@users.noreply.github.com>

Copilot AI balanced review requested due to automatic review settings November 6, 2026 20:05

George Mileka (gmileka) changed the title ~~User/gmileka/enable systemd boot signing~~ Enable systemd boot secure-boot signing Nov 6, 2026

Copilot started reviewing on behalf of George Mileka (gmileka) November 6, 2026 20:06

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Lynsey Rydberg (corvus-callidus) self-requested a review November 6, 2026 23:21

github-actions Bot added the targets-4.0 label Nov 7, 2026

Add systemd-boot

e1c3aff

Copilot AI balanced review requested due to automatic review settings November 11, 2026 00:55

Copilot started reviewing on behalf of George Mileka (gmileka) November 11, 2026 00:55

View session