Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package grub2 for openSUSE:Factory checked in at 2026-10-12 22:05:29 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/grub2 (Old) and /work/SRC/openSUSE:Factory/.grub2.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "grub2" Mon Oct 12 22:05:29 2026 rev:400 rq:1383309 version:2.16 Changes: -------- --- /work/SRC/openSUSE:Factory/grub2/grub2.changes 2026-09-19 22:20:08.761110552 +0200 +++ /work/SRC/openSUSE:Factory/.grub2.new.3698736/grub2.changes 2026-10-12 22:05:44.133597550 +0200 @@ -1,0 +2,148 @@ +Thu Oct 8 08:01:44 UTC 2026 - Fabian Vogt <[email protected]> + +- Add upstream patch to fix CDROM boot failures (boo#1282614): + * 0001-disk-i386-pc-biosdisk-Fix-retry-of-CDROM-reads.patch + +------------------------------------------------------------------- +Wed Oct 7 10:50:57 UTC 2026 - Dirk Müller <[email protected]> + +- fix typos in description + +------------------------------------------------------------------- +Tue Oct 6 03:45:41 UTC 2026 - Gary Ching-Pang Lin <[email protected]> + +- Fix a potential boot error when loading the synthesized initrd + * 0001-Skip-in-place-verifier-for-the-synthesized-initrd.patch + +------------------------------------------------------------------- +Mon Oct 5 01:44:49 UTC 2026 - Gary Ching-Pang Lin <[email protected]> + +- Backport upstream fixes to verify linux initrd in place to avoid + the potential OOM (bsc#1275739) + * 0001-kern-file-record-file-type-and-track-in-place-verifi.patch + * 0002-verifiers-support-in-place-verification.patch + * 0003-tpm-tpcm-mark-TPM-and-TPCM-verifiers-as-in-place-cap.patch + * 0004-loader-linux-measure-initrd-in-place.patch + * 0005-docs-grub-dev.texi-Document-in-place-verification.patch +- Patch refreshed + * 0001-clean-up-crypttab-and-linux-modules-dependency.patch + * 0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch + +------------------------------------------------------------------- +Sat Oct 3 16:04:21 UTC 2026 - Dirk Müller <[email protected]> + +- fix typos + +------------------------------------------------------------------- +Fri Sep 18 09:35:59 UTC 2026 - Michael Chang <[email protected]> + +- Update to 2.16 + * libgcrypt 1.12.2. + * libtasn1 4.21.0. + * ML-DSA post-quantum signature support for appended signatures. + * Certificate revocation (dbx) checks for appended signatures. + * PKCS#7 signedAttrs verification and X.509 validity period checking. + * NVMe native disk support. + * NVMe over Fibre Channel and multiple NVMe boot paths on IEEE 1275. + * virtio-net driver. + * AMBA PL011 UART support. + * DHCPv6 support and network configuration from the UEFI device path. + * Argon2 password hashing for GRUB users and the grub-mkpasswd-argon2 utility. + * Access levels for authentication in grub-mkconfig. + * MFA key protector. + * TPCM (Trusted Platform Control Module) verifier on x86_64 EFI. + * New tpm_record_pcrs command exposing a TPM PCR snapshot to the OS. + * New efibootnext module and 31_efi_bootnext script for one-shot boot entries. + * New connectefi, lsefivar, btrfs-info, btrfs-list-subvols and + btrfs-get-default-subvol commands. + * Downstream SBAT support and SBAT level validation in grub-mkimage. + * Serial port addresses restricted to firmware-described UARTs under lockdown. + * Drop UGA Draw and Console Control protocols support. + * GitLab CI with multi-architecture builds, clang jobs and weekly Coverity scans. + * Cygwin and mingw cross-build fixes. + * Filesystems hardening and fixes. + * Video readers and font fixes found by fuzzing. + * EFI code improvements and fixes. + * Network stack fixes. + * Coverity and memory leak fixes. + * ofpath and grub-install host utility robustness fixes. + * Tests improvements. + * Documentation improvements. + * ... and tons of other fixes and cleanups... +- Patch removed + * 0001-fs-btrfs-mark-Btrfs-on-disk-structs-as-GRUB_PACKED.patch + * 0002-fs-btrfs-add-btrfs-info-command.patch + * 0003-fs-btrfs-add-btrfs-list-subvols-command.patch + * 0004-fs-btrfs-add-btrfs-get-default-subvol-command.patch + * 0001-lvm-allocate-metadata-buffer-from-raw-contents.patch + * 0001-net-http-Check-result-of-grub_netbuff_put-in-http_re.patch + * 0002-efinet-Add-structures-for-PXE-messages.patch + * 0003-efinet-bootp-add-net_dhcp6-command-supporting-dhcpv6.patch + * 0004-grub.texi-Add-net_dhcp6-document.patch + * 0005-bootp-Process-DHCPACK-packet-during-HTTP-Boot.patch + * 0006-efinet-Configure-network-from-UEFI-device-path.patch + * 0007-efinet-Set-DNS-server-from-UEFI-protocol.patch + * 0008-kern-efi-efi-Print-URI-and-DNS-device-path-info.patch + * 0009-kern-efi-efi-Correct-endianness-in-IPv6-device-path.patch + * 0010-bootp-Fix-logical-operator-in-DHCP-option-overload-c.patch + * 0001-test-Fix-f-test-on-files-over-network.patch + * 0002-http-Return-HTTP-status-code-in-http_establish.patch + * 0003-docs-Clarify-test-for-files-on-TFTP-and-HTTP.patch + * 0004-tftp-Fix-hang-when-file-is-a-directory.patch + * 0001-cacheinfo-fix-hit-ratio-calculation-and-statistics-o.patch + * 0002-disk-fix-cache-lock-and-hit-counter-for-invalidated-.patch + * 0003-disk-reduce-cache-slot-thrashing.patch + * 0001-ieee1275-powerpc-implements-fibre-channel-discovery-.patch + * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch + * 0001-ieee1275-add-support-for-NVMeoFC.patch + * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch + * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch + * 0001-Make-grub.cfg-compatible-to-old-binaries.patch + * 0001-ieee1275-support-added-for-multiple-nvme-bootpaths.patch + * 0001-ofpath-Add-error-check-in-NVMEoF-device-translation.patch + * grub2-bls-boot-show-snapshot.patch + * 0001-getroot-Skip-mount-points-in-grub_find_device.patch + * 0001-00_header-Omit-loading-efi_uga-on-non-x86-EFI-platfo.patch + * 0001-Revert-configure-Print-a-more-helpful-error-if-autoc.patch + * 0002-Revert-configure-Check-linker-for-image-base-support.patch + * 0001-mdraid1x-fix-raid_disks-decoding-on-big-endian-syste.patch + * 0001-Mandatory-install-device-check-for-PowerPC.patch + * 0001-osdep-linux-ofpath-Update-strstr-calls.patch + * 0001-util-probe-Save-strrchr-ret-val-to-const-data-ptr.patch + * 0002-util-resolve-Save-str-r-chr-ret-val-to-const-data-pt.patch + * gcc16.patch + * 0001-lib-hwfeatures-gcry-Fix-write_cr0-writing-to-CR4.patch +- Patch rebased + * use-grub2-as-a-package-name.patch + * info-dir-entry.patch + * grub2-sysfb.patch + * grub2-iterate-and-hook-for-extended-partition.patch + * grub2-secureboot-chainloader.patch + * grub2-s390x-04-grub2-install.patch + * grub2-s390x-05-grub2-mkconfig.patch + * grub2-default-distributor.patch + * grub2-emu-4-all.patch + * grub2-btrfs-04-grub2-install.patch + * grub2-btrfs-05-grub2-mkconfig.patch + * grub2-efi-xen-cmdline.patch + * grub2-Add-hidden-menu-entries.patch + * grub2-suse-remove-linux-root-param.patch + * 0002-ieee1275-powerpc-enables-device-mapper-discovery.patch + * 0001-Unify-the-check-to-enable-btrfs-relative-path.patch + * 0004-Try-to-pick-better-locations-for-kernel-and-initrd.patch + * 0003-grub-install-support-prep-environment-block.patch + * 0001-install-fix-software-raid1-on-esp.patch + * 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch + * 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch + * 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch + * grub2-bsc1220338-key_protector-implement-the-blocklist.patch + * 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch + * 0001-10_linux-Ensure-persistence-of-root-file-system-moun.patch + * 0001-mkconfig-Determine-GRUB_DISTRIBUTOR-from-etc-SUSE-br.patch + * 0001-bls-fix-default-entry-and-bumpcounter-for-BLS-boot-c.patch +- Avoid insmod error when dealing with old grub.cfg + * 0001-insmod-ignore-efi_uga-on-EFI.patch +- Set grub as vendor_package_name in upstream's SBAT entry + 0001-grub-core-sbat.csv.in-Set-vendor_package_name-to-gru.patch + +------------------------------------------------------------------- Old: ---- 0001-00_header-Omit-loading-efi_uga-on-non-x86-EFI-platfo.patch 0001-Make-grub.cfg-compatible-to-old-binaries.patch 0001-Mandatory-install-device-check-for-PowerPC.patch 0001-Revert-configure-Print-a-more-helpful-error-if-autoc.patch 0001-cacheinfo-fix-hit-ratio-calculation-and-statistics-o.patch 0001-fs-btrfs-mark-Btrfs-on-disk-structs-as-GRUB_PACKED.patch 0001-getroot-Skip-mount-points-in-grub_find_device.patch 0001-ieee1275-add-support-for-NVMeoFC.patch 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch 0001-ieee1275-powerpc-implements-fibre-channel-discovery-.patch 0001-ieee1275-support-added-for-multiple-nvme-bootpaths.patch 0001-lib-hwfeatures-gcry-Fix-write_cr0-writing-to-CR4.patch 0001-lvm-allocate-metadata-buffer-from-raw-contents.patch 0001-mdraid1x-fix-raid_disks-decoding-on-big-endian-syste.patch 0001-net-http-Check-result-of-grub_netbuff_put-in-http_re.patch 0001-ofpath-Add-error-check-in-NVMEoF-device-translation.patch 0001-osdep-linux-ofpath-Update-strstr-calls.patch 0001-test-Fix-f-test-on-files-over-network.patch 0001-util-probe-Save-strrchr-ret-val-to-const-data-ptr.patch 0002-Revert-configure-Check-linker-for-image-base-support.patch 0002-disk-fix-cache-lock-and-hit-counter-for-invalidated-.patch 0002-efinet-Add-structures-for-PXE-messages.patch 0002-fs-btrfs-add-btrfs-info-command.patch 0002-http-Return-HTTP-status-code-in-http_establish.patch 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch 0002-util-resolve-Save-str-r-chr-ret-val-to-const-data-pt.patch 0003-disk-reduce-cache-slot-thrashing.patch 0003-docs-Clarify-test-for-files-on-TFTP-and-HTTP.patch 0003-efinet-bootp-add-net_dhcp6-command-supporting-dhcpv6.patch 0003-fs-btrfs-add-btrfs-list-subvols-command.patch 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch 0004-fs-btrfs-add-btrfs-get-default-subvol-command.patch 0004-grub.texi-Add-net_dhcp6-document.patch 0004-tftp-Fix-hang-when-file-is-a-directory.patch 0005-bootp-Process-DHCPACK-packet-during-HTTP-Boot.patch 0006-efinet-Configure-network-from-UEFI-device-path.patch 0007-efinet-Set-DNS-server-from-UEFI-protocol.patch 0008-kern-efi-efi-Print-URI-and-DNS-device-path-info.patch 0009-kern-efi-efi-Correct-endianness-in-IPv6-device-path.patch 0010-bootp-Fix-logical-operator-in-DHCP-option-overload-c.patch gcc16.patch grub-2.14.tar.xz grub2-bls-boot-show-snapshot.patch New: ---- 0001-Skip-in-place-verifier-for-the-synthesized-initrd.patch 0001-disk-i386-pc-biosdisk-Fix-retry-of-CDROM-reads.patch 0001-grub-core-sbat.csv.in-Set-vendor_package_name-to-gru.patch 0001-insmod-ignore-efi_uga-on-EFI.patch 0001-kern-file-record-file-type-and-track-in-place-verifi.patch 0002-verifiers-support-in-place-verification.patch 0003-tpm-tpcm-mark-TPM-and-TPCM-verifiers-as-in-place-cap.patch 0004-loader-linux-measure-initrd-in-place.patch 0005-docs-grub-dev.texi-Document-in-place-verification.patch grub-2.16.tar.xz ----------(Old B)---------- Old: * 0001-getroot-Skip-mount-points-in-grub_find_device.patch * 0001-00_header-Omit-loading-efi_uga-on-non-x86-EFI-platfo.patch * 0001-Revert-configure-Print-a-more-helpful-error-if-autoc.patch Old: * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0001-Make-grub.cfg-compatible-to-old-binaries.patch * 0001-ieee1275-support-added-for-multiple-nvme-bootpaths.patch Old: * 0001-mdraid1x-fix-raid_disks-decoding-on-big-endian-syste.patch * 0001-Mandatory-install-device-check-for-PowerPC.patch * 0001-osdep-linux-ofpath-Update-strstr-calls.patch Old: * 0001-00_header-Omit-loading-efi_uga-on-non-x86-EFI-platfo.patch * 0001-Revert-configure-Print-a-more-helpful-error-if-autoc.patch * 0002-Revert-configure-Check-linker-for-image-base-support.patch Old: * 0004-tftp-Fix-hang-when-file-is-a-directory.patch * 0001-cacheinfo-fix-hit-ratio-calculation-and-statistics-o.patch * 0002-disk-fix-cache-lock-and-hit-counter-for-invalidated-.patch Old:- Patch removed * 0001-fs-btrfs-mark-Btrfs-on-disk-structs-as-GRUB_PACKED.patch * 0002-fs-btrfs-add-btrfs-info-command.patch Old: * grub2-bls-boot-show-snapshot.patch * 0001-getroot-Skip-mount-points-in-grub_find_device.patch * 0001-00_header-Omit-loading-efi_uga-on-non-x86-EFI-platfo.patch Old: * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch Old: * 0001-ieee1275-powerpc-implements-fibre-channel-discovery-.patch * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch * 0001-ieee1275-add-support-for-NVMeoFC.patch Old: * 0003-disk-reduce-cache-slot-thrashing.patch * 0001-ieee1275-powerpc-implements-fibre-channel-discovery-.patch * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch Old: * 0001-Make-grub.cfg-compatible-to-old-binaries.patch * 0001-ieee1275-support-added-for-multiple-nvme-bootpaths.patch * 0001-ofpath-Add-error-check-in-NVMEoF-device-translation.patch Old: * gcc16.patch * 0001-lib-hwfeatures-gcry-Fix-write_cr0-writing-to-CR4.patch - Patch rebased Old: * 0004-fs-btrfs-add-btrfs-get-default-subvol-command.patch * 0001-lvm-allocate-metadata-buffer-from-raw-contents.patch * 0001-net-http-Check-result-of-grub_netbuff_put-in-http_re.patch Old: * 0002-Revert-configure-Check-linker-for-image-base-support.patch * 0001-mdraid1x-fix-raid_disks-decoding-on-big-endian-syste.patch * 0001-Mandatory-install-device-check-for-PowerPC.patch Old: * 0001-lvm-allocate-metadata-buffer-from-raw-contents.patch * 0001-net-http-Check-result-of-grub_netbuff_put-in-http_re.patch * 0002-efinet-Add-structures-for-PXE-messages.patch Old: * 0001-ieee1275-support-added-for-multiple-nvme-bootpaths.patch * 0001-ofpath-Add-error-check-in-NVMEoF-device-translation.patch * grub2-bls-boot-show-snapshot.patch Old: * 0001-Mandatory-install-device-check-for-PowerPC.patch * 0001-osdep-linux-ofpath-Update-strstr-calls.patch * 0001-util-probe-Save-strrchr-ret-val-to-const-data-ptr.patch Old: * 0010-bootp-Fix-logical-operator-in-DHCP-option-overload-c.patch * 0001-test-Fix-f-test-on-files-over-network.patch * 0002-http-Return-HTTP-status-code-in-http_establish.patch Old: * 0001-osdep-linux-ofpath-Update-strstr-calls.patch * 0001-util-probe-Save-strrchr-ret-val-to-const-data-ptr.patch * 0002-util-resolve-Save-str-r-chr-ret-val-to-const-data-pt.patch Old: * 0001-Revert-configure-Print-a-more-helpful-error-if-autoc.patch * 0002-Revert-configure-Check-linker-for-image-base-support.patch * 0001-mdraid1x-fix-raid_disks-decoding-on-big-endian-syste.patch Old: * 0001-cacheinfo-fix-hit-ratio-calculation-and-statistics-o.patch * 0002-disk-fix-cache-lock-and-hit-counter-for-invalidated-.patch * 0003-disk-reduce-cache-slot-thrashing.patch Old: * 0001-net-http-Check-result-of-grub_netbuff_put-in-http_re.patch * 0002-efinet-Add-structures-for-PXE-messages.patch * 0003-efinet-bootp-add-net_dhcp6-command-supporting-dhcpv6.patch Old: * 0001-fs-btrfs-mark-Btrfs-on-disk-structs-as-GRUB_PACKED.patch * 0002-fs-btrfs-add-btrfs-info-command.patch * 0003-fs-btrfs-add-btrfs-list-subvols-command.patch Old: * 0001-test-Fix-f-test-on-files-over-network.patch * 0002-http-Return-HTTP-status-code-in-http_establish.patch * 0003-docs-Clarify-test-for-files-on-TFTP-and-HTTP.patch Old: * 0001-ieee1275-add-support-for-NVMeoFC.patch * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch Old: * 0001-util-probe-Save-strrchr-ret-val-to-const-data-ptr.patch * 0002-util-resolve-Save-str-r-chr-ret-val-to-const-data-pt.patch * gcc16.patch Old: * 0002-disk-fix-cache-lock-and-hit-counter-for-invalidated-.patch * 0003-disk-reduce-cache-slot-thrashing.patch * 0001-ieee1275-powerpc-implements-fibre-channel-discovery-.patch Old: * 0002-http-Return-HTTP-status-code-in-http_establish.patch * 0003-docs-Clarify-test-for-files-on-TFTP-and-HTTP.patch * 0004-tftp-Fix-hang-when-file-is-a-directory.patch Old: * 0002-efinet-Add-structures-for-PXE-messages.patch * 0003-efinet-bootp-add-net_dhcp6-command-supporting-dhcpv6.patch * 0004-grub.texi-Add-net_dhcp6-document.patch Old: * 0002-fs-btrfs-add-btrfs-info-command.patch * 0003-fs-btrfs-add-btrfs-list-subvols-command.patch * 0004-fs-btrfs-add-btrfs-get-default-subvol-command.patch Old: * 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch * 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch * 0001-Make-grub.cfg-compatible-to-old-binaries.patch Old: * 0003-fs-btrfs-add-btrfs-list-subvols-command.patch * 0004-fs-btrfs-add-btrfs-get-default-subvol-command.patch * 0001-lvm-allocate-metadata-buffer-from-raw-contents.patch Old: * 0003-efinet-bootp-add-net_dhcp6-command-supporting-dhcpv6.patch * 0004-grub.texi-Add-net_dhcp6-document.patch * 0005-bootp-Process-DHCPACK-packet-during-HTTP-Boot.patch Old: * 0003-docs-Clarify-test-for-files-on-TFTP-and-HTTP.patch * 0004-tftp-Fix-hang-when-file-is-a-directory.patch * 0001-cacheinfo-fix-hit-ratio-calculation-and-statistics-o.patch Old: * 0004-grub.texi-Add-net_dhcp6-document.patch * 0005-bootp-Process-DHCPACK-packet-during-HTTP-Boot.patch * 0006-efinet-Configure-network-from-UEFI-device-path.patch Old: * 0005-bootp-Process-DHCPACK-packet-during-HTTP-Boot.patch * 0006-efinet-Configure-network-from-UEFI-device-path.patch * 0007-efinet-Set-DNS-server-from-UEFI-protocol.patch Old: * 0006-efinet-Configure-network-from-UEFI-device-path.patch * 0007-efinet-Set-DNS-server-from-UEFI-protocol.patch * 0008-kern-efi-efi-Print-URI-and-DNS-device-path-info.patch Old: * 0007-efinet-Set-DNS-server-from-UEFI-protocol.patch * 0008-kern-efi-efi-Print-URI-and-DNS-device-path-info.patch * 0009-kern-efi-efi-Correct-endianness-in-IPv6-device-path.patch Old: * 0008-kern-efi-efi-Print-URI-and-DNS-device-path-info.patch * 0009-kern-efi-efi-Correct-endianness-in-IPv6-device-path.patch * 0010-bootp-Fix-logical-operator-in-DHCP-option-overload-c.patch Old: * 0009-kern-efi-efi-Correct-endianness-in-IPv6-device-path.patch * 0010-bootp-Fix-logical-operator-in-DHCP-option-overload-c.patch * 0001-test-Fix-f-test-on-files-over-network.patch Old: * 0002-util-resolve-Save-str-r-chr-ret-val-to-const-data-pt.patch * gcc16.patch * 0001-lib-hwfeatures-gcry-Fix-write_cr0-writing-to-CR4.patch Old: * 0001-ofpath-Add-error-check-in-NVMEoF-device-translation.patch * grub2-bls-boot-show-snapshot.patch * 0001-getroot-Skip-mount-points-in-grub_find_device.patch ----------(Old E)---------- ----------(New B)---------- New:- Fix a potential boot error when loading the synthesized initrd * 0001-Skip-in-place-verifier-for-the-synthesized-initrd.patch New:- Add upstream patch to fix CDROM boot failures (boo#1282614): * 0001-disk-i386-pc-biosdisk-Fix-retry-of-CDROM-reads.patch New:- Set grub as vendor_package_name in upstream's SBAT entry 0001-grub-core-sbat.csv.in-Set-vendor_package_name-to-gru.patch New:- Avoid insmod error when dealing with old grub.cfg * 0001-insmod-ignore-efi_uga-on-EFI.patch - Set grub as vendor_package_name in upstream's SBAT entry New: the potential OOM (bsc#1275739) * 0001-kern-file-record-file-type-and-track-in-place-verifi.patch * 0002-verifiers-support-in-place-verification.patch New: * 0001-kern-file-record-file-type-and-track-in-place-verifi.patch * 0002-verifiers-support-in-place-verification.patch * 0003-tpm-tpcm-mark-TPM-and-TPCM-verifiers-as-in-place-cap.patch New: * 0002-verifiers-support-in-place-verification.patch * 0003-tpm-tpcm-mark-TPM-and-TPCM-verifiers-as-in-place-cap.patch * 0004-loader-linux-measure-initrd-in-place.patch New: * 0003-tpm-tpcm-mark-TPM-and-TPCM-verifiers-as-in-place-cap.patch * 0004-loader-linux-measure-initrd-in-place.patch * 0005-docs-grub-dev.texi-Document-in-place-verification.patch New: * 0004-loader-linux-measure-initrd-in-place.patch * 0005-docs-grub-dev.texi-Document-in-place-verification.patch - Patch refreshed ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ grub2.spec ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.585908924 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.586908966 +0200 @@ -22,7 +22,6 @@ %if %{defined sbat_distro} # SBAT metadata %define sbat_generation 1 -%define sbat_generation_grub 6 %else %{error please define sbat_distro, sbat_distro_summary and sbat_distro_url} %endif @@ -175,13 +174,13 @@ %endif %endif -Version: 2.14 +Version: 2.16 Release: 0 Summary: Bootloader with support for Linux, Multiboot and more License: GPL-3.0-or-later Group: System/Boot URL: http://www.gnu.org/software/grub/ -Source0: https://ftp.gnu.org/gnu/grub/grub-%{version}.tar.xz +Source0: https://gitlab.freedesktop.org/api/v4/projects/26558/packages/generic/source-assets/grub-%{version}/grub-%{version}.tar.xz Source1: 90_persistent Source2: grub.default Source4: grub2.rpmlintrc @@ -198,28 +197,13 @@ Source18: grub2-check-default.sh Source19: grub2-instdev-fixup.pl Source1000: PATCH_POLICY -Patch: 0001-fs-btrfs-mark-Btrfs-on-disk-structs-as-GRUB_PACKED.patch -Patch: 0002-fs-btrfs-add-btrfs-info-command.patch -Patch: 0003-fs-btrfs-add-btrfs-list-subvols-command.patch -Patch: 0004-fs-btrfs-add-btrfs-get-default-subvol-command.patch -Patch: 0001-lvm-allocate-metadata-buffer-from-raw-contents.patch -Patch: 0001-net-http-Check-result-of-grub_netbuff_put-in-http_re.patch -Patch: 0002-efinet-Add-structures-for-PXE-messages.patch -Patch: 0003-efinet-bootp-add-net_dhcp6-command-supporting-dhcpv6.patch -Patch: 0004-grub.texi-Add-net_dhcp6-document.patch -Patch: 0005-bootp-Process-DHCPACK-packet-during-HTTP-Boot.patch -Patch: 0006-efinet-Configure-network-from-UEFI-device-path.patch -Patch: 0007-efinet-Set-DNS-server-from-UEFI-protocol.patch -Patch: 0008-kern-efi-efi-Print-URI-and-DNS-device-path-info.patch -Patch: 0009-kern-efi-efi-Correct-endianness-in-IPv6-device-path.patch -Patch: 0010-bootp-Fix-logical-operator-in-DHCP-option-overload-c.patch -Patch: 0001-test-Fix-f-test-on-files-over-network.patch -Patch: 0002-http-Return-HTTP-status-code-in-http_establish.patch -Patch: 0003-docs-Clarify-test-for-files-on-TFTP-and-HTTP.patch -Patch: 0004-tftp-Fix-hang-when-file-is-a-directory.patch -Patch: 0001-cacheinfo-fix-hit-ratio-calculation-and-statistics-o.patch -Patch: 0002-disk-fix-cache-lock-and-hit-counter-for-invalidated-.patch -Patch: 0003-disk-reduce-cache-slot-thrashing.patch +Patch: 0001-kern-file-record-file-type-and-track-in-place-verifi.patch +Patch: 0002-verifiers-support-in-place-verification.patch +Patch: 0003-tpm-tpcm-mark-TPM-and-TPCM-verifiers-as-in-place-cap.patch +Patch: 0004-loader-linux-measure-initrd-in-place.patch +Patch: 0005-docs-grub-dev.texi-Document-in-place-verification.patch +Patch: 0001-disk-i386-pc-biosdisk-Fix-retry-of-CDROM-reads.patch +Patch: 0001-grub-core-sbat.csv.in-Set-vendor_package_name-to-gru.patch Patch: rename-grub-info-file-to-grub2.patch Patch: grub2-linux.patch Patch: use-grub2-as-a-package-name.patch @@ -301,7 +285,6 @@ Patch: grub2-gfxmenu-support-scrolling-menu-entry-s-text.patch Patch: 0001-kern-mm.c-Make-grub_calloc-inline.patch Patch: 0002-cmdline-Provide-cmdline-functions-as-module.patch -Patch: 0001-ieee1275-powerpc-implements-fibre-channel-discovery-.patch Patch: 0002-ieee1275-powerpc-enables-device-mapper-discovery.patch Patch: 0001-Unify-the-check-to-enable-btrfs-relative-path.patch Patch: 0001-efi-linux-provide-linux-command.patch @@ -313,7 +296,6 @@ Patch: 0001-ieee1275-Avoiding-many-unecessary-open-close.patch Patch: 0001-Workaround-volatile-efi-boot-variable.patch Patch: 0001-templates-Follow-the-path-of-usr-merged-kernel-confi.patch -Patch: 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch Patch: 0001-arm64-Fix-EFI-loader-kernel-image-allocation.patch Patch: 0002-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch Patch: 0001-Factor-out-grub_efi_linux_boot.patch @@ -345,9 +327,6 @@ Patch: tpm-record-pcrs.patch Patch: grub-install-record-pcrs.patch Patch: safe_tpm_pcr_snapshot.patch -Patch: 0001-ieee1275-add-support-for-NVMeoFC.patch -Patch: 0002-ieee1275-ofpath-enable-NVMeoF-logical-device-transla.patch -Patch: 0003-ieee1275-change-the-logic-of-ieee1275_get_devargs.patch Patch: grub2-increase-crypttab-path-buffer.patch Patch: 0001-tpm2-Add-extra-RSA-SRK-types.patch Patch: 0001-clean-up-crypttab-and-linux-modules-dependency.patch @@ -357,7 +336,6 @@ Patch: 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch Patch: 0002-prep_loadenv-Fix-regex-for-Open-Firmware-device-spec.patch Patch: 0001-font-Try-memdisk-fonts-with-the-same-name.patch -Patch: 0001-Make-grub.cfg-compatible-to-old-binaries.patch Patch: grub2-mkconfig-riscv64.patch Patch: arm64-Use-proper-memory-type-for-kernel-allocation.patch Patch: 0001-luks2-Use-grub-tpm2-token-for-TPM2-protected-volume-.patch @@ -372,35 +350,27 @@ Patch: 0001-util-enable-grub-protect-only-for-EFI-systems.patch Patch: grub2-s390x-set-hostonly.patch Patch: 0001-Streamline-BLS-and-improve-PCR-stability.patch -Patch: 0001-ieee1275-support-added-for-multiple-nvme-bootpaths.patch Patch: 0001-kern-main-Fix-cmdpath-in-root-directory.patch Patch: grub2-s390x-secure-execution-support.patch Patch: 0001-autofs-Ignore-zfs-not-found.patch Patch: 0001-s390x-emu-Pass-through-PAES-cipher-as-AES.patch -Patch: 0001-ofpath-Add-error-check-in-NVMEoF-device-translation.patch Patch: grub2-btrfs-filter-non-subvol-mount.patch Patch: 0001-prep_loadenv-Measure-the-environment-block-into-PCR-.patch Patch: 0001-Fix-PowerPC-CAS-reboot-to-evaluate-menu-context.patch Patch: 0001-blscfg-read-fragments-in-order.patch -Patch: grub2-bls-boot-show-snapshot.patch Patch: 0001-Improve-TPM-key-protection-on-boot-interruptions.patch Patch: 0004-Key-revocation-on-out-of-bound-file-access.patch Patch: 0001-mkconfig-Determine-GRUB_DISTRIBUTOR-from-etc-SUSE-br.patch -Patch: 0001-getroot-Skip-mount-points-in-grub_find_device.patch Patch: 0001-linux-fallback-to-EFI-handover-on-x86_64.patch Patch: 0002-linux-fallback-to-direct-PE-entry-boot-on-arm64.patch Patch: 0003-efi-chainloader-fallback-to-direct-image-execution.patch Patch: 0004-efi-chainloader-fix-missing-file_path-in-loaded_imag.patch Patch: grub2-i386-pc-no-pageflipping.patch Patch: 0001-editenv-create-health_check_flag-env-var-on-RW-raw-b.patch -Patch: 0001-00_header-Omit-loading-efi_uga-on-non-x86-EFI-platfo.patch -Patch: 0001-Revert-configure-Print-a-more-helpful-error-if-autoc.patch -Patch: 0002-Revert-configure-Check-linker-for-image-base-support.patch Patch: 0001-blsuki-Fix-linux_cmd-size-calcution-in-bls_get_linux.patch Patch: 0001-bls-Allow-configuration-of-active-console-type.patch Patch: 0002-grubbls-Add-automatic-fwsetup-menu-entry.patch Patch: 0001-ieee1275-support-dm-multipath-bootlist.patch -Patch: 0001-mdraid1x-fix-raid_disks-decoding-on-big-endian-syste.patch Patch: 0001-blsuki-Add-support-for-LoaderEntries.patch Patch: 0002-menu-Allow-default-entry-to-have-.conf-suffix.patch Patch: 0003-bli-Add-support-for-LoaderEntryDefault-and-LoaderEnt.patch @@ -410,16 +380,12 @@ Patch: 0007-blsuki-Fix-sorting-for-entries-with-boot-counting-en.patch Patch: 0008-blsuki-append-leftover-LoaderEntries.patch Patch: 0009-blsuki-conservative-UTF-8-buffer-size.patch -Patch: 0001-Mandatory-install-device-check-for-PowerPC.patch -Patch: 0001-osdep-linux-ofpath-Update-strstr-calls.patch -Patch: 0001-util-probe-Save-strrchr-ret-val-to-const-data-ptr.patch -Patch: 0002-util-resolve-Save-str-r-chr-ret-val-to-const-data-pt.patch Patch: 0001-Fix-problematic-utf8-conversion-in-bli-patches.patch Patch: 0001-bls-fix-default-entry-and-bumpcounter-for-BLS-boot-c.patch -Patch: gcc16.patch -Patch: 0001-lib-hwfeatures-gcry-Fix-write_cr0-writing-to-CR4.patch Patch: 0001-bash-completion-add-_init_completion-marker.patch Patch: 0001-linux-allocate-EFI-kernel-buffer-as-GRUB_EFI_LOADER_.patch +Patch: 0001-insmod-ignore-efi_uga-on-EFI.patch +Patch: 0001-Skip-in-place-verifier-for-the-synthesized-initrd.patch %if 0%{?suse_version} < 1600 Requires: gettext-runtime @@ -449,6 +415,18 @@ %endif %endif +%global sbat_generation_grub %(tar -xOf %{SOURCE0} grub-%{version}/configure.ac | sed -n '/^GLOBAL_SBAT_LEVEL=/s///p') + +%ifarch %{efi} +%if "%{?sbat_generation_grub}" == "" +%{error: GLOBAL_SBAT_LEVEL is not found in %{SOURCE0}} +%endif +%endif + +%if "%{platform}" == "ieee1275" && "%{?sbat_generation_grub}" == "" +%{error: GLOBAL_SBAT_LEVEL is not found in %{SOURCE0}} +%endif + %if 0%{?suse_version} >= 1600 # Always requires a default cpu-platform package Requires: grub2-%{grubarch} = %{version}-%{release} @@ -467,12 +445,12 @@ %description This is the second version of the GRUB (Grand Unified Bootloader), a highly configurable and customizable bootloader with modular -architecture. It support rich scale of kernel formats, file systems, +architecture. It supports a rich variety of kernel formats, file systems, computer architectures and hardware devices. %if 0%{?suse_version} >= 1600 %package common -Summary: Utilies to manage grub +Summary: Utilities to manage grub Group: System/Boot Requires: gettext-runtime %ifnarch s390x @@ -499,7 +477,7 @@ %endif %description common -This package includes user space utlities to manage GRUB on your system. +This package includes user space utilities to manage GRUB on your system. %endif %package branding-upstream @@ -538,7 +516,7 @@ %description %{grubarch} The GRand Unified Bootloader (GRUB) is a highly configurable and customizable -bootloader with modular architecture. It supports rich variety of kernel formats, +bootloader with modular architecture. It supports a rich variety of kernel formats, file systems, computer architectures and hardware devices. This subpackage provides support for %{platform} systems. @@ -596,7 +574,7 @@ %description %{grubefiarch} The GRand Unified Bootloader (GRUB) is a highly configurable and customizable -bootloader with modular architecture. It supports rich variety of kernel formats, +bootloader with modular architecture. It supports a rich variety of kernel formats, file systems, computer architectures and hardware devices. This subpackage provides support for EFI systems. @@ -652,7 +630,7 @@ %description %{grubxenarch} The GRand Unified Bootloader (GRUB) is a highly configurable and customizable -bootloader with modular architecture. It supports rich variety of kernel formats, +bootloader with modular architecture. It supports a rich variety of kernel formats, file systems, computer architectures and hardware devices. This subpackage provides support for XEN systems. @@ -716,7 +694,7 @@ %description systemd-sleep-plugin Grub2's systemd-sleep plugin for directly booting hibernated kernel image in -swap partition while in resuming +swap partition while resuming. %endif %prep @@ -809,7 +787,7 @@ PXE_MODULES="tftp http" CRYPTO_MODULES="luks luks2 gcry_rijndael gcry_sha1 gcry_sha256 gcry_sha512 crypttab" %ifarch %{efi} -CD_MODULES="${CD_MODULES} chain efifwsetup efinet read tpm tss2 tpm2_key_protector memdisk tar squash4 xzio blsuki bls_bumpcounter" +CD_MODULES="${CD_MODULES} chain efifwsetup efinet read tpm tss2 tpm2_key_protector memdisk tar squash4 xzio blsuki bls_bumpcounter efibootnext" PXE_MODULES="${PXE_MODULES} efinet" %else CD_MODULES="${CD_MODULES} net ofnet" @@ -829,6 +807,11 @@ %ifarch %{efi} cd build-efi + +%if 0%{?sbat_generation} +echo "grub.%{sbat_distro},%{sbat_generation},%{sbat_distro_summary},%{name},%{version},%{sbat_distro_url}" > vendor_sbat.csv +%endif + ../configure \ TARGET_LDFLAGS=-static \ --prefix=%{_prefix} \ @@ -836,14 +819,11 @@ --sysconfdir=%{_sysconfdir} \ --target=%{_target_platform} \ --with-platform=efi \ - --program-transform-name=s,grub,%{name}, -make %{?_smp_mflags} - %if 0%{?sbat_generation} -echo "sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md"; > sbat.csv -echo "grub,%{sbat_generation_grub},Free Software Foundation,grub,%{version},https://www.gnu.org/software/grub/"; >> sbat.csv -echo "grub.%{sbat_distro},%{sbat_generation},%{sbat_distro_summary},%{name},%{version},%{sbat_distro_url}" >> sbat.csv + --with-sbat-file=vendor_sbat.csv \ %endif + --program-transform-name=s,grub,%{name}, +make %{?_smp_mflags} mkdir -p ./fonts cp %{_datadir}/%{name}/themes/*/*.pf2 ./fonts @@ -854,7 +834,7 @@ mksquashfs ./fonts memdisk.sqsh -keep-as-directory -comp xz -quiet -no-progress %endif -./grub-mkimage -O %{grubefiarch} -o grub.efi --memdisk=./memdisk.sqsh --prefix= %{?sbat_generation:--sbat sbat.csv} \ +./grub-mkimage -O %{grubefiarch} -o grub.efi --memdisk=./memdisk.sqsh --prefix= %{?sbat_generation:--sbat=} \ -d grub-core ${GRUB_MODULES} %if 0%{?suse_version} >= 1600 @@ -899,10 +879,10 @@ -o grubbls.efi \ --memdisk=./memdisk.sqsh \ -c ./grubbls.cfg \ - %{?sbat_generation:--sbat sbat.csv} \ + %{?sbat_generation:--sbat=} \ -d grub-core \ all_video boot font gfxmenu gfxterm gzio halt jpeg minicmd normal part_gpt png reboot video \ - fat tpm tss2 tpm2_key_protector memdisk tar squash4 xzio blsuki bls_bumpcounter linux bli regexp loadenv test echo true sleep efifwsetup + fat tpm tss2 tpm2_key_protector memdisk tar squash4 xzio blsuki bls_bumpcounter linux bli regexp loadenv test echo true sleep efifwsetup efibootnext %endif %ifarch x86_64 aarch64 @@ -937,9 +917,7 @@ %ifarch ppc ppc64 ppc64le %if 0%{?sbat_generation} -echo "sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md"; > sbat.csv -echo "grub,%{sbat_generation_grub},Free Software Foundation,grub,%{version},https://www.gnu.org/software/grub/"; >> sbat.csv -echo "grub.%{sbat_distro},%{sbat_generation},%{sbat_distro_summary},%{name},%{version},%{sbat_distro_url}" >> sbat.csv +echo "grub.%{sbat_distro},%{sbat_generation},%{sbat_distro_summary},%{name},%{version},%{sbat_distro_url}" > vendor_sbat.csv %endif %endif @@ -956,6 +934,11 @@ --target=%{_target_platform} \ --with-platform=%{platform} \ %{arch_specific} \ +%ifarch ppc ppc64 ppc64le +%if 0%{?sbat_generation} + --with-sbat-file=vendor_sbat.csv \ +%endif +%endif --program-transform-name=s,grub,%{name}, make %{?_smp_mflags} @@ -1081,7 +1064,7 @@ EOF %{__tar} cvf memdisk.tar ./grub.cfg ./grub-mkimage -O %{grubarch} -o grub.elf -d grub-core -x grub.der -m memdisk.tar \ - -c %{platform}-config -s sbat.csv --appended-signature-size %brp_pesign_reservation ${GRUB_MODULES} + -c %{platform}-config -s "" --appended-signature-size %brp_pesign_reservation ${GRUB_MODULES} ls -l "grub.elf" # truncate -s -%brp_pesign_reservation "grub.elf" fi @@ -1378,6 +1361,7 @@ # to be a drop-in file, requires no external dependency (boo#1231591) %attr(0644, root, root) %config(noreplace) %{_sysconfdir}/grub.d/25_bli %config(noreplace) %{_sysconfdir}/grub.d/30_uefi-firmware +%config(noreplace) %{_sysconfdir}/grub.d/31_efi_bootnext %config(noreplace) %{_sysconfdir}/grub.d/40_custom %config(noreplace) %{_sysconfdir}/grub.d/41_custom %config(noreplace) %{_sysconfdir}/grub.d/90_persistent @@ -1411,6 +1395,7 @@ %{_bindir}/%{name}-mkimage %{_bindir}/%{name}-mklayout %{_bindir}/%{name}-mknetdir +%{_bindir}/%{name}-mkpasswd-argon2 %{_bindir}/%{name}-mkpasswd-pbkdf2 %{_bindir}/%{name}-mkrelpath %{_bindir}/%{name}-mkrescue @@ -1441,6 +1426,7 @@ %{_mandir}/man1/%{name}-mkimage.1.* %{_mandir}/man1/%{name}-mklayout.1.* %{_mandir}/man1/%{name}-mknetdir.1.* +%{_mandir}/man1/%{name}-mkpasswd-argon2.1.* %{_mandir}/man1/%{name}-mkpasswd-pbkdf2.1.* %{_mandir}/man1/%{name}-mkrelpath.1.* %{_mandir}/man1/%{name}-mkrescue.1.* @@ -1491,6 +1477,7 @@ %{_datadir}/%{name}/%{grubarch}/grub.elf %{_datadir}/%{name}/%{grubarch}/grub.der %{_datadir}/%{name}/%{grubarch}/bootinfo.txt +%{_datadir}/%{name}/%{grubarch}/sbat.csv %endif %ifnarch ppc ppc64 ppc64le s390x %{arm} %{_datadir}/%{name}/%{grubarch}/*.image @@ -1531,6 +1518,7 @@ %{_datadir}/%{name}/%{grubefiarch}/*.lst %{_datadir}/%{name}/%{grubefiarch}/kernel.exec %{_datadir}/%{name}/%{grubefiarch}/modinfo.sh +%{_datadir}/%{name}/%{grubefiarch}/sbat.csv %dir %{sysefibasedir} %dir %{sysefidir} %{sysefidir}/grub.efi ++++++ 0001-10_linux-Ensure-persistence-of-root-file-system-moun.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.618910303 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.621910428 +0200 @@ -23,30 +23,25 @@ util/grub.d/10_linux.in | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -diff --git a/util/grub.d/10_linux.in b/util/grub.d/10_linux.in -index 5531239eb..4d8bdeac2 100644 --- a/util/grub.d/10_linux.in +++ b/util/grub.d/10_linux.in -@@ -54,14 +54,16 @@ esac +@@ -54,14 +54,16 @@ if ( [ "x${GRUB_DEVICE_UUID}" = "x" ] && [ "x${GRUB_DEVICE_PARTUUID}" = "x" ] ) \ || ( [ "x${GRUB_DISABLE_LINUX_UUID}" = "xtrue" ] \ && [ "x${GRUB_DISABLE_LINUX_PARTUUID}" = "xtrue" ] ) \ -- || ( ! test -e "/dev/disk/by-uuid/${GRUB_DEVICE_UUID}" \ -- && ! test -e "/dev/disk/by-partuuid/${GRUB_DEVICE_PARTUUID}" ) \ - || ( test -e "${GRUB_DEVICE}" && uses_abstraction "${GRUB_DEVICE}" lvm ); then +- || ( ! findfs UUID="${GRUB_DEVICE_UUID}" > /dev/null 2>&1 \ +- && ! findfs PARTUUID="${GRUB_DEVICE_PARTUUID}" > /dev/null 2>&1 ) \ + || ( test -e "${GRUB_DEVICE}" && ( uses_abstraction "${GRUB_DEVICE}" lvm || uses_abstraction "${GRUB_DEVICE}" diskfilter ) ); then LINUX_ROOT_DEVICE=${GRUB_DEVICE} elif [ "x${GRUB_DEVICE_UUID}" = "x" ] \ || [ "x${GRUB_DISABLE_LINUX_UUID}" = "xtrue" ]; then -+ test -e "/dev/disk/by-partuuid/${GRUB_DEVICE_PARTUUID}" || ++ findfs PARTUUID="${GRUB_DEVICE_PARTUUID}" > /dev/null 2>&1 || + echo "WARN: Use PARTUUID=${GRUB_DEVICE_PARTUUID} despite missing by-partuuid symlink" >&2 LINUX_ROOT_DEVICE=PARTUUID=${GRUB_DEVICE_PARTUUID} else -+ test -e "/dev/disk/by-uuid/${GRUB_DEVICE_UUID}" || ++ findfs UUID="${GRUB_DEVICE_UUID}" > /dev/null 2>&1 || + echo "WARN: Use UUID=${GRUB_DEVICE_UUID} despite missing by-uuid symlink" >&2 LINUX_ROOT_DEVICE=UUID=${GRUB_DEVICE_UUID} fi --- -2.44.0 - ++++++ 0001-Skip-in-place-verifier-for-the-synthesized-initrd.patch ++++++ >From bf4d87ed116bfa9772ae2b9ac8ea9ff57f950d12 Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Tue, 6 Oct 2026 11:38:58 +0800 Subject: [PATCH] Skip in-place verifier for the synthesized initrd The in-place verifier expects a 'file' when verifying an initrd. However the synthesized initrd isn't loaded from a file, so the verifier failed to verify it. Skip in-place verifier for the synthesized initrd to avoid the potential error. Signed-off-by: Gary Lin <[email protected]> --- grub-core/loader/linux.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c index 352bd1e..853789d 100644 --- a/grub-core/loader/linux.c +++ b/grub-core/loader/linux.c @@ -413,6 +413,10 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, goto fail; } + /* The synthesized initrd does not have 'file'. Skip in-place verifier. */ + if (initrd_ctx->components[i].file == NULL) + goto next; + /* * Measure the buffer the kernel is actually going to consume. The * verifiers which authenticate the file already ran when it was opened @@ -429,6 +433,7 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, goto fail; } + next: ptr += cursize; } if (newc) -- 2.51.0 ++++++ 0001-Unify-the-check-to-enable-btrfs-relative-path.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.663912184 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.666912309 +0200 @@ -41,8 +41,8 @@ - if (!bootloader_id && config.grub_distributor) { - char *ptr; -@@ -1064,6 +1064,45 @@ + bootloader_id = xstrdup (config.grub_distributor); +@@ -1059,6 +1059,45 @@ grub_hostfs_init (); grub_host_init (); @@ -88,7 +88,7 @@ switch (platform) { case GRUB_INSTALL_PLATFORM_I386_EFI: -@@ -1478,8 +1517,7 @@ +@@ -1486,8 +1525,7 @@ debug_image); } @@ -98,7 +98,7 @@ { if (!load_cfg_f) load_cfg_f = grub_util_fopen (load_cfg, "wb"); -@@ -1670,22 +1708,14 @@ +@@ -1678,22 +1716,14 @@ #ifdef __linux__ @@ -125,7 +125,7 @@ if (subvol && mount_path) { -@@ -1709,11 +1739,6 @@ +@@ -1717,11 +1747,6 @@ } } ++++++ 0001-bls-fix-default-entry-and-bumpcounter-for-BLS-boot-c.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.695913521 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.697913604 +0200 @@ -15,11 +15,9 @@ grub-core/commands/blsuki.c | 48 ++++++++++++++++++++++++++++ 2 files changed, 71 insertions(+), 9 deletions(-) -diff --git a/grub-core/commands/bls_bumpcounter.c b/grub-core/commands/bls_bumpcounter.c -index d45fe276c..fe4a9ea92 100644 --- a/grub-core/commands/bls_bumpcounter.c +++ b/grub-core/commands/bls_bumpcounter.c -@@ -102,8 +102,9 @@ grub_cmd_bls_bumpcounter (grub_extcmd_context_t ctxt __attribute__ ((unused)), +@@ -102,8 +102,9 @@ grub_efi_status_t err; char *entry, *new_path = NULL, *old_path; const char *blsdir; @@ -30,7 +28,7 @@ if (argc != 1) { grub_dprintf ("bls_bumpcounter", "only one argument should be passed\n"); -@@ -160,7 +161,7 @@ grub_cmd_bls_bumpcounter (grub_extcmd_context_t ctxt __attribute__ ((unused)), +@@ -160,7 +161,7 @@ blsdir = GRUB_BLS_CONFIG_PATH; } @@ -39,7 +37,7 @@ grub_utf8_to_utf16_alloc (old_path, &old_path16, NULL); err = root->Open (root, &handle, old_path16, -@@ -179,14 +180,15 @@ grub_cmd_bls_bumpcounter (grub_extcmd_context_t ctxt __attribute__ ((unused)), +@@ -179,14 +180,15 @@ most cases, and, if it fails, allocate a new one with the exact size returned from GetInfo. Reference: systemd:src/boot/efi/util.c =*/ @@ -57,7 +55,7 @@ err = handle->GetInfo (handle, &grub_efi_file_info_guid, &size, file_info); if (err == GRUB_EFI_BUFFER_TOO_SMALL) { -@@ -194,12 +196,12 @@ grub_cmd_bls_bumpcounter (grub_extcmd_context_t ctxt __attribute__ ((unused)), +@@ -194,12 +196,12 @@ /* When we bump the counter, it might happen that we increase the filename length. Add the space for 2 more characters (4 bytes). (i.e. adding the boot done part "-1") */ @@ -72,7 +70,7 @@ if (!file_info) { grub_error (GRUB_ERR_OUT_OF_MEMORY, N_("out of memory")); -@@ -221,12 +223,24 @@ grub_cmd_bls_bumpcounter (grub_extcmd_context_t ctxt __attribute__ ((unused)), +@@ -221,12 +223,24 @@ goto finish; grub_dprintf ("bls_bumpcounter", "renaming entry to %s\n", new_path); @@ -100,11 +98,9 @@ if (err != GRUB_EFI_SUCCESS) { -diff --git a/grub-core/commands/blsuki.c b/grub-core/commands/blsuki.c -index 4dfc4934e..8b152b443 100644 --- a/grub-core/commands/blsuki.c +++ b/grub-core/commands/blsuki.c -@@ -1091,6 +1091,7 @@ bls_create_entry (grub_blsuki_entry_t *entry) +@@ -1093,6 +1093,7 @@ char *initrd_cmd = NULL; char *dt_cmd = NULL; char *id = entry->filename; @@ -112,7 +108,7 @@ grub_size_t id_len; char *hotkey = NULL; char *users = NULL; -@@ -1111,6 +1112,52 @@ bls_create_entry (grub_blsuki_entry_t *entry) +@@ -1113,6 +1114,52 @@ id_len = grub_strlen (id); if (id_len >= BLS_EXT_LEN && grub_strcmp (id + id_len - BLS_EXT_LEN, ".conf") == 0) id[id_len - BLS_EXT_LEN] = '\0'; @@ -164,8 +160,8 @@ + } title = blsuki_get_val (entry, "title", NULL); - if (title != NULL) -@@ -1178,6 +1225,7 @@ bls_create_entry (grub_blsuki_entry_t *entry) + version = blsuki_get_val (entry, "version", NULL); +@@ -1174,6 +1221,7 @@ grub_free (args); grub_free (argv); grub_free (src); @@ -173,7 +169,4 @@ } #ifdef GRUB_MACHINE_EFI --- -2.53.0 - ++++++ 0001-clean-up-crypttab-and-linux-modules-dependency.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.717914440 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.720914565 +0200 @@ -23,8 +23,10 @@ 5 files changed, 71 insertions(+), 59 deletions(-) create mode 100644 include/grub/crypttab.h ---- a/grub-core/commands/crypttab.c -+++ b/grub-core/commands/crypttab.c +Index: grub-2.16/grub-core/commands/crypttab.c +=================================================================== +--- grub-2.16.orig/grub-core/commands/crypttab.c ++++ grub-2.16/grub-core/commands/crypttab.c @@ -3,10 +3,56 @@ #include <grub/command.h> #include <grub/misc.h> @@ -83,9 +85,11 @@ static grub_err_t grub_cmd_crypttab_entry (grub_command_t cmd __attribute__ ((unused)), int argc, char **argv) ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c -@@ -31,7 +31,7 @@ +Index: grub-2.16/grub-core/disk/cryptodisk.c +=================================================================== +--- grub-2.16.orig/grub-core/disk/cryptodisk.c ++++ grub-2.16/grub-core/disk/cryptodisk.c +@@ -34,7 +34,7 @@ #ifdef GRUB_UTIL #include <grub/emu/hostdisk.h> #else @@ -94,17 +98,19 @@ #endif GRUB_MOD_LICENSE ("GPLv3+"); ---- a/grub-core/loader/linux.c -+++ b/grub-core/loader/linux.c -@@ -6,6 +6,7 @@ - #include <grub/mm.h> +Index: grub-2.16/grub-core/loader/linux.c +=================================================================== +--- grub-2.16.orig/grub-core/loader/linux.c ++++ grub-2.16/grub-core/loader/linux.c +@@ -7,6 +7,7 @@ #include <grub/safemath.h> + #include <grub/verify.h> #include <grub/list.h> +#include <grub/crypttab.h> struct newc_head { -@@ -40,18 +41,6 @@ +@@ -41,18 +42,6 @@ struct dir struct dir *child; }; @@ -123,9 +129,9 @@ static char hex (grub_uint8_t val) { -@@ -436,45 +425,3 @@ - root = 0; - return GRUB_ERR_NONE; +@@ -471,45 +460,3 @@ grub_initrd_load (struct grub_linux_init + grub_initrd_close (initrd_ctx); + return status; } - -grub_err_t @@ -169,8 +175,10 @@ - - return GRUB_ERR_NONE; -} +Index: grub-2.16/include/grub/crypttab.h +=================================================================== --- /dev/null -+++ b/include/grub/crypttab.h ++++ grub-2.16/include/grub/crypttab.h @@ -0,0 +1,22 @@ +#ifndef GRUB_CRYPTTAB_HEADER +#define GRUB_CRYPTTAB_HEADER 1 @@ -194,9 +202,11 @@ +grub_initrd_publish_key (const char *uuid, const char *key, grub_size_t key_len, const char *path); + +#endif /* ! GRUB_CRYPTTAB_HEADER */ ---- a/include/grub/linux.h -+++ b/include/grub/linux.h -@@ -22,6 +22,3 @@ +Index: grub-2.16/include/grub/linux.h +=================================================================== +--- grub-2.16.orig/include/grub/linux.h ++++ grub-2.16/include/grub/linux.h +@@ -22,6 +22,3 @@ grub_initrd_close (struct grub_linux_ini grub_err_t grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, void *target); ++++++ 0001-disk-i386-pc-biosdisk-Fix-retry-of-CDROM-reads.patch ++++++ >From 2127a8c8abdee219ad75ae4f51f4c9d3add2bcdf Mon Sep 17 00:00:00 2001 From: Fabian Vogt <[email protected]> Date: Tue, 29 Sep 2026 14:33:48 +0200 Subject: [PATCH] disk/i386/pc/biosdisk: Fix retry of CDROM reads Make sure dap->blocks is set again before retries, otherwise the retry may not read the wanted amount of blocks. This caused boot failures if the kernel file was close enough to the end of the .iso file: grub_disk_read_small_real attempted to read past the end of the disk while filling a cache line. The initial read failed, but set dap->blocks = 0, which made the retry succeed, but not actually return data. Fixes: https://bugzilla.opensuse.org/show_bug.cgi?id=1282614 Signed-off-by: Fabian Vogt <[email protected]> Reviewed-by: Michael Chang <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/281> --- grub-core/disk/i386/pc/biosdisk.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/grub-core/disk/i386/pc/biosdisk.c b/grub-core/disk/i386/pc/biosdisk.c index 1d6788950..7a3c5b3bb 100644 --- a/grub-core/disk/i386/pc/biosdisk.c +++ b/grub-core/disk/i386/pc/biosdisk.c @@ -487,8 +487,16 @@ grub_biosdisk_rw (int cmd, grub_disk_t disk, return grub_error (GRUB_ERR_WRITE_ERROR, N_("cannot write to CD-ROM")); for (i = 0; i < GRUB_BIOSDISK_CDROM_RETRY_COUNT; i++) - if (! grub_biosdisk_rw_int13_extensions (0x42, data->drive, dap)) - break; + { + if (! grub_biosdisk_rw_int13_extensions (0x42, data->drive, dap)) + break; + + /* + * The BIOS may have overwritten dap->blocks, e.g. with the number of + * successfully read blocks. Set it again. + */ + dap->blocks = size; + } if (i == GRUB_BIOSDISK_CDROM_RETRY_COUNT) return grub_error (GRUB_ERR_READ_ERROR, N_("failure reading sector 0x%llx " -- 2.55.0 ++++++ 0001-grub-core-sbat.csv.in-Set-vendor_package_name-to-gru.patch ++++++ >From 26d4eb318d3e5048fc666ba086cb9e3f4c0d146d Mon Sep 17 00:00:00 2001 From: Michael Chang <[email protected]> Date: Mon, 7 Sep 2026 18:15:49 +0800 Subject: [PATCH] grub-core/sbat.csv.in: Set vendor_package_name to grub Replace @PACKAGE@ with a fixed "grub" in grub-core/sbat.csv.in. The "vendor_package_name" field is informational metadata. Using a constant value avoids variation from distro's package naming policies (for example, grub vs grub2) and matches SBAT.md examples for upstream GRUB. Signed-off-by: Michael Chang <[email protected]> --- grub-core/sbat.csv.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/grub-core/sbat.csv.in b/grub-core/sbat.csv.in index d5a8be7ea..4776b6ee2 100644 --- a/grub-core/sbat.csv.in +++ b/grub-core/sbat.csv.in @@ -1,2 +1,2 @@ sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md -grub,@GLOBAL_SBAT_LEVEL@,Free Software Foundation,@PACKAGE@,@VERSION@,https://www.gnu.org/software/grub/ +grub,@GLOBAL_SBAT_LEVEL@,Free Software Foundation,grub,@VERSION@,https://www.gnu.org/software/grub/ -- 2.55.0 ++++++ 0001-ieee1275-ofdisk-retry-on-open-and-read-failure.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.775916863 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.779917031 +0200 @@ -24,7 +24,7 @@ --- a/docs/grub.texi +++ b/docs/grub.texi -@@ -3323,6 +3323,7 @@ +@@ -3423,6 +3423,7 @@ * net_default_ip:: * net_default_mac:: * net_default_server:: @@ -32,7 +32,7 @@ * pager:: * prefix:: * pxe_default_server:: -@@ -3783,6 +3784,13 @@ +@@ -3883,6 +3884,13 @@ @xref{Network}. @@ -56,9 +56,9 @@ + +#define RETRY_DEFAULT_TIMEOUT 15 - static char *last_devpath; - static grub_ieee1275_ihandle_t last_ihandle; -@@ -822,7 +825,7 @@ + #define EXTEND_PATH_64 64 + #define EXTEND_PATH_512 512 +@@ -816,7 +819,7 @@ } static grub_err_t @@ -67,7 +67,7 @@ { grub_ieee1275_phandle_t dev; char *devpath; -@@ -918,6 +921,56 @@ +@@ -912,6 +915,56 @@ return 0; } @@ -124,7 +124,7 @@ static void grub_ofdisk_close (grub_disk_t disk) { -@@ -954,7 +1007,7 @@ +@@ -948,7 +1001,7 @@ } static grub_err_t @@ -133,7 +133,7 @@ grub_size_t size, char *buf) { grub_err_t err; -@@ -974,6 +1027,29 @@ +@@ -968,6 +1021,29 @@ } static grub_err_t ++++++ 0001-insmod-ignore-efi_uga-on-EFI.patch ++++++ >From cc02c7c0fbe95ee2726081a2d1b4d44d242e067e Mon Sep 17 00:00:00 2001 From: Michael Chang <[email protected]> Date: Tue, 22 Sep 2026 18:51:24 +0800 Subject: [PATCH] insmod: ignore efi_uga on EFI Silently ignore insmod requests for efi_uga on EFI systems. The module was removed after 2.16, but older generated grub.cfg files may still try to load it. Avoid emitting an error to preserve boot compatibility with existing configurations. --- grub-core/kern/corecmd.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/grub-core/kern/corecmd.c b/grub-core/kern/corecmd.c index 62d434ba9..bde9548bf 100644 --- a/grub-core/kern/corecmd.c +++ b/grub-core/kern/corecmd.c @@ -81,6 +81,15 @@ grub_core_cmd_insmod (struct grub_command *cmd __attribute__ ((unused)), if (argc == 0) return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("one argument expected")); +#ifdef GRUB_MACHINE_EFI + /* + * efi_uga was removed after 2.16; silently ignore insmod requests for it + * so that grub.cfg files generated by older versions won't emit error. + */ + if (grub_strcmp (argv[0], "efi_uga") == 0) + return GRUB_ERR_NONE; +#endif + if (argv[0][0] == '/' || argv[0][0] == '(' || argv[0][0] == '+') mod = grub_dl_load_file (argv[0]); else -- 2.55.0 ++++++ 0001-install-fix-software-raid1-on-esp.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.803918033 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.806918159 +0200 @@ -41,7 +41,7 @@ --- a/grub-core/disk/diskfilter.c +++ b/grub-core/disk/diskfilter.c -@@ -159,8 +159,8 @@ +@@ -161,8 +161,8 @@ for (m = arr->pvs; m; m = m->next) if (m->disk && m->disk->id == disk->id && m->disk->dev->id == disk->dev->id @@ -52,7 +52,7 @@ return 0; } -@@ -1340,19 +1340,23 @@ +@@ -1359,19 +1359,23 @@ ? (grub_memcmp (pv->id.uuid, id->uuid, id->uuidlen) == 0) : (pv->id.id == id->id)) { @@ -83,7 +83,7 @@ #ifdef GRUB_UTIL { -@@ -1369,7 +1373,6 @@ +@@ -1388,7 +1392,6 @@ #endif if (start_sector != (grub_uint64_t)-1) pv->start_sector = start_sector; @@ -91,7 +91,7 @@ /* Add the device to the array. */ for (lv = array->lvs; lv; lv = lv->next) if (!lv->became_readable_at && lv->fullname && is_lv_readable (lv, 0)) -@@ -1457,8 +1460,8 @@ +@@ -1476,8 +1479,8 @@ { if (pv->disk && pv->disk->id == disk->id && pv->disk->dev->id == disk->dev->id @@ -104,7 +104,7 @@ *vg_out = vg; --- a/grub-core/disk/mdraid1x_linux.c +++ b/grub-core/disk/mdraid1x_linux.c -@@ -208,6 +208,9 @@ +@@ -289,6 +289,9 @@ grub_le_to_cpu32 (sb.chunksize), grub_le_to_cpu32 (sb.layout), grub_le_to_cpu32 (sb.level)); @@ -128,7 +128,7 @@ } --- a/grub-core/osdep/unix/platform.c +++ b/grub-core/osdep/unix/platform.c -@@ -132,15 +132,14 @@ +@@ -135,15 +135,14 @@ } int @@ -149,9 +149,9 @@ if (grub_util_exec_redirect_null ((const char * []){ "efibootmgr", "--version", NULL })) { -@@ -158,22 +157,50 @@ - if (ret) - return ret; +@@ -168,22 +167,50 @@ + return 0; + } - char *efidir_part_str = xasprintf ("%d", efidir_part); + for (curdisk = efidir_grub_disk; *curdisk; curdisk++) @@ -208,7 +208,7 @@ + return 0; } - void + --- a/grub-core/osdep/windows/platform.c +++ b/grub-core/osdep/windows/platform.c @@ -204,7 +204,8 @@ @@ -242,7 +242,7 @@ /* Optional. */ --- a/include/grub/util/install.h +++ b/include/grub/util/install.h -@@ -236,9 +236,10 @@ +@@ -239,9 +239,10 @@ grub_install_get_powerpc_secure_boot (void); int @@ -253,11 +253,11 @@ + const char *efi_distributor, + const char *force_disk); - void - grub_install_register_ieee1275 (int is_prep, const char *install_device, + char * + add_multiple_nvme_bootdevices (const char *install_device); --- a/util/grub-install.c +++ b/util/grub-install.c -@@ -1719,6 +1719,40 @@ +@@ -1777,6 +1777,40 @@ } } prefix_drive = xasprintf ("(%s)", grub_drives[0]); @@ -298,7 +298,7 @@ } #ifdef __linux__ -@@ -2258,9 +2292,13 @@ +@@ -2316,9 +2350,13 @@ { /* Try to make this image bootable using the EFI Boot Manager, if available. */ int ret; @@ -314,7 +314,7 @@ if (ret) grub_util_error (_("efibootmgr failed to register the boot entry: %s"), strerror (ret)); -@@ -2314,7 +2352,11 @@ +@@ -2372,7 +2410,11 @@ { char * efifile_path; char * part; @@ -326,7 +326,7 @@ /* Try to make this image bootable using the EFI Boot Manager, if available. */ if (!efi_distributor || efi_distributor[0] == '\0') -@@ -2331,8 +2373,65 @@ +@@ -2389,8 +2431,65 @@ efidir_grub_dev->disk->name, (part ? ",": ""), (part ? : "")); grub_free (part); ++++++ 0001-kern-file-record-file-type-and-track-in-place-verifi.patch ++++++ >From 3eb5bc6b73d4aaf20936e2c732823bcffe6e4330 Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Fri, 21 Aug 2026 09:15:17 +0000 Subject: [PATCH 1/5] kern/file: record file type and track in-place verification In preparation for supporting in-place verification, add the `verify_pending` flag to track files requiring in-place verification, and record the file type when opening a file. Print a warning if a file is closed while in-place verification is still pending. Assisted-by: Claude:claude-opus-5 Gemini:gemini-3.5-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Reviewed-by: Leo Sandoval <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/254> --- grub-core/kern/file.c | 7 +++++++ include/grub/file.h | 26 +++++++++++++++++++++++++- 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/grub-core/kern/file.c b/grub-core/kern/file.c index eb52fd25f..564ab761d 100644 --- a/grub-core/kern/file.c +++ b/grub-core/kern/file.c @@ -139,6 +139,9 @@ grub_file_open (const char *name, enum grub_file_type type) if (!file) grub_file_close (last_file); + if (file) + file->type = type; + return file; fail: @@ -201,6 +204,10 @@ grub_file_read (grub_file_t file, void *buf, grub_size_t len) grub_err_t grub_file_close (grub_file_t file) { + if (file->verify_pending) + grub_dprintf ("verify", "file %s closed without grub_verify_in_place() " + "being called\n", file->name); + if (file->fs->fs_close) (file->fs->fs_close) (file); diff --git a/include/grub/file.h b/include/grub/file.h index d51834e6a..b77622f7b 100644 --- a/include/grub/file.h +++ b/include/grub/file.h @@ -140,7 +140,20 @@ enum grub_file_type /* --skip-sig is specified. */ GRUB_FILE_TYPE_SKIP_SIGNATURE = 0x10000, - GRUB_FILE_TYPE_NO_DECOMPRESS = 0x20000 + GRUB_FILE_TYPE_NO_DECOMPRESS = 0x20000, + /* + * The caller loads the file to its final location itself and calls + * grub_verify_in_place() on it afterwards. Verifiers which can work on + * that buffer (measurement) are left to that call, so that the file does + * not have to be kept in memory twice. Verifiers which decide whether the + * file may be used at all still run at grub_file_open() time. + * + * Must be combined with GRUB_FILE_TYPE_NO_DECOMPRESS: the verify filter + * runs before compression filters, so without it grub_verifiers_open() + * and grub_verify_in_place() would hash different bytes (compressed vs. + * decompressed). grub_verifiers_open() enforces this combination. + */ + GRUB_FILE_TYPE_VERIFY_IN_PLACE = 0x40000 }; /* File description. */ @@ -170,6 +183,17 @@ struct grub_file /* If file is not easily seekable. Should be set by underlying layer. */ int not_easily_seekable; + /* The type this file was opened with, as passed to grub_file_open(). */ + enum grub_file_type type; + + /* + * Set by grub_verifiers_open() when GRUB_FILE_TYPE_VERIFY_IN_PLACE caused + * one or more in_place verifiers to be deferred to grub_verify_in_place(). + * Cleared by grub_verify_in_place(). grub_file_close() logs a debug message + * if still set, indicating the caller forgot to call grub_verify_in_place(). + */ + int verify_pending; + /* Filesystem-specific data. */ void *data; -- 2.51.0 ++++++ 0001-mkconfig-Determine-GRUB_DISTRIBUTOR-from-etc-SUSE-br.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.846919830 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.848919913 +0200 @@ -12,13 +12,11 @@ util/grub-mkconfig.in | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) -diff --git a/util/grub-mkconfig.in b/util/grub-mkconfig.in -index 31c4851aee..e11835ad69 100644 --- a/util/grub-mkconfig.in +++ b/util/grub-mkconfig.in -@@ -226,6 +226,17 @@ GRUB_ACTUAL_DEFAULT="$GRUB_DEFAULT" - - if [ "x${GRUB_ACTUAL_DEFAULT}" = "xsaved" ] ; then GRUB_ACTUAL_DEFAULT="`"${grub_editenv}" - list | sed -n '/^saved_entry=/ s,^saved_entry=,,p'`" ; fi +@@ -241,6 +241,17 @@ + if [ "x${GRUB_ADVANCED_ACCESS_LEVEL}" = "x" ] ; then GRUB_ADVANCED_ACCESS_LEVEL="0" ; fi + if [ "x${GRUB_RECOVERY_ACCESS_LEVEL}" = "x" ] ; then GRUB_RECOVERY_ACCESS_LEVEL="0" ; fi +# Use /etc/SUSE-brand for os label (bsc#1239169) +grub_os_id () ( @@ -34,7 +32,7 @@ if [ x"${GRUB_DISTRIBUTOR}" = x ] ; then for i in "${sysconfdir}/os-release" "/usr/lib/os-release" ; do if [ -f "$i" ] ; then -@@ -233,7 +244,12 @@ if [ x"${GRUB_DISTRIBUTOR}" = x ] ; then +@@ -248,7 +259,12 @@ break fi done @@ -48,7 +46,4 @@ GRUB_DISTRIBUTOR="${NAME} ${VERSION}" else GRUB_DISTRIBUTOR="${NAME}" --- -2.49.0 - ++++++ 0001-ofdisk-Enhance-canonical-path-handling-for-bootpath.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.859920373 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.862920498 +0200 @@ -25,7 +25,7 @@ --- a/grub-core/disk/ieee1275/ofdisk.c +++ b/grub-core/disk/ieee1275/ofdisk.c -@@ -36,8 +36,13 @@ +@@ -40,8 +40,13 @@ #define IEEE1275_DISK_ALIAS "/disk@" #define IEEE1275_NVMEOF_DISK_ALIAS "/nvme-of/controller@" @@ -39,47 +39,47 @@ static int is_boot_nvmeof; struct ofdisk_hash_ent -@@ -554,20 +559,30 @@ +@@ -550,20 +555,30 @@ { if (grub_strcmp (alias->type, "fcp") == 0) - { -- if (boot_type && -- grub_strcmp (boot_type, alias->type) != 0) -+ if (boot_parent && -+ grub_strcmp (boot_parent, alias->path) != 0) - { -- grub_dprintf ("ofdisk", "Skipped device: %s, type %s did not match boot_type %s\n", -- alias->path, alias->type, boot_type); -+ grub_dprintf ("ofdisk", "Skipped device: %s, doesn't match boot_parent %s\n", -+ alias->path, boot_parent); - goto iter_children; - } - -- if (grub_strcmp (boot_parent, alias->path) == 0) -+ /* Allow set boot_parent and boot_type to NULL to force iteration */ -+ if (!boot_parent) - { -- if (is_boot_nvmeof) -- dev_iterate_fcp_nvmeof(alias); -- else -- dev_iterate_fcp_disks(alias); -+ grub_dprintf ("ofdisk", "iterate %s\n", alias->path); -+ dev_iterate_fcp_nvmeof(alias); -+ dev_iterate_fcp_disks(alias); -+ } -+ else if (is_boot_nvmeof) -+ { -+ grub_dprintf ("ofdisk", "iterate nvmeof: %s\n", alias->path); -+ dev_iterate_fcp_nvmeof(alias); -+ } -+ else -+ { -+ grub_dprintf ("ofdisk", "iterate fcp: %s\n", alias->path); -+ dev_iterate_fcp_disks(alias); - } - } + { +- if (boot_type && +- grub_strcmp (boot_type, alias->type) != 0) ++ if (boot_parent && ++ grub_strcmp (boot_parent, alias->path) != 0) + { +- grub_dprintf ("ofdisk", "Skipped device: %s, type %s did not match boot_type %s\n", +- alias->path, alias->type, boot_type); ++ grub_dprintf ("ofdisk", "Skipped device: %s, doesn't match boot_parent %s\n", ++ alias->path, boot_parent); + goto iter_children; + } + +- if (grub_strcmp (boot_parent, alias->path) == 0) ++ /* Allow set boot_parent and boot_type to NULL to force iteration */ ++ if (!boot_parent) ++ { ++ grub_dprintf ("ofdisk", "iterate %s\n", alias->path); ++ dev_iterate_fcp_nvmeof(alias); ++ dev_iterate_fcp_disks(alias); ++ } ++ else if (is_boot_nvmeof) ++ { ++ grub_dprintf ("ofdisk", "iterate nvmeof: %s\n", alias->path); ++ dev_iterate_fcp_nvmeof(alias); ++ } ++ else + { +- if (is_boot_nvmeof) +- dev_iterate_fcp_nvmeof(alias); +- else +- dev_iterate_fcp_disks(alias); ++ grub_dprintf ("ofdisk", "iterate fcp: %s\n", alias->path); ++ dev_iterate_fcp_disks(alias); + } + } else if (grub_strcmp (alias->type, "vscsi") == 0) -@@ -590,9 +605,8 @@ +@@ -586,9 +601,8 @@ if (boot_type && grub_strcmp (boot_type, alias->type) != 0) { @@ -90,7 +90,7 @@ } if (grub_ieee1275_open (alias->path, &ihandle)) -@@ -672,9 +686,8 @@ +@@ -668,9 +682,8 @@ if (boot_type && grub_strcmp (boot_type, alias->type) != 0) { @@ -101,7 +101,7 @@ } if (grub_add (grub_strlen (alias->path), sizeof ("/disk@7766554433221100"), &sz)) -@@ -1155,13 +1168,37 @@ +@@ -1151,13 +1164,37 @@ return parent; } @@ -142,7 +142,7 @@ if (!canon) { -@@ -1170,8 +1207,6 @@ +@@ -1166,8 +1203,6 @@ grub_print_error (); return NULL; } @@ -151,7 +151,7 @@ parent = get_parent_devname (canon, is_nvmeof); early_log ("%s is parent of %s\n", parent, canon); -@@ -1225,9 +1260,9 @@ +@@ -1221,9 +1256,9 @@ boot_parent = get_boot_device_parent (bootpath, &is_boot_nvmeof); boot_type = grub_ieee1275_get_device_type (boot_parent); if (boot_type) ++++++ 0001-ofdisk-enhance-boot-time-by-focusing-on-boot-disk-re.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.874921000 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.877921125 +0200 @@ -37,7 +37,7 @@ --- a/grub-core/disk/ieee1275/ofdisk.c +++ b/grub-core/disk/ieee1275/ofdisk.c -@@ -32,6 +32,13 @@ +@@ -36,6 +36,13 @@ static char *last_devpath; static grub_ieee1275_ihandle_t last_ihandle; @@ -51,34 +51,33 @@ struct ofdisk_hash_ent { char *devpath; -@@ -543,12 +550,21 @@ +@@ -539,10 +546,21 @@ { if (grub_strcmp (alias->type, "fcp") == 0) - { -- // Iterate disks -- dev_iterate_fcp_disks(alias); -- -- // Iterate NVMeoF -- dev_iterate_fcp_nvmeof(alias); -+ if (boot_type && -+ grub_strcmp (boot_type, alias->type) != 0) -+ { -+ grub_dprintf ("ofdisk", "Skipped device: %s, type %s did not match boot_type %s\n", -+ alias->path, alias->type, boot_type); -+ goto iter_children; -+ } - -+ if (grub_strcmp (boot_parent, alias->path) == 0) -+ { -+ if (is_boot_nvmeof) -+ dev_iterate_fcp_nvmeof(alias); -+ else -+ dev_iterate_fcp_disks(alias); -+ } - } + { +- /* Iterate disks */ +- dev_iterate_fcp_disks (alias); +- /* Iterate NVMeoF */ +- dev_iterate_fcp_nvmeof (alias); ++ if (boot_type && ++ grub_strcmp (boot_type, alias->type) != 0) ++ { ++ grub_dprintf ("ofdisk", "Skipped device: %s, type %s did not match boot_type %s\n", ++ alias->path, alias->type, boot_type); ++ goto iter_children; ++ } ++ ++ if (grub_strcmp (boot_parent, alias->path) == 0) ++ { ++ if (is_boot_nvmeof) ++ dev_iterate_fcp_nvmeof(alias); ++ else ++ dev_iterate_fcp_disks(alias); ++ } + } else if (grub_strcmp (alias->type, "vscsi") == 0) { -@@ -567,6 +583,14 @@ +@@ -561,6 +579,14 @@ unsigned i; grub_size_t sz; @@ -93,7 +92,7 @@ if (grub_ieee1275_open (alias->path, &ihandle)) return; -@@ -641,6 +665,14 @@ +@@ -635,6 +661,14 @@ grub_ieee1275_ihandle_t ihandle; grub_size_t sz; @@ -108,7 +107,7 @@ if (grub_add (grub_strlen (alias->path), sizeof ("/disk@7766554433221100"), &sz)) { grub_error (GRUB_ERR_OUT_OF_RANGE, "overflow detected while creating buffer for sas_ioa"); -@@ -705,6 +737,7 @@ +@@ -699,6 +733,7 @@ return; } @@ -116,7 +115,7 @@ { struct grub_ieee1275_devalias child; -@@ -1081,6 +1114,68 @@ +@@ -1075,6 +1110,68 @@ .next = 0 }; @@ -185,7 +184,7 @@ static void insert_bootpath (void) { -@@ -1123,6 +1218,12 @@ +@@ -1117,6 +1214,12 @@ char *device = grub_ieee1275_get_devname (bootpath); op = ofdisk_hash_add (device, NULL); op->is_boot = 1; @@ -198,7 +197,7 @@ } grub_free (type); grub_free (bootpath); -@@ -1139,12 +1240,37 @@ +@@ -1133,12 +1236,37 @@ grub_disk_dev_unregister (&grub_ofdisk_dev); } ++++++ 0001-openfw-Ensure-get_devargs-and-get_devname-functions-.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.893921794 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.896921919 +0200 @@ -20,21 +20,12 @@ grub-core/kern/ieee1275/openfw.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) -diff --git a/grub-core/kern/ieee1275/openfw.c b/grub-core/kern/ieee1275/openfw.c -index e2ffec32d..3bbd07d95 100644 --- a/grub-core/kern/ieee1275/openfw.c +++ b/grub-core/kern/ieee1275/openfw.c -@@ -354,13 +354,16 @@ static char * - grub_ieee1275_get_devargs (const char *path) +@@ -360,6 +360,16 @@ { - char *colon = grub_strchr (path, ':'); -- char *colon_check = colon; + char *colon = grub_strrchr (path, ':'); -- /* Find the last occurence of colon */ -- while(colon_check){ -- colon = colon_check; -- colon_check = grub_strchr (colon+1, ':'); -- } + /* Use the same logic in grub_ieee1275_get_devname for nvme-of arguments */ + if (grub_strstr(path, "nvme-of")) + { @@ -44,10 +35,8 @@ + else + colon = NULL; + } - ++ if (! colon) return 0; --- -2.39.2 - + ++++++ 0002-ieee1275-powerpc-enables-device-mapper-discovery.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:51.967924886 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:51.970925011 +0200 @@ -21,15 +21,7 @@ --- a/grub-core/osdep/linux/ofpath.c +++ b/grub-core/osdep/linux/ofpath.c -@@ -37,6 +37,7 @@ - #include <fcntl.h> - #include <errno.h> - #include <ctype.h> -+#include <dirent.h> - - #ifdef __sparc__ - typedef enum -@@ -757,13 +758,74 @@ +@@ -1205,13 +1205,74 @@ return new; } ++++++ 0002-verifiers-support-in-place-verification.patch ++++++ >From 808af0e115ce24ce17105428a9f90fbe63f0acae Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Fri, 21 Aug 2026 09:15:17 +0000 Subject: [PATCH 2/5] verifiers: support in-place verification By design, the verifiers framework stores and verifies the full file in a private buffer when opening a file, then copies the data to the caller's buffer during reads. This guarantees that unverified data never reaches the caller's buffer. However, this behavior doubles memory usage. As initrd sizes grow, some systems encounter out-of-memory (OOM) errors during loading. To mitigate OOM errors, introduce in-place verification to the verifiers framework. This allows callers to verify files directly within their own buffers, avoiding redundant allocations. Add the `in_place` field to `struct grub_file_verifier` so a verifier can mark itself as in-place-capable. Introduce `grub_verify_in_place()` to run in-place-capable verifiers over a buffer into which the file has already been loaded. When a file is opened with `GRUB_FILE_TYPE_VERIFY_IN_PLACE`, verifiers with `in_place = true` are skipped during opening. Once the file is fully read, the caller is responsible for invoking `grub_verify_in_place()`. If all verifiers registered for the file are in-place-capable, allocating the private buffer is skipped entirely, reducing peak memory usage. Note that if any non-in-place-capable verifier is registered for the file, the private buffer will still be allocated, leaving memory usage unchanged. Assisted-by: Claude:claude-opus-5 Gemini:gemini-3.5-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Reviewed-by: Leo Sandoval <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/254> --- grub-core/kern/verifiers.c | 159 +++++++++++++++++++++++++++++++++++-- include/grub/verify.h | 18 +++++ 2 files changed, 169 insertions(+), 8 deletions(-) diff --git a/grub-core/kern/verifiers.c b/grub-core/kern/verifiers.c index 75d7994cf..89732427f 100644 --- a/grub-core/kern/verifiers.c +++ b/grub-core/kern/verifiers.c @@ -75,6 +75,32 @@ struct grub_fs verified_fs = .fs_close = verified_close }; +/* + * Files which are exempt from verification altogether, no matter which + * verifiers are registered. Shared by grub_verifiers_open() and + * grub_verify_in_place() so that both entry points agree on the exemptions. + */ +static bool +grub_verifiers_exempt (grub_file_t io, enum grub_file_type type) +{ + if ((type & GRUB_FILE_TYPE_MASK) == GRUB_FILE_TYPE_SIGNATURE + || (type & GRUB_FILE_TYPE_MASK) == GRUB_FILE_TYPE_VERIFY_SIGNATURE + || (type & GRUB_FILE_TYPE_SKIP_SIGNATURE)) + return true; + + /* + * Files read from a memdisk are embedded in the (already verified) GRUB + * image and files read from procfs are generated by GRUB itself. Neither + * has a detached signature to check. + */ + if (io->device && io->device->disk && + (io->device->disk->dev->id == GRUB_DISK_DEVICE_MEMDISK_ID + || io->device->disk->dev->id == GRUB_DISK_DEVICE_PROCFS_ID)) + return true; + + return false; +} + static grub_file_t grub_verifiers_open (grub_file_t io, enum grub_file_type type) { @@ -84,22 +110,42 @@ grub_verifiers_open (grub_file_t io, enum grub_file_type type) grub_file_t ret = 0; grub_err_t err; int defer = 0; + bool in_place = (type & GRUB_FILE_TYPE_VERIFY_IN_PLACE) != 0; + bool verify_pending = false; - grub_dprintf ("verify", "file: %s type: %d\n", io->name, type); - if ((type & GRUB_FILE_TYPE_MASK) == GRUB_FILE_TYPE_SIGNATURE - || (type & GRUB_FILE_TYPE_MASK) == GRUB_FILE_TYPE_VERIFY_SIGNATURE - || (type & GRUB_FILE_TYPE_SKIP_SIGNATURE)) - return io; + /* + * VERIFY_IN_PLACE requires NO_DECOMPRESS: the verify filter runs before + * compression filters (GRUB_FILE_FILTER_VERIFY = 0), so without it + * grub_verifiers_open() would hash compressed bytes at open time while + * grub_verify_in_place() hashes decompressed bytes from the loaded buffer. + */ + if (in_place && !(type & GRUB_FILE_TYPE_NO_DECOMPRESS)) + { + grub_error (GRUB_ERR_BAD_ARGUMENT, + "GRUB_FILE_TYPE_VERIFY_IN_PLACE requires GRUB_FILE_TYPE_NO_DECOMPRESS"); + return NULL; + } - if (io->device->disk && - (io->device->disk->dev->id == GRUB_DISK_DEVICE_MEMDISK_ID - || io->device->disk->dev->id == GRUB_DISK_DEVICE_PROCFS_ID)) + grub_dprintf ("verify", "file: %s type: %d\n", io->name, type); + + if (grub_verifiers_exempt (io, type)) return io; FOR_LIST_ELEMENTS(ver, grub_file_verifiers) { enum grub_verify_flags flags = 0; + + /* + * Run the verification in grub_verify_in_place() if both the caller + * and the verifier agree so. + */ + if (in_place && ver->in_place) + { + verify_pending = true; + continue; + } + err = ver->init (io, type, &context, &flags); if (err) goto fail_noclose; @@ -114,6 +160,10 @@ grub_verifiers_open (grub_file_t io, enum grub_file_type type) if (!ver) { + /* + * Note that an in-place verifier cannot satisfy a deferral: it only + * measures the file, it does not decide whether the file is allowed. + */ if (defer) { grub_error (GRUB_ERR_ACCESS_DENIED, @@ -121,6 +171,9 @@ grub_verifiers_open (grub_file_t io, enum grub_file_type type) goto fail_noclose; } + if (verify_pending) + io->verify_pending = 1; + /* No verifiers wanted to verify. Just return underlying file. */ return io; } @@ -172,6 +225,17 @@ grub_verifiers_open (grub_file_t io, enum grub_file_type type) FOR_LIST_ELEMENTS_NEXT(ver, grub_file_verifiers) { enum grub_verify_flags flags = 0; + + /* + * Run the verification in grub_verify_in_place() if both the caller + * and the verifier agree so. + */ + if (in_place && ver->in_place) + { + verify_pending = true; + continue; + } + err = ver->init (io, type, &context, &flags); if (err) goto fail_noclose; @@ -193,6 +257,8 @@ grub_verifiers_open (grub_file_t io, enum grub_file_type type) verified->file = io; ret->data = verified; + if (verify_pending) + ret->verify_pending = 1; return ret; fail: @@ -226,3 +292,80 @@ grub_verifiers_init (void) { grub_file_filter_register (GRUB_FILE_FILTER_VERIFY, grub_verifiers_open); } + +/* + * Run the in-place capable verifiers over a buffer the file has already been + * loaded into, for files opened with GRUB_FILE_TYPE_VERIFY_IN_PLACE. + * + * Only verifiers with in_place set are run here. Everything which decides + * whether the file may be used has already run in grub_verifiers_open(), + * because this call can happen arbitrarily late - on the EFI LoadFile2 path + * the Linux EFI stub asks for the initrd after the kernel has been started, + * so a failure here can no longer stop the boot, it can only make the stub + * give up. For the same reason the resulting measurement lands in the event + * log after the kernel's own PCR 4 measurement rather than before it. + */ +grub_err_t +grub_verify_in_place (grub_file_t io, void *buf, grub_size_t size) +{ + struct grub_file_verifier *ver; + grub_err_t err = GRUB_ERR_NONE; + + if ((io->type & GRUB_FILE_TYPE_VERIFY_IN_PLACE) == 0) + return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("in-place verification not requested: %s"), + io->name); + + grub_dprintf ("verify", "in-place file: %s type: %d size: %" PRIuGRUB_SIZE "\n", + io->name, io->type, size); + + if (grub_verifiers_exempt (io, io->type)) + return GRUB_ERR_NONE; + + if (!io->verify_pending) + grub_dprintf ("verify", "file %s: grub_verify_in_place() called twice, " + "or no in-place verifiers registered\n", io->name); + io->verify_pending = 0; + + FOR_LIST_ELEMENTS(ver, grub_file_verifiers) + { + void *context = NULL; + enum grub_verify_flags flags = 0; + + if (!ver->in_place) + continue; + + err = ver->init (io, io->type, &context, &flags); + if (err) + return err; + + /* + * A DEFER_AUTH request is answered in grub_verifiers_open(), which is + * the only place seeing every verifier. Measuring the file here does + * not authenticate it, so there is nothing to do about it here. + */ + if (flags & (GRUB_VERIFY_FLAGS_SKIP_VERIFICATION + | GRUB_VERIFY_FLAGS_DEFER_AUTH)) + { + if (ver->close) + ver->close (context); + continue; + } + + if (ver->write == NULL) + err = grub_error (GRUB_ERR_BAD_ARGUMENT, + "verifier `%s' has no write method", ver->name); + else + err = ver->write (context, buf, size); + + if (err == GRUB_ERR_NONE && ver->fini) + err = ver->fini (context); + + if (ver->close) + ver->close (context); + + if (err != GRUB_ERR_NONE) + return err; + } + + return GRUB_ERR_NONE; +} diff --git a/include/grub/verify.h b/include/grub/verify.h index 672ae1692..f700e9b5d 100644 --- a/include/grub/verify.h +++ b/include/grub/verify.h @@ -45,6 +45,21 @@ struct grub_file_verifier const char *name; + /* + * Set if this verifier measures a file rather than authenticating it, and + * is therefore able to work on the buffer the file has already been loaded + * into. For files opened with GRUB_FILE_TYPE_VERIFY_IN_PLACE such a + * verifier is not run by grub_verifiers_open() but by the caller's later + * grub_verify_in_place() call, which saves keeping a second copy of the + * file around just to hash it. + * + * Verifiers which decide whether a file may be used at all must leave this + * unset: they have to run while grub_file_open() is still the enforcement + * point, as the in-place call may happen much later - on the EFI LoadFile2 + * path it happens after the kernel has been started. + */ + bool in_place; + /* * Check if file needs to be verified and set up context. * init/read/fini is structured in the same way as hash interface. @@ -85,4 +100,7 @@ grub_verifier_unregister (struct grub_file_verifier *ver) extern grub_err_t EXPORT_FUNC (grub_verify_string) (char *str, enum grub_verify_string_type type); +extern grub_err_t +EXPORT_FUNC (grub_verify_in_place) (grub_file_t io, void *buf, grub_size_t size); + #endif /* ! GRUB_VERIFY_HEADER */ -- 2.51.0 ++++++ 0003-grub-install-support-prep-environment-block.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.020927100 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.025927309 +0200 @@ -29,16 +29,15 @@ --- a/include/grub/lib/envblk.h +++ b/include/grub/lib/envblk.h -@@ -24,6 +24,9 @@ - +@@ -25,6 +25,8 @@ #ifndef ASM_FILE + #include <grub/types.h> +#include <grub/disk.h> +#define GRUB_ENVBLK_PREP_SIZE (GRUB_DISK_SECTOR_SIZE << 3) -+ + struct grub_envblk { - char *buf; --- a/util/grub-install.c +++ b/util/grub-install.c @@ -43,6 +43,7 @@ @@ -91,7 +90,7 @@ static int is_same_disk (const char *a, const char *b) { -@@ -2138,6 +2174,43 @@ +@@ -2147,6 +2183,43 @@ if (write_to_disk (ins_dev, imgfile)) grub_util_error ("%s", _("failed to copy Grub to the PReP partition")); grub_set_install_backup_ponr (); ++++++ 0003-tpm-tpcm-mark-TPM-and-TPCM-verifiers-as-in-place-cap.patch ++++++ >From e696b603427a3fb6685c821fd519293e78ffc5db Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Fri, 21 Aug 2026 09:15:17 +0000 Subject: [PATCH 3/5] tpm/tpcm: mark TPM and TPCM verifiers as in-place capable Set the `in_place` member to true for TPM and TPCM verifiers so that they are deferred to `grub_verify_in_place()` rather than running in `grub_verifiers_open()`. Assisted-by: Claude:claude-opus-5 Gemini:gemini-3.5-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Reviewed-by: Leo Sandoval <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/254> --- grub-core/commands/tpcm.c | 2 ++ grub-core/commands/tpm.c | 2 ++ 2 files changed, 4 insertions(+) diff --git a/grub-core/commands/tpcm.c b/grub-core/commands/tpcm.c index 82fd6cc25..f6c2f108e 100644 --- a/grub-core/commands/tpcm.c +++ b/grub-core/commands/tpcm.c @@ -96,6 +96,8 @@ grub_tpcm_verify_string (char *str, enum grub_verify_string_type type) struct grub_file_verifier grub_tpcm_verifier = { .name = "tpcm", + /* Measurement only, so it can run on the final buffer. */ + .in_place = true, .init = grub_tpcm_verify_init, .write = grub_tpcm_verify_write, .close = grub_tpcm_verify_close, diff --git a/grub-core/commands/tpm.c b/grub-core/commands/tpm.c index 3cbd464ee..187d7e90a 100644 --- a/grub-core/commands/tpm.c +++ b/grub-core/commands/tpm.c @@ -125,6 +125,8 @@ grub_tpm_verify_string (char *str, enum grub_verify_string_type type) struct grub_file_verifier grub_tpm_verifier = { .name = "tpm", + /* Measurement only, so it can run on the final buffer. */ + .in_place = true, .init = grub_tpm_verify_init, .write = grub_tpm_verify_write, .verify_string = grub_tpm_verify_string, -- 2.51.0 ++++++ 0004-Try-to-pick-better-locations-for-kernel-and-initrd.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.059928730 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.063928897 +0200 @@ -35,7 +35,7 @@ --- a/grub-core/kern/efi/mm.c +++ b/grub-core/kern/efi/mm.c -@@ -121,7 +121,7 @@ +@@ -123,7 +123,7 @@ grub_efi_boot_services_t *b; grub_efi_physical_address_t address = max; @@ -44,7 +44,7 @@ return 0; b = grub_efi_system_table->boot_services; -@@ -481,7 +481,7 @@ +@@ -499,7 +499,7 @@ { if (desc->type == GRUB_EFI_CONVENTIONAL_MEMORY #if 1 @@ -53,7 +53,7 @@ #endif && desc->physical_start + PAGES_TO_BYTES (desc->num_pages) > 0x100000 && desc->num_pages != 0) -@@ -499,9 +499,9 @@ +@@ -517,9 +517,9 @@ #if 1 if (BYTES_TO_PAGES (filtered_desc->physical_start) + filtered_desc->num_pages @@ -144,7 +144,7 @@ @@ -2,5 +2,6 @@ #include <grub/efi/memory.h> - #define GRUB_EFI_MAX_USABLE_ADDRESS 0xffffffffffffULL + #define GRUB_EFI_MAX_USABLE_ADDRESS 0xffffffff +#define GRUB_EFI_MAX_ALLOCATION_ADDRESS GRUB_EFI_MAX_USABLE_ADDRESS #endif /* ! GRUB_MEMORY_CPU_HEADER */ ++++++ 0004-loader-linux-measure-initrd-in-place.patch ++++++ >From 7b449f34f4bb7725c740810a53cd814a0f46ba3d Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Fri, 21 Aug 2026 09:15:17 +0000 Subject: [PATCH 4/5] loader/linux: measure initrd in place Open initrd files with `GRUB_FILE_TYPE_VERIFY_IN_PLACE` and call `grub_verify_in_place()` over the loaded buffer. This avoids keeping a second copy of the file in memory solely for measurement, reducing peak memory usage for large initrds. Additionally, clean up target memory if verification fails. NOTE: When the PGP verifier is used, the initrd file may still be verified during `grub_file_open()`, triggering the creation of an additional private buffer within the verifiers framework. In this case, memory reduction will not occur. Assisted-by: Claude:claude-opus-5 Gemini:gemini-3.5-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Reviewed-by: Leo Sandoval <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/254> --- grub-core/loader/linux.c | 47 +++++++++++++++++++++++++++++++++++----- 1 file changed, 41 insertions(+), 6 deletions(-) diff --git a/grub-core/loader/linux.c b/grub-core/loader/linux.c index 56bc1be58..143291e56 100644 --- a/grub-core/loader/linux.c +++ b/grub-core/loader/linux.c @@ -5,6 +5,7 @@ #include <grub/file.h> #include <grub/mm.h> #include <grub/safemath.h> +#include <grub/verify.h> struct newc_head { @@ -227,7 +228,8 @@ grub_initrd_init (int argc, char *argv[], } initrd_ctx->components[i].file = grub_file_open (fname, GRUB_FILE_TYPE_LINUX_INITRD - | GRUB_FILE_TYPE_NO_DECOMPRESS); + | GRUB_FILE_TYPE_NO_DECOMPRESS + | GRUB_FILE_TYPE_VERIFY_IN_PLACE); if (!initrd_ctx->components[i].file) { grub_initrd_close (initrd_ctx); @@ -291,6 +293,7 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, int newc = 0; struct dir *root = 0; grub_ssize_t cursize = 0; + grub_err_t status; for (i = 0; i < initrd_ctx->nfiles; i++) { @@ -304,9 +307,8 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, if (insert_dir (initrd_ctx->components[i].newc_name, &root, ptr, &dir_size)) { - free_dir (root); - grub_initrd_close (initrd_ctx); - return grub_errno; + status = grub_errno; + goto fail; } ptr += dir_size; ptr = make_header (ptr, initrd_ctx->components[i].newc_name, @@ -331,9 +333,26 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, if (!grub_errno) grub_error (GRUB_ERR_FILE_READ_ERROR, N_("premature end of file %s"), initrd_ctx->components[i].file->name); - grub_initrd_close (initrd_ctx); - return grub_errno; + status = grub_errno; + goto fail; + } + + /* + * Measure the buffer the kernel is actually going to consume. The + * verifiers which authenticate the file already ran when it was opened + * by grub_initrd_init(), which matters because on the EFI LoadFile2 + * path we are called from the Linux EFI stub, i.e. after the kernel has + * been started. + */ + status = grub_verify_in_place (initrd_ctx->components[i].file, ptr, cursize); + if (status != GRUB_ERR_NONE) + { + if (grub_errno == GRUB_ERR_NONE) + grub_error (status, N_("in-place verification failed: %s"), + initrd_ctx->components[i].file->name); + goto fail; } + ptr += cursize; } if (newc) @@ -345,4 +364,20 @@ grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, free_dir (root); root = 0; return GRUB_ERR_NONE; + + fail: + /* + * The target is the memory the kernel is going to consume: EFI loader pages + * or, on the LoadFile2 path, a buffer owned by the Linux EFI stub. Anything + * copied there so far is unverified - either it was never measured or, if + * grub_verify_in_place() is what failed, it was measured and rejected - so + * do not leave it behind for whoever gets these pages next. Wipe the whole + * region, not just the last component, since earlier components are just as + * stale once the load is abandoned. + */ + grub_memset (target, 0, initrd_ctx->size); + free_dir (root); + root = 0; + grub_initrd_close (initrd_ctx); + return status; } -- 2.51.0 ++++++ 0005-docs-grub-dev.texi-Document-in-place-verification.patch ++++++ >From 0ec84e5e4ce2604726bf1ec7a972d846a005f111 Mon Sep 17 00:00:00 2001 From: Gary Lin <[email protected]> Date: Tue, 1 Sep 2026 07:36:15 +0000 Subject: [PATCH 5/5] docs/grub-dev.texi: Document in-place verification Add the documentation of in-place verification to verifiers framework. Assisted-by: Gemini:gemini-3.5-flash Signed-off-by: Gary Lin <[email protected]> Reviewed-by: Avnish Chouhan <[email protected]> Reviewed-by: Leo Sandoval <[email protected]> Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/254> --- docs/grub-dev.texi | 53 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/docs/grub-dev.texi b/docs/grub-dev.texi index d7e2ec919..2fc4121c0 100644 --- a/docs/grub-dev.texi +++ b/docs/grub-dev.texi @@ -2487,6 +2487,59 @@ Optionally at the end of the file @samp{fini}, if it exists, is called with just the context. If you return no error during any of @samp{init}, @samp{write} and @samp{fini} then the file is considered as having succeded verification. +@heading In-place Verification and Measurement + +By default, the verifier framework copies every opened file into a private heap +buffer, runs the verifiers on that copy, and then serves all subsequent reads +from it. This ensures that unverified data never reaches its final destination, +preventing Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities. However, for +large files like an @samp{initrd} (often tens or hundreds of megabytes), this +doubled the peak memory usage, since both the verifier framework and the bootloader +kept separate copies of the file in memory. + +For verifiers that do not gate or authenticate the boot process (such as +measurement-style verifiers like TPM and TPCM), it is safe to run verification +directly on the loaded buffer inside the caller's memory, avoiding the need for +a private copy. + +To support this optimization, the verifier structure @code{struct grub_file_verifier} +has a boolean member @code{in_place}: + +@itemize +@item @code{in_place} +Should be set to @code{true} if the verifier only measures or hashes the file (like TPM +or TPCM) rather than deciding whether the file is allowed to be loaded or run. Gating or +authenticating verifiers (e.g., PGP, @samp{shim_lock}, or @samp{appendedsig}) @strong{must} +leave this field set to @code{false}. +@end itemize + +When a bootloader or loader wants to verify a file in place, it must use the following +procedure: + +@enumerate +@item Open the file with @code{grub_file_open()} using the type flag +@code{GRUB_FILE_TYPE_VERIFY_IN_PLACE}. This flag @strong{must} be combined with +@code{GRUB_FILE_TYPE_NO_DECOMPRESS}. + +@item If all registered and active verifiers are marked as @code{in_place}, the verifiers +framework defers verification during the open stage and sets the tracking field +@code{verify_pending} on the @code{grub_file_t} structure. + +@item If even one active verifier does not support @code{in_place}, the framework +automatically falls back to normal open-time verification and reads the entire file +into a private buffer. + +@item The loader must allocate the destination buffer, read or load the file into it, +and then execute the deferred verification by calling: +@code{grub_verify_in_place (file, buf, size)} +before the file is closed. This function executes all deferred in-place verifiers +on the loaded buffer and clears the @code{verify_pending} field. + +@item If the file is closed via @code{grub_file_close()} while @code{verify_pending} +is still set to @code{1}, a warning is logged to the @samp{verify} debug stream, indicating +that the loader forgot to call @code{grub_verify_in_place()}. +@end enumerate + @node Lockdown framework @chapter Lockdown framework -- 2.51.0 ++++++ 0009-Add-crypttab_entry-to-obviate-the-need-to-input-pass.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.142932198 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.145932324 +0200 @@ -29,9 +29,11 @@ 5 files changed, 193 insertions(+), 5 deletions(-) create mode 100644 grub-core/commands/crypttab.c ---- a/grub-core/Makefile.core.def -+++ b/grub-core/Makefile.core.def -@@ -2802,3 +2802,8 @@ +Index: grub-2.16/grub-core/Makefile.core.def +=================================================================== +--- grub-2.16.orig/grub-core/Makefile.core.def ++++ grub-2.16/grub-core/Makefile.core.def +@@ -2906,3 +2906,8 @@ module = { cflags = '$(CFLAGS_POSIX) $(CFLAGS_GNULIB)'; cppflags = '$(CPPFLAGS_POSIX) $(CPPFLAGS_GNULIB)'; }; @@ -40,8 +42,10 @@ + name = crypttab; + common = commands/crypttab.c; +}; +Index: grub-2.16/grub-core/commands/crypttab.c +=================================================================== --- /dev/null -+++ b/grub-core/commands/crypttab.c ++++ grub-2.16/grub-core/commands/crypttab.c @@ -0,0 +1,47 @@ + +#include <grub/dl.h> @@ -90,8 +94,10 @@ +{ + grub_unregister_command (cmd); +} ---- a/grub-core/disk/cryptodisk.c -+++ b/grub-core/disk/cryptodisk.c +Index: grub-2.16/grub-core/disk/cryptodisk.c +=================================================================== +--- grub-2.16.orig/grub-core/disk/cryptodisk.c ++++ grub-2.16/grub-core/disk/cryptodisk.c @@ -33,6 +33,8 @@ #ifdef GRUB_UTIL @@ -101,7 +107,7 @@ #endif GRUB_MOD_LICENSE ("GPLv3+"); -@@ -1303,6 +1305,10 @@ +@@ -1310,6 +1312,10 @@ grub_cryptodisk_scan_device_real (const if (cargs->hdr_file != NULL) source->read_hook = NULL; @@ -112,17 +118,19 @@ if (askpass) { grub_memset (cargs->key_data, 0, cargs->key_len); ---- a/grub-core/loader/linux.c -+++ b/grub-core/loader/linux.c -@@ -5,6 +5,7 @@ - #include <grub/file.h> +Index: grub-2.16/grub-core/loader/linux.c +=================================================================== +--- grub-2.16.orig/grub-core/loader/linux.c ++++ grub-2.16/grub-core/loader/linux.c +@@ -6,6 +6,7 @@ #include <grub/mm.h> #include <grub/safemath.h> + #include <grub/verify.h> +#include <grub/list.h> struct newc_head { -@@ -27,6 +28,7 @@ +@@ -28,6 +29,7 @@ struct newc_head struct grub_linux_initrd_component { grub_file_t file; @@ -130,7 +138,7 @@ char *newc_name; grub_off_t size; }; -@@ -38,6 +40,18 @@ +@@ -39,6 +41,18 @@ struct dir struct dir *child; }; @@ -149,7 +157,7 @@ static char hex (grub_uint8_t val) { -@@ -162,6 +176,65 @@ +@@ -163,6 +177,65 @@ insert_dir (const char *name, struct dir return GRUB_ERR_NONE; } @@ -215,7 +223,7 @@ grub_err_t grub_initrd_init (int argc, char *argv[], struct grub_linux_initrd_context *initrd_ctx) -@@ -169,11 +242,17 @@ +@@ -170,11 +243,17 @@ grub_initrd_init (int argc, char *argv[] int i; int newc = 0; struct dir *root = 0; @@ -234,7 +242,7 @@ if (!initrd_ctx->components) return grub_errno; -@@ -253,6 +332,10 @@ +@@ -255,6 +334,10 @@ grub_initrd_init (int argc, char *argv[] root = 0; } @@ -245,7 +253,7 @@ return GRUB_ERR_NONE; overflow: -@@ -276,7 +359,9 @@ +@@ -278,7 +361,9 @@ grub_initrd_close (struct grub_linux_ini for (i = 0; i < initrd_ctx->nfiles; i++) { grub_free (initrd_ctx->components[i].newc_name); @@ -256,7 +264,7 @@ } grub_free (initrd_ctx->components); initrd_ctx->components = 0; -@@ -325,7 +410,12 @@ +@@ -327,7 +412,12 @@ grub_initrd_load (struct grub_linux_init } cursize = initrd_ctx->components[i].size; @@ -270,9 +278,9 @@ != cursize) { if (!grub_errno) -@@ -346,3 +436,45 @@ - root = 0; - return GRUB_ERR_NONE; +@@ -381,3 +471,45 @@ grub_initrd_load (struct grub_linux_init + grub_initrd_close (initrd_ctx); + return status; } + +grub_err_t @@ -316,9 +324,11 @@ + + return GRUB_ERR_NONE; +} ---- a/include/grub/linux.h -+++ b/include/grub/linux.h -@@ -22,3 +22,6 @@ +Index: grub-2.16/include/grub/linux.h +=================================================================== +--- grub-2.16.orig/include/grub/linux.h ++++ grub-2.16/include/grub/linux.h +@@ -22,3 +22,6 @@ grub_initrd_close (struct grub_linux_ini grub_err_t grub_initrd_load (struct grub_linux_initrd_context *initrd_ctx, void *target); ++++++ grub-2.14.tar.xz -> grub-2.16.tar.xz ++++++ /work/SRC/openSUSE:Factory/grub2/grub-2.14.tar.xz /work/SRC/openSUSE:Factory/.grub2.new.3698736/grub-2.16.tar.xz differ: char 13, line 1 ++++++ grub2-Add-hidden-menu-entries.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.290938382 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.294938550 +0200 @@ -161,7 +161,7 @@ return -1; } -@@ -520,6 +534,10 @@ +@@ -524,6 +538,10 @@ grub_menu_entry_t e = menu->entry_list; int i; @@ -172,7 +172,7 @@ grub_errno = GRUB_ERR_NONE; for (i = 0; e; i++) -@@ -531,6 +549,10 @@ +@@ -535,6 +553,10 @@ break; } e = e->next; @@ -220,7 +220,7 @@ grub_normal_set_password (const char *user, const char *password); --- a/grub-core/commands/blsuki.c +++ b/grub-core/commands/blsuki.c -@@ -1022,7 +1022,7 @@ +@@ -1033,7 +1033,7 @@ linux_cmd, initrd_cmd ? initrd_cmd : "", dt_cmd ? dt_cmd : ""); @@ -228,8 +228,8 @@ + grub_normal_add_menu_entry (argc, argv, classes, id, users, hotkey, NULL, src, 0, entry, 0); finish: - grub_free (linux_cmd); -@@ -1088,7 +1088,7 @@ + grub_free (full_title); +@@ -1118,7 +1118,7 @@ (options != NULL) ? " " : "", (options != NULL) ? options : ""); @@ -237,5 +237,5 @@ + grub_normal_add_menu_entry (1, argv, NULL, id, NULL, NULL, NULL, src, 0, entry, 0); finish: - grub_free (argv); + grub_free (full_title); ++++++ grub2-bsc1220338-key_protector-implement-the-blocklist.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.320939636 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.323939761 +0200 @@ -75,8 +75,8 @@ } --- a/include/grub/efi/api.h +++ b/include/grub/efi/api.h -@@ -409,6 +409,11 @@ - { 0xbd, 0x89, 0x86, 0x3b, 0xbe, 0xf8, 0x23, 0x25 } \ +@@ -414,6 +414,11 @@ + { 0x99, 0x20, 0x2d, 0x3b, 0x36, 0xd7, 0x50, 0xdf } \ } +#define GRUB_EFI_SYSTEMD_GUID \ ++++++ grub2-btrfs-04-grub2-install.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.349940848 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.356941140 +0200 @@ -80,8 +80,8 @@ + if (!bootloader_id && config.grub_distributor) { - char *ptr; -@@ -1451,6 +1456,15 @@ + bootloader_id = xstrdup (config.grub_distributor); +@@ -1459,6 +1464,15 @@ debug_image); } @@ -99,7 +99,7 @@ if ((disk_module && grub_strcmp (disk_module, "biosdisk") != 0) --- a/grub-core/osdep/linux/getroot.c +++ b/grub-core/osdep/linux/getroot.c -@@ -373,6 +373,7 @@ +@@ -375,6 +375,7 @@ return NULL; } @@ -107,7 +107,7 @@ char ** grub_find_root_devices_from_mountinfo (const char *dir, char **relroot) -@@ -516,6 +517,12 @@ +@@ -521,6 +522,12 @@ { ret = grub_find_root_devices_from_btrfs (dir); fs_prefix = get_btrfs_fs_prefix (entries[i].enc_path); ++++++ grub2-btrfs-05-grub2-mkconfig.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.372941809 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.375941934 +0200 @@ -48,8 +48,8 @@ # Do this as early as possible, since other commands might depend on it. # (e.g. the `loadfont' command might need lvm or raid modules) for i in ${GRUB_PRELOAD_MODULES} ; do -@@ -43,7 +58,9 @@ - if [ "x${GRUB_TIMEOUT_BUTTON}" = "x" ] ; then GRUB_TIMEOUT_BUTTON="$GRUB_TIMEOUT" ; fi +@@ -90,7 +105,9 @@ + fi cat << EOF -if [ -s \$prefix/grubenv ]; then @@ -59,7 +59,7 @@ load_env fi -@@ -417,3 +434,15 @@ +@@ -462,3 +479,15 @@ if [ "x${GRUB_BADRAM}" != "x" ] ; then echo "badram ${GRUB_BADRAM}" fi @@ -77,12 +77,12 @@ +fi --- a/util/grub-mkconfig.in +++ b/util/grub-mkconfig.in -@@ -299,7 +299,8 @@ - GRUB_BADRAM \ - GRUB_OS_PROBER_SKIP_LIST \ - GRUB_DISABLE_SUBMENU \ -- GRUB_FORCE_EFI_ALL_VIDEO -+ GRUB_FORCE_EFI_ALL_VIDEO \ +@@ -321,7 +321,8 @@ + GRUB_SIMPLE_ACCESS_LEVEL \ + GRUB_ADVANCED_ACCESS_LEVEL \ + GRUB_RECOVERY_ACCESS_LEVEL \ +- GRUB_BOOTNEXT_OMIT_INACTIVE ++ GRUB_BOOTNEXT_OMIT_INACTIVE \ + SUSE_BTRFS_SNAPSHOT_BOOTING if test "x${grub_cfg}" != "x"; then @@ -104,7 +104,7 @@ fi;; xzfs) rpool=`${grub_probe} --device ${GRUB_DEVICE} --target=fs_label 2>/dev/null || zdb -l ${GRUB_DEVICE} | awk -F \' '/ name/ { print $2 }'` -@@ -295,7 +299,12 @@ +@@ -308,7 +312,12 @@ if [ $PLATFORM != "emu" ]; then hotkey=0 else ++++++ grub2-default-distributor.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.432944316 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.435944441 +0200 @@ -6,11 +6,9 @@ v2: Use /usr/lib/os-release as fallback to /etc/os-release -Index: grub-2.06/grub-core/osdep/unix/config.c -=================================================================== ---- grub-2.06.orig/grub-core/osdep/unix/config.c -+++ grub-2.06/grub-core/osdep/unix/config.c -@@ -61,6 +61,131 @@ grub_util_get_localedir (void) +--- a/grub-core/osdep/unix/config.c ++++ b/grub-core/osdep/unix/config.c +@@ -61,6 +61,131 @@ return LOCALEDIR; } @@ -142,7 +140,7 @@ void grub_util_load_config (struct grub_util_config *cfg) { -@@ -125,7 +250,17 @@ grub_util_load_config (struct grub_util_ +@@ -125,7 +250,32 @@ waitpid (pid, NULL, 0); } if (f) @@ -154,6 +152,21 @@ + if (cfg->grub_distributor) + grub_free (cfg->grub_distributor); + cfg->grub_distributor = grub_util_default_distributor (); ++ if (cfg->grub_distributor) ++ { ++ /* ++ * For bootloader-id derived from the default distributor, use ++ * the first word in all lower case. It is to retain the behavior ++ * prior to this commit. ddb8f4c1f util/grub-install: ++ * bootloader-id, pass GRUB_DISTRIBUTOR directly. ++ */ ++ char *s; ++ ++ for (s = cfg->grub_distributor; *s && *s != ' '; s++) ++ if (*s >= 'A' && *s <= 'Z') ++ *s = *s - 'A' + 'a'; ++ *s = '\0'; ++ } + } +#endif + return; @@ -161,7 +174,7 @@ f = grub_util_fopen (cfgfile, "r"); if (f) -@@ -136,4 +271,13 @@ grub_util_load_config (struct grub_util_ +@@ -136,4 +286,28 @@ else grub_util_warn (_("cannot open configuration file `%s': %s"), cfgfile, strerror (errno)); @@ -172,16 +185,29 @@ + if (cfg->grub_distributor) + grub_free (cfg->grub_distributor); + cfg->grub_distributor = grub_util_default_distributor (); ++ if (cfg->grub_distributor) ++ { ++ /* ++ * For bootloader-id derived from the default distributor, use ++ * the first word in all lower case. It is to retain the behavior ++ * prior to this commit. ddb8f4c1f util/grub-install: ++ * bootloader-id, pass GRUB_DISTRIBUTOR directly. ++ */ ++ char *s; ++ ++ for (s = cfg->grub_distributor; *s && *s != ' '; s++) ++ if (*s >= 'A' && *s <= 'Z') ++ *s = *s - 'A' + 'a'; ++ *s = '\0'; ++ } + } +#endif } -Index: grub-2.06/util/grub-mkconfig.in -=================================================================== ---- grub-2.06.orig/util/grub-mkconfig.in -+++ grub-2.06/util/grub-mkconfig.in -@@ -225,6 +225,19 @@ GRUB_ACTUAL_DEFAULT="$GRUB_DEFAULT" - - if [ "x${GRUB_ACTUAL_DEFAULT}" = "xsaved" ] ; then GRUB_ACTUAL_DEFAULT="`"${grub_editenv}" - list | sed -n '/^saved_entry=/ s,^saved_entry=,,p'`" ; fi +--- a/util/grub-mkconfig.in ++++ b/util/grub-mkconfig.in +@@ -241,6 +241,19 @@ + if [ "x${GRUB_ADVANCED_ACCESS_LEVEL}" = "x" ] ; then GRUB_ADVANCED_ACCESS_LEVEL="0" ; fi + if [ "x${GRUB_RECOVERY_ACCESS_LEVEL}" = "x" ] ; then GRUB_RECOVERY_ACCESS_LEVEL="0" ; fi +if [ x"${GRUB_DISTRIBUTOR}" = x ] ; then + for i in "${sysconfdir}/os-release" "/usr/lib/os-release" ; do ++++++ grub2-efi-xen-cmdline.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.473946029 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.477946196 +0200 @@ -1,9 +1,9 @@ --- a/util/grub-mkconfig.in +++ b/util/grub-mkconfig.in -@@ -300,7 +300,8 @@ - GRUB_OS_PROBER_SKIP_LIST \ - GRUB_DISABLE_SUBMENU \ - GRUB_FORCE_EFI_ALL_VIDEO \ +@@ -322,7 +322,8 @@ + GRUB_ADVANCED_ACCESS_LEVEL \ + GRUB_RECOVERY_ACCESS_LEVEL \ + GRUB_BOOTNEXT_OMIT_INACTIVE \ - SUSE_BTRFS_SNAPSHOT_BOOTING + SUSE_BTRFS_SNAPSHOT_BOOTING \ + SUSE_CMDLINE_XENEFI @@ -12,7 +12,7 @@ rm -f "${grub_cfg}.new" --- a/util/grub.d/20_linux_xen.in +++ b/util/grub.d/20_linux_xen.in -@@ -219,7 +219,7 @@ +@@ -222,7 +222,7 @@ message="$(gettext_printf "Loading Xen %s with Linux %s ..." ${xen_version} ${version})" sed "s/^/$submenu_indentation/" <<-EOF echo '$(echo "$message" | grub_quote)' ++++++ grub2-emu-4-all.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.497947032 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.500947157 +0200 @@ -7,7 +7,7 @@ --- a/Makefile.util.def +++ b/Makefile.util.def -@@ -408,7 +408,7 @@ +@@ -427,7 +427,7 @@ ldadd = grub-core/lib/gnulib/libgnu.a; ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBUTIL) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; cppflags = '-DGRUB_SETUP_FUNC=grub_util_bios_setup'; @@ -16,7 +16,7 @@ }; program = { -@@ -429,7 +429,7 @@ +@@ -448,7 +448,7 @@ ldadd = grub-core/lib/gnulib/libgnu.a; ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBUTIL) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; cppflags = '-DGRUB_SETUP_FUNC=grub_util_sparc_setup'; @@ -25,7 +25,7 @@ }; program = { -@@ -445,7 +445,7 @@ +@@ -464,7 +464,7 @@ ldadd = libgrubgcry.a; ldadd = grub-core/lib/gnulib/libgnu.a; ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBUTIL) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; @@ -34,7 +34,7 @@ }; program = { -@@ -476,7 +476,7 @@ +@@ -495,7 +495,7 @@ ldadd = libgrubgcry.a; ldadd = grub-core/lib/gnulib/libgnu.a; ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBUTIL) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; @@ -43,18 +43,25 @@ }; data = { -@@ -1475,7 +1475,7 @@ +@@ -1661,7 +1661,6 @@ ldadd = libgrubgcry.a; ldadd = grub-core/lib/gnulib/libgnu.a; ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; - emu_condition = COND_NOT_s390x; + }; + + program = { +@@ -1696,6 +1695,7 @@ + ldadd = libgrubgcry.a; + ldadd = grub-core/lib/gnulib/libgnu.a; + ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; + emu_condition = COND_NOT_emu; }; program = { --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -1225,7 +1225,7 @@ +@@ -1269,7 +1269,7 @@ module = { name = videotest; common = commands/videotest.c; @@ -63,7 +70,7 @@ }; module = { -@@ -1691,7 +1691,7 @@ +@@ -1753,7 +1753,7 @@ common = gfxmenu/gui_progress_bar.c; common = gfxmenu/gui_util.c; common = gfxmenu/gui_string_util.c; @@ -72,7 +79,7 @@ }; module = { -@@ -2137,13 +2137,13 @@ +@@ -2201,13 +2201,13 @@ name = gfxterm; common = term/gfxterm.c; enable = videomodules; @@ -88,7 +95,7 @@ }; module = { -@@ -2293,9 +2293,7 @@ +@@ -2380,9 +2380,7 @@ enable = i386_xen_pvh; enable = i386_efi; enable = x86_64_efi; @@ -98,7 +105,7 @@ }; module = { -@@ -2346,7 +2344,7 @@ +@@ -2433,7 +2431,7 @@ module = { name = gfxterm_menu; common = tests/gfxterm_menu.c; @@ -107,7 +114,7 @@ }; module = { -@@ -2507,9 +2505,7 @@ +@@ -2587,9 +2585,7 @@ enable = i386_xen_pvh; enable = i386_efi; enable = x86_64_efi; @@ -119,7 +126,7 @@ module = { --- a/configure.ac +++ b/configure.ac -@@ -2419,6 +2419,7 @@ +@@ -2492,6 +2492,7 @@ AM_CONDITIONAL([COND_real_platform], [test x$platform != xnone]) AM_CONDITIONAL([COND_emu], [test x$platform = xemu]) ++++++ grub2-iterate-and-hook-for-extended-partition.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.548949163 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.552949330 +0200 @@ -16,11 +16,9 @@ References: https://bugzilla.novell.com/show_bug.cgi?id=785341 --- -Index: grub-2.00/grub-core/partmap/msdos.c -=================================================================== ---- grub-2.00.orig/grub-core/partmap/msdos.c -+++ grub-2.00/grub-core/partmap/msdos.c -@@ -188,13 +188,20 @@ grub_partition_msdos_iterate (grub_disk_ +--- a/grub-core/partmap/msdos.c ++++ b/grub-core/partmap/msdos.c +@@ -188,13 +188,20 @@ (unsigned long long) p.len); /* If this partition is a normal one, call the hook. */ @@ -45,5 +43,5 @@ + } } else if (p.number < 3) - /* If this partition is a logical one, shouldn't increase the + /* Reserve a partition number for every one of the four primary ++++++ grub2-s390x-04-grub2-install.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.649953383 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.653953550 +0200 @@ -76,7 +76,7 @@ --- a/Makefile.util.def +++ b/Makefile.util.def -@@ -408,6 +408,7 @@ +@@ -427,6 +427,7 @@ ldadd = grub-core/lib/gnulib/libgnu.a; ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBUTIL) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; cppflags = '-DGRUB_SETUP_FUNC=grub_util_bios_setup'; @@ -84,7 +84,7 @@ }; program = { -@@ -428,6 +429,7 @@ +@@ -447,6 +448,7 @@ ldadd = grub-core/lib/gnulib/libgnu.a; ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBUTIL) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; cppflags = '-DGRUB_SETUP_FUNC=grub_util_sparc_setup'; @@ -92,7 +92,7 @@ }; program = { -@@ -443,6 +445,7 @@ +@@ -462,6 +464,7 @@ ldadd = libgrubgcry.a; ldadd = grub-core/lib/gnulib/libgnu.a; ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBUTIL) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; @@ -100,7 +100,7 @@ }; program = { -@@ -473,6 +476,7 @@ +@@ -492,6 +495,7 @@ ldadd = libgrubgcry.a; ldadd = grub-core/lib/gnulib/libgnu.a; ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBUTIL) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; @@ -108,7 +108,7 @@ }; data = { -@@ -696,6 +700,7 @@ +@@ -721,6 +725,7 @@ common = grub-core/disk/host.c; common = util/resolve.c; @@ -116,7 +116,7 @@ common = grub-core/kern/emu/argp_common.c; common = grub-core/osdep/init.c; -@@ -765,6 +770,46 @@ +@@ -790,6 +795,46 @@ }; script = { @@ -163,7 +163,7 @@ name = grub-mkconfig_lib; common = util/grub-mkconfig_lib.in; installdir = noinst; -@@ -1430,6 +1475,7 @@ +@@ -1616,6 +1661,7 @@ ldadd = libgrubgcry.a; ldadd = grub-core/lib/gnulib/libgnu.a; ldadd = '$(LIBINTL) $(LIBDEVMAPPER) $(LIBZFS) $(LIBNVPAIR) $(LIBGEOM)'; @@ -173,7 +173,7 @@ program = { --- a/configure.ac +++ b/configure.ac -@@ -212,9 +212,9 @@ +@@ -239,9 +239,9 @@ esac fi @@ -186,7 +186,7 @@ case "$target_os" in windows* | mingw32*) target_os=cygwin ;; -@@ -2451,6 +2451,9 @@ +@@ -2524,6 +2524,9 @@ AM_CONDITIONAL([COND_sparc64_emu], [test x$target_cpu = xsparc64 -a x$platform = xemu]) AM_CONDITIONAL([COND_x86_64_efi], [test x$target_cpu = xx86_64 -a x$platform = xefi]) AM_CONDITIONAL([COND_x86_64_xen], [test x$target_cpu = xx86_64 -a x$platform = xxen]) @@ -198,7 +198,7 @@ AM_CONDITIONAL([COND_HOST_LINUX], [test x$host_kernel = xlinux]) --- a/grub-core/Makefile.core.def +++ b/grub-core/Makefile.core.def -@@ -1225,6 +1225,7 @@ +@@ -1269,6 +1269,7 @@ module = { name = videotest; common = commands/videotest.c; @@ -206,7 +206,7 @@ }; module = { -@@ -1690,6 +1691,7 @@ +@@ -1752,6 +1753,7 @@ common = gfxmenu/gui_progress_bar.c; common = gfxmenu/gui_util.c; common = gfxmenu/gui_string_util.c; @@ -214,7 +214,7 @@ }; module = { -@@ -2135,11 +2137,13 @@ +@@ -2199,11 +2201,13 @@ name = gfxterm; common = term/gfxterm.c; enable = videomodules; @@ -228,7 +228,7 @@ }; module = { -@@ -2291,6 +2295,7 @@ +@@ -2378,6 +2382,7 @@ enable = x86_64_efi; enable = emu; enable = xen; @@ -236,7 +236,7 @@ }; module = { -@@ -2341,6 +2346,7 @@ +@@ -2428,6 +2433,7 @@ module = { name = gfxterm_menu; common = tests/gfxterm_menu.c; @@ -244,7 +244,7 @@ }; module = { -@@ -2503,6 +2509,7 @@ +@@ -2583,6 +2589,7 @@ enable = x86_64_efi; enable = emu; enable = xen; @@ -267,7 +267,7 @@ + --- a/grub-core/osdep/unix/platform.c +++ b/grub-core/osdep/unix/platform.c -@@ -239,3 +239,14 @@ +@@ -385,3 +385,14 @@ imgfile, destname, NULL }); grub_util_warn ("%s", _("You will have to set `SystemPartition' and `OSLoader' manually.")); } @@ -304,7 +304,7 @@ GRUB_INSTALL_PLATFORM_MAX }; -@@ -247,6 +248,9 @@ +@@ -250,6 +251,9 @@ grub_install_sgi_setup (const char *install_device, const char *imgfile, const char *destname); @@ -316,7 +316,7 @@ int --- a/util/grub-install-common.c +++ b/util/grub-install-common.c -@@ -957,6 +957,7 @@ +@@ -969,6 +969,7 @@ [GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI] = { "loongarch64", "efi" }, [GRUB_INSTALL_PLATFORM_RISCV32_EFI] = { "riscv32", "efi" }, [GRUB_INSTALL_PLATFORM_RISCV64_EFI] = { "riscv64", "efi" }, @@ -381,7 +381,7 @@ return 0; /* pacify warning. */ -@@ -939,6 +952,7 @@ +@@ -934,6 +947,7 @@ case GRUB_INSTALL_PLATFORM_I386_XEN: case GRUB_INSTALL_PLATFORM_X86_64_XEN: case GRUB_INSTALL_PLATFORM_I386_XEN_PVH: @@ -389,7 +389,7 @@ break; case GRUB_INSTALL_PLATFORM_I386_QEMU: -@@ -990,6 +1004,7 @@ +@@ -985,6 +999,7 @@ case GRUB_INSTALL_PLATFORM_I386_XEN: case GRUB_INSTALL_PLATFORM_X86_64_XEN: case GRUB_INSTALL_PLATFORM_I386_XEN_PVH: @@ -397,8 +397,8 @@ free (install_device); install_device = NULL; break; -@@ -1291,6 +1306,20 @@ - } +@@ -1299,6 +1314,20 @@ + #endif /* __powerpc__ */ } + if (platform == GRUB_INSTALL_PLATFORM_S390X_EMU) @@ -418,7 +418,7 @@ size_t ndev = 0; /* Write device to a variable so we don't have to traverse /dev every time. */ -@@ -1543,6 +1572,7 @@ +@@ -1551,6 +1580,7 @@ case GRUB_INSTALL_PLATFORM_I386_XEN: case GRUB_INSTALL_PLATFORM_X86_64_XEN: case GRUB_INSTALL_PLATFORM_I386_XEN_PVH: @@ -426,7 +426,7 @@ grub_util_warn ("%s", _("no hints available for your platform. Expect reduced performance")); break; /* pacify warning. */ -@@ -1661,6 +1691,10 @@ +@@ -1669,6 +1699,10 @@ strcpy (mkimage_target, "sparc64-ieee1275-raw"); core_name = "core.img"; break; @@ -437,7 +437,7 @@ /* pacify warning. */ case GRUB_INSTALL_PLATFORM_MAX: break; -@@ -1676,6 +1710,7 @@ +@@ -1684,6 +1718,7 @@ core_name); char *prefix = xasprintf ("%s%s", prefix_drive ? : "", relative_grubdir); @@ -445,7 +445,7 @@ grub_install_make_image_wrap (/* source dir */ grub_install_source_directory, /*prefix */ prefix, /* output */ imgfile, -@@ -1714,6 +1749,10 @@ +@@ -1722,6 +1757,10 @@ /* image target */ mkimage_target, 0); } break; @@ -456,7 +456,7 @@ case GRUB_INSTALL_PLATFORM_ARM_EFI: case GRUB_INSTALL_PLATFORM_ARM64_EFI: case GRUB_INSTALL_PLATFORM_LOONGARCH64_EFI: -@@ -2013,6 +2052,10 @@ +@@ -2021,6 +2060,10 @@ } break; @@ -1276,7 +1276,7 @@ +exit $ret --- a/util/grub-editenv.c +++ b/util/grub-editenv.c -@@ -568,6 +568,10 @@ +@@ -572,6 +572,10 @@ grub_fs_t grub_fs = NULL; bool have_abstraction = false; ++++++ grub2-s390x-05-grub2-mkconfig.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.667954135 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.674954428 +0200 @@ -27,7 +27,7 @@ case x"$GRUB_FS" in xbtrfs) rootsubvol="`make_system_path_relative_to_its_root /`" -@@ -81,6 +85,21 @@ +@@ -87,6 +91,21 @@ title_correction_code= @@ -49,21 +49,22 @@ linux_entry () { os="$1" -@@ -110,9 +129,11 @@ +@@ -120,10 +139,12 @@ title_correction_code="${title_correction_code}if [ \"x\$default\" = '$quoted' ]; then default='$(echo "$replacement_title" | grub_quote)'; fi;" grub_warn "$(gettext_printf "Please don't use old title \`%s' for GRUB_DEFAULT, use \`%s' (for versions before 2.00) or \`%s' (for 2.00 or later)" "$GRUB_ACTUAL_DEFAULT" "$replacement_title" "gnulinux-advanced-$boot_device_id>gnulinux-$version-$type-$boot_device_id")" fi -- echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_indentation/" -+ echo "menuentry '$(echo "$title" | grub_quote)' $(print_hotkey) ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' {" | sed "s/^/$submenu_indentation/" +- echo "menuentry '$(echo "$title" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' ${allowed_user_list}{" | sed "s/^/$submenu_indentation/" ++ echo "menuentry '$(echo "$title" | grub_quote)' $(print_hotkey) ${CLASS} \$menuentry_id_option 'gnulinux-$version-$type-$boot_device_id' ${allowed_user_list}{" | sed "s/^/$submenu_indentation/" + hotkey=$(incr_hotkey) else -- echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/" -+ echo "menuentry '$(echo "$os" | grub_quote)' $(print_hotkey) ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' {" | sed "s/^/$submenu_indentation/" + allowed_user_list="$(grub_get_auth_user_list $GRUB_SIMPLE_ACCESS_LEVEL)" +- echo "menuentry '$(echo "$os" | grub_quote)' ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' ${allowed_user_list}{" | sed "s/^/$submenu_indentation/" ++ echo "menuentry '$(echo "$os" | grub_quote)' $(print_hotkey) ${CLASS} \$menuentry_id_option 'gnulinux-simple-$boot_device_id' ${allowed_user_list}{" | sed "s/^/$submenu_indentation/" + hotkey=$(incr_hotkey) fi if [ x$type != xrecovery ] ; then save_default_entry | grub_add_tab -@@ -135,6 +156,7 @@ +@@ -148,6 +169,7 @@ echo " insmod gzio" | sed "s/^/$submenu_indentation/" @@ -71,7 +72,7 @@ if [ x$dirname = x/ ]; then if [ -z "${prepare_root_cache}" ]; then prepare_root_cache="$(prepare_grub_to_access_device ${GRUB_DEVICE} | grub_add_tab)" -@@ -146,6 +168,7 @@ +@@ -159,6 +181,7 @@ fi printf '%s\n' "${prepare_boot_cache}" | sed "s/^/$submenu_indentation/" fi @@ -79,7 +80,7 @@ message="$(gettext_printf "Loading Linux %s ..." ${version})" sed "s/^/$submenu_indentation/" << EOF echo '$(echo "$message" | grub_quote)' -@@ -170,17 +193,15 @@ +@@ -183,17 +206,15 @@ machine=`uname -m` case "x$machine" in @@ -105,7 +106,7 @@ case "$machine" in i?86) GENKERNEL_ARCH="x86" ;; -@@ -190,6 +211,15 @@ +@@ -203,6 +224,15 @@ *) GENKERNEL_ARCH="$machine" ;; esac @@ -121,7 +122,7 @@ prepare_boot_cache= prepare_root_cache= boot_device_id= -@@ -216,6 +246,11 @@ +@@ -229,6 +259,11 @@ basename=`basename $linux` dirname=`dirname $linux` rel_dirname=`make_system_path_relative_to_its_root $dirname` @@ -133,12 +134,12 @@ version=`echo $basename | sed -e "s,^[^0-9]*-,,g"` alt_version=`echo $version | sed -e "s,\.old$,,g"` linux_root_device_thisversion="${LINUX_ROOT_DEVICE}" -@@ -333,7 +368,8 @@ +@@ -346,7 +381,8 @@ boot_device_id="$(grub_get_device_id "${GRUB_DEVICE}")" fi # TRANSLATORS: %s is replaced with an OS name -- echo "submenu '$(gettext_printf "Advanced options for %s" "${OS}" | grub_quote)' \$menuentry_id_option 'gnulinux-advanced-$boot_device_id' {" -+ echo "submenu '$(gettext_printf "Advanced options for %s" "${OS}" | grub_quote)' $(print_hotkey) \$menuentry_id_option 'gnulinux-advanced-$boot_device_id' {" +- echo "submenu '$(gettext_printf "Advanced options for %s" "${OS}" | grub_quote)' \$menuentry_id_option 'gnulinux-advanced-$boot_device_id' $(grub_echo_unrestricted_maybe){" ++ echo "submenu '$(gettext_printf "Advanced options for %s" "${OS}" | grub_quote)' $(print_hotkey) \$menuentry_id_option 'gnulinux-advanced-$boot_device_id' $(grub_echo_unrestricted_maybe){" + hotkey=$(incr_hotkey) is_top_level=false fi ++++++ grub2-secureboot-chainloader.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.733956893 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.737957060 +0200 @@ -26,7 +26,7 @@ --- a/grub-core/loader/efi/chainloader.c +++ b/grub-core/loader/efi/chainloader.c -@@ -42,10 +42,24 @@ +@@ -42,6 +42,15 @@ #include <grub/i386/macho.h> #endif @@ -42,6 +42,9 @@ GRUB_MOD_LICENSE ("GPLv3+"); static grub_dl_t my_mod; +@@ -63,6 +72,11 @@ + grub_efi_device_path_t *saved_device_path; + }; +#ifdef SUPPORT_SECURE_BOOT +static grub_efi_boolean_t debug_secureboot = 0; @@ -51,7 +54,7 @@ static grub_err_t grub_chainloader_unload (void *context) { -@@ -207,6 +221,421 @@ +@@ -240,6 +254,421 @@ return file_path; } @@ -473,7 +476,7 @@ static grub_err_t grub_cmd_chainloader (grub_command_t cmd __attribute__ ((unused)), int argc, char *argv[]) -@@ -220,11 +649,12 @@ +@@ -253,12 +682,13 @@ grub_efi_loaded_image_t *loaded_image; char *filename; void *boot_image = 0; @@ -482,12 +485,13 @@ grub_efi_uintn_t pages = 0; grub_efi_char16_t *cmdline = NULL; grub_efi_handle_t image_handle = NULL; + struct grub_chainloader_context *ctx = NULL; + grub_ssize_t cmdline_len = 0; + grub_efi_handle_t dev_handle = 0; if (argc == 0) return grub_error (GRUB_ERR_BAD_ARGUMENT, N_("filename expected")); -@@ -234,12 +664,39 @@ +@@ -268,12 +698,39 @@ b = grub_efi_system_table->boot_services; @@ -529,7 +533,7 @@ if (dev == NULL) ; else if (dev->disk) -@@ -338,6 +795,28 @@ +@@ -372,6 +829,28 @@ } #endif @@ -558,7 +562,7 @@ image_handle = grub_efi_get_last_verified_image_handle (); if (image_handle == NULL) { -@@ -366,33 +845,10 @@ +@@ -400,33 +879,10 @@ loaded_image->device_handle = dev_handle; /* Build load options with arguments from chainloader command line. */ @@ -593,5 +597,5 @@ + loaded_image->load_options_size = cmdline_len; } - grub_file_close (file); + /* ++++++ grub2-suse-remove-linux-root-param.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.789959233 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.795959483 +0200 @@ -1,8 +1,8 @@ --- a/util/grub-mkconfig.in +++ b/util/grub-mkconfig.in -@@ -301,7 +301,8 @@ - GRUB_DISABLE_SUBMENU \ - GRUB_FORCE_EFI_ALL_VIDEO \ +@@ -323,7 +323,8 @@ + GRUB_RECOVERY_ACCESS_LEVEL \ + GRUB_BOOTNEXT_OMIT_INACTIVE \ SUSE_BTRFS_SNAPSHOT_BOOTING \ - SUSE_CMDLINE_XENEFI + SUSE_CMDLINE_XENEFI \ @@ -21,7 +21,7 @@ GRUB_CMDLINE_LINUX="rootflags=subvol=${rootsubvol} ${GRUB_CMDLINE_LINUX}" fi fi;; -@@ -87,6 +87,10 @@ +@@ -93,6 +93,10 @@ ;; esac ++++++ grub2-sysfb.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.818960444 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.824960695 +0200 @@ -1,16 +1,19 @@ -Index: grub-2.12/util/grub.d/10_linux.in -=================================================================== ---- grub-2.12.orig/util/grub.d/10_linux.in -+++ grub-2.12/util/grub.d/10_linux.in -@@ -116,7 +116,7 @@ linux_entry () +--- a/util/grub.d/10_linux.in ++++ b/util/grub.d/10_linux.in +@@ -127,11 +127,9 @@ # FIXME: We need an interface to select vesafb in case efifb can't be used. if [ "x$GRUB_GFXPAYLOAD_LINUX" = x ]; then echo " load_video" | sed "s/^/$submenu_indentation/" - if grep -qx "CONFIG_FB_EFI=y" "${config}" 2> /dev/null \ + if grep -qx "CONFIG_\(DRM_EFIDRM\|DRM_VESADRM\|FB_EFI\|SYSFB_SIMPLEFB\)=y" "${config}" 2> /dev/null \ && grep -qx "CONFIG_VT_HW_CONSOLE_BINDING=y" "${config}" 2> /dev/null; then - echo " set gfxpayload=keep" | sed "s/^/$submenu_indentation/" +- echo ' if [ "x$grub_platform" = xefi ]; then' | sed "s/^/$submenu_indentation/" +- echo " set gfxpayload=keep" | sed "s/^/$submenu_indentation/" +- echo ' fi' | sed "s/^/$submenu_indentation/" ++ echo " set gfxpayload=keep" | sed "s/^/$submenu_indentation/" fi + else + if [ "x$GRUB_GFXPAYLOAD_LINUX" != xtext ]; then ++++++ info-dir-entry.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.914964456 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.916964539 +0200 @@ -1,23 +1,23 @@ -Index: grub-2.02~beta3/docs/grub.texi -=================================================================== ---- grub-2.02~beta3.orig/docs/grub.texi -+++ grub-2.02~beta3/docs/grub.texi -@@ -32,15 +32,15 @@ Invariant Sections. +--- a/docs/grub.texi ++++ b/docs/grub.texi +@@ -32,16 +32,16 @@ @dircategory Kernel @direntry -* GRUB: (grub). The GRand Unified Bootloader -* grub-install: (grub)Invoking grub-install. Install GRUB on your drive -* grub-mkconfig: (grub)Invoking grub-mkconfig. Generate GRUB configuration +-* grub-mkpasswd-argon2: (grub)Invoking grub-mkpasswd-argon2. -* grub-mkpasswd-pbkdf2: (grub)Invoking grub-mkpasswd-pbkdf2. -* grub-mkrelpath: (grub)Invoking grub-mkrelpath. -* grub-mkrescue: (grub)Invoking grub-mkrescue. Make a GRUB rescue image -* grub-mount: (grub)Invoking grub-mount. Mount a file system using GRUB -* grub-probe: (grub)Invoking grub-probe. Probe device information -* grub-script-check: (grub)Invoking grub-script-check. -+* GRUB2: (grub2). The GRand Unified Bootloader ++* GRUB: (grub2). The GRand Unified Bootloader +* grub2-install: (grub2)Invoking grub-install. Install GRUB on your drive +* grub2-mkconfig: (grub2)Invoking grub-mkconfig. Generate GRUB configuration ++* grub2-mkpasswd-argon2: (grub2)Invoking grub-mkpasswd-argon2. +* grub2-mkpasswd-pbkdf2: (grub2)Invoking grub-mkpasswd-pbkdf2. +* grub2-mkrelpath: (grub2)Invoking grub-mkrelpath. +* grub2-mkrescue: (grub2)Invoking grub-mkrescue. Make a GRUB rescue image ++++++ use-grub2-as-a-package-name.patch ++++++ --- /var/tmp/diff_new_pack.XutlF1/_old 2026-10-12 22:05:52.949965918 +0200 +++ /var/tmp/diff_new_pack.XutlF1/_new 2026-10-12 22:05:52.953966085 +0200 @@ -18,9 +18,9 @@ dnl the target type. See INSTALL for full list of variables and dnl description of the relationships between them. --AC_INIT([GRUB],[2.14],[[email protected]]) -+AC_INIT([GRUB2],[2.14],[[email protected]]) +-AC_INIT([GRUB],[2.16],[[email protected]]) ++AC_INIT([GRUB2],[2.16],[[email protected]]) - AS_CASE(["$ERROR_PLATFORM_NOT_SUPPORT_SSP"], - [n | no | nO | N | No | NO], [ERROR_PLATFORM_NOT_SUPPORT_SSP=no], + # 1: Initial value + # 2: https://lists.gnu.org/archive/html/grub-devel/2022-06/msg00035.html
