Add ciq-grub2 virtual Provides (ciq8) - #5
Merged
Merged
Conversation
The CIQ shim must not boot upstream RESF grub2 (it lacks the grub.ciq_rocky SBAT entry and is not signed by the key the shim trusts). A version pin is unsafe: a newer Rocky grub2 would satisfy the range but still be wrong. Add ciq-grub2 and ciq-grub2-<efiarch> Provides to the EFI variant package so the shim can Requires the token directly. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the GRUB RPM macro definitions to ensure CIQ Secure Boot shim can depend on CIQ-signed GRUB EFI variant packages via stable virtual Provides, helping shim and grub2 install/upgrade together on supported architectures.
Changes:
- Adds
Provides: ciq-grub2 = %{evr}to EFI variant subpackages on CIQ Secure Boot supported arches. - Adds
Provides: ciq-grub2-%{1} = %{evr}(e.g.,ciq-grub2-efi-x64/-aa64/-ia32) to match shim dependency naming.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Bump Release .0.1.3 -> .0.1.4 so the committed branch matches the deployed artifacts and the transfer/sign pipeline (which already reference .0.1.4). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Same fix as el9: grub2-pc requires grub2-pc-modules of equal EVR, but x86_64 had with_legacy_modules 0, so the modules subpackage was never built -> grub2-pc is uninstallable / blocks dnf upgrade on any box with stock grub2-pc installed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jason-rodri
marked this pull request as ready for review
June 30, 2026 13:29
josephtate
reviewed
Jun 30, 2026
Addresses josephtate review comment on PR #5 — the .0.1.4 changelog only mentioned the Epoch bump; add the grub2-pc-modules/with_legacy_modules bullet so the change is documented in the spec. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
juphoff
approved these changes
Jul 7, 2026
This was referenced Jul 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds `ciq-grub2` and `ciq-grub2-%{1}` (→ `ciq-grub2-efi-x64`/`-aa64`/`-ia32`) Provides to the EFI variant package in `grub.macros`.
The CIQ shim 16.1 carries `Requires: ciq-grub2-efi-`, so it boots only this CIQ grub2 — never upstream RESF grub2, which lacks the `grub.ciq_*` SBAT entry and is not signed by the key the shim trusts. Reverse edge of the existing `Requires: ciq-shim` in `define_efi_variant`, so shim and grub2 install/upgrade as a unit.
Verified: `grub` SBAT generation `5` matches the shim `.sbatlevel` floor.
Additional changes in this PR
Epoch 1 → 5 (
SPECS/grub2.spec)The Epoch is bumped from 1 to 5 so that CIQ grub2 EVR outranks Rocky Linux's stock grub2 on a plain `dnf upgrade` — without this, a user running `dnf upgrade` on a CIQ system would pull in the upstream RESF grub2 instead of the CIQ build. Epoch 5 matches the shim and kernel Epoch strategy (both also at 5) so the entire secure-boot stack upgrades together.
Upgrade path: any box with Epoch 1 CIQ grub2 or Rocky grub2 (also Epoch 1) will upgrade to Epoch 5 CIQ grub2 on next `dnf upgrade`. Downgrade back to Epoch 1 requires `--allow-erasing`.
Enable `with_legacy_modules` on x86_64 (
SOURCES/grub.macros)The EL8 build had `with_legacy_modules 0` on x86_64, which meant `grub2-pc-modules` was never built. Since `grub2-pc` carries `Requires: grub2-pc-modules`, it was uninstallable and `dnf upgrade` on any box with the stock `grub2-pc` installed would fail with:
Setting `with_legacy_modules 1` restores upstream behavior and makes `grub2-pc` installable/upgradeable alongside the EFI packages.
🤖 Generated with Claude Code