Merge branch '3.0-dev' into 3.0

Author: jslobodzian

.github/workflows/merge-conflict-check.yml

@@ -0,0 +1,65 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+name: Github Merge Conflict Check
+
+on:
+  push:
+    branches: [main, dev, 1.0*, 2.0*, 3.0*, fasttrack/*]
+  pull_request:
+    branches: [main, dev, 1.0*, 2.0*, 3.0*, fasttrack/*]
+
+jobs:
+  spec-check:
+    name: Github Merge Conflict Check
+    runs-on: ubuntu-latest
+
+    steps:
+      # Checkout the branch of our repo that triggered this action
+      - name: Workflow trigger checkout
+        uses: actions/checkout@v4
+
+      - name: Get base commit for PRs
+        if: ${{ github.event_name == 'pull_request' }}
+        run: |
+          git fetch origin ${{ github.base_ref }}
+          echo "base_sha=$(git rev-parse origin/${{ github.base_ref }})" >> $GITHUB_ENV
+          echo "Merging ${{ github.sha }} into ${{ github.base_ref }}"
+
+      - name: Get base commit for Pushes
+        if: ${{ github.event_name == 'push' }}
+        run: |
+          git fetch origin ${{ github.event.before }}
+          echo "base_sha=${{ github.event.before }}" >> $GITHUB_ENV
+          echo "Merging ${{ github.sha }} into ${{ github.event.before }}"
+
+      - name: Check for merge conflicts
+        run: |
+          echo "Files changed: '$(git diff-tree --no-commit-id --name-only -r ${{ env.base_sha }} ${{ github.sha }})'"
+          changed_files=$(git diff-tree --diff-filter=d --no-commit-id --name-only -r ${{ env.base_sha }} ${{ github.sha }})
+
+          merge_conflict_found=false
+          for file in $changed_files ; do
+            if [ -f $file ]; then
+              echo "Checking for merge conflicts in $file"
+              if grep -H -r "^<<<<<<< HEAD$" $file; then
+                echo "Merge conflict found in $file"
+                merge_conflict_found=true
+              fi
+
+              if grep -H -r "^>>>>>>>$" $file; then
+                echo "Merge conflict found in $file"
+                merge_conflict_found=true
+              fi
+
+              if grep -H -r "^=======$" $file; then
+                echo "Merge conflict found in $file"
+                merge_conflict_found=true
+              fi
+            fi
+          done
+
+          if [[ $merge_conflict_found =~ [Tt]rue ]]; then
+            echo "Merge conflict found in one or more files"
+            exit 1
+          fi

.github/workflows/validate-cg-manifest.sh

@@ -52,7 +52,7 @@ ignore_no_source_tarball=" \
   python-rpm-generators \
   qt-rpm-macros \
   sgx-backwards-compatibility \
-  verity-read-only-root \
+  shim \
   web-assets \
   "
 

.pipelines/fasttrack/FasttrackMergeNotifier.yml

@@ -0,0 +1,39 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+# Triggers controlled on the ADO side.
+trigger: none
+
+resources:
+  repositories:
+    - repository: templates
+      type: git
+      name: OneBranch.Pipelines/GovernedTemplates
+      ref: refs/heads/main
+
+extends:
+  template: v2/OneBranch.NonOfficial.CrossPlat.yml@templates
+  parameters:
+    featureFlags:
+      runOnHost: true
+    globalSdl:
+      credscan:
+        suppressionsFile: .config/CredScanSuppressions.json
+    stages:
+      - stage: InfoPublishing
+        jobs:
+          - job: PublishMergeInfo
+            pool:
+              type: linux
+
+            variables:
+              ob_outputDirectory: "$(Pipeline.Workspace)/not_used/OB_template_complains_if_this_is_not_set"
+
+            steps:
+              - script: |
+                  set -e
+
+                  echo "##vso[build.addbuildtag]Repository.Name-$(Build.Repository.Name)"
+                  echo "##vso[build.addbuildtag]SourceBranch-$(Build.SourceBranch)"
+                  echo "##vso[build.addbuildtag]SourceVersion-$(Build.SourceVersion)"
+                displayName: "Set merge info tags"

.pipelines/templates/PackageBuild.yml

@@ -297,7 +297,7 @@ steps:
           - bash: |
               published_logs_dir="${{ parameters.outputArtifactsFolder }}/${{ parameters.outputArtifactsLogsSubfolder }}"
               mkdir -p "$published_logs_dir"
-              tar -C "${{ parameters.buildRepoRoot }}/build/logs/pkggen" -czf "$published_logs_dir/pkggen.logs.tar.gz" .
+              tar -C "${{ parameters.buildRepoRoot }}/build/logs" -czf "$published_logs_dir/pkggen.logs.tar.gz" .
               tar -C "${{ parameters.buildRepoRoot }}/build/pkg_artifacts" -czf "$published_logs_dir/pkg_artifacts.tar.gz" .
               tar -C "${{ parameters.buildRepoRoot }}/build/timestamp" -czf "$published_logs_dir/timestamp.tar.gz" .
             condition: always()

LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md

@@ -1986,6 +1986,8 @@
                 "sgpio",
                 "shared-mime-info",
                 "sharutils",
+                "shim-unsigned-aarch64",
+                "shim-unsigned-x64",
                 "sip",
                 "sisu",
                 "skkdic",
@@ -2417,9 +2419,6 @@
                 "sdbus-cpp",
                 "sgx-backwards-compatibility",
                 "shim",
-                "shim-unsigned",
-                "shim-unsigned-aarch64",
-                "shim-unsigned-x64",
                 "skopeo",
                 "span-lite",
                 "sriov-network-device-plugin",
@@ -2434,7 +2433,6 @@
                 "usrsctp",
                 "vala",
                 "valkey",
-                "verity-read-only-root",
                 "vnstat",
                 "zstd"
             ]

LICENSES-AND-NOTICES/SPECS/data/licenses.json

@@ -1,4 +1,5 @@
 %global debug_package %{nil}
+%global efidir BOOT
 %ifarch x86_64
 %global buildarch x86_64
 %global grubefiname grubx64.efi
@@ -12,7 +13,7 @@
 Summary:        Signed GRand Unified Bootloader for %{buildarch} systems
 Name:           grub2-efi-binary-signed-%{buildarch}
 Version:        2.06
-Release:        21%{?dist}
+Release:        22%{?dist}
 License:        GPLv3+
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -42,6 +43,8 @@ specifically created for installing on %{buildarch} systems
 Summary:        GRand Unified Bootloader
 Group:          Applications/System
 Requires:       grub2-tools-minimal = %{version}-%{release}
+Recommends:     shim >= 15.8-3
+Conflicts:      shim < 15.8-3
 
 # Some distros split 'grub2' into more subpackages. For now we're bundling it all together
 # inside the default package and adding these 'Provides' to make installation more user-friendly
@@ -58,6 +61,8 @@ specifically created for installing on %{buildarch} systems
 Summary:        GRand Unified Bootloader
 Group:          Applications/System
 Requires:       grub2-tools-minimal = %{version}-%{release}
+Recommends:     shim >= 15.8-3
+Conflicts:      shim < 15.8-3
 
 %description -n grub2-efi-binary-noprefix
 This package contains the GRUB EFI image with no prefix directory set and is signed for secure boot. The package is
@@ -68,17 +73,20 @@ specifically created for installing on %{buildarch} systems
 %build
 
 %install
-mkdir -p %{buildroot}/boot/efi/EFI/BOOT
-cp %{SOURCE2} %{buildroot}/boot/efi/EFI/BOOT/%{grubefiname}
-cp %{SOURCE3} %{buildroot}/boot/efi/EFI/BOOT/%{grubpxeefiname}
+mkdir -p %{buildroot}/boot/efi/EFI/%{efidir}
+cp %{SOURCE2} %{buildroot}/boot/efi/EFI/%{efidir}/%{grubefiname}
+cp %{SOURCE3} %{buildroot}/boot/efi/EFI/%{efidir}/%{grubpxeefiname}
 
 %files -n grub2-efi-binary
-/boot/efi/EFI/BOOT/%{grubefiname}
+/boot/efi/EFI/%{efidir}/%{grubefiname}
 
 %files -n grub2-efi-binary-noprefix
-/boot/efi/EFI/BOOT/%{grubpxeefiname}
+/boot/efi/EFI/%{efidir}/%{grubpxeefiname}
 
 %changelog
+* Sun Nov 10 2024 Chris Co <chrco@microsoft.com> - 2.06-22
+- Set efidir location to BOOT for eventual use in changing to "azurelinux"
+
 * Mon Oct 28 2024 Chris Co <chrco@microsoft.com> - 2.06-21
 - Bump release number to match grub release
 

SPECS-SIGNED/grub2-efi-binary-signed/grub2-efi-binary-signed.spec

@@ -10,7 +10,7 @@
 Summary:        Signed Linux Kernel for %{buildarch} systems
 Name:           kernel-signed-%{buildarch}
 Version:        6.6.57.1
-Release:        2%{?dist}
+Release:        4%{?dist}
 License:        GPLv2
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -145,6 +145,12 @@ echo "initrd of kernel %{uname_r} removed" >&2
 %exclude /module_info.ld
 
 %changelog
+* Wed Nov 06 2024 Suresh Babu Chalamalasetty <schalam@microsoft.com> - 6.6.57.1-4
+- Bump release to match kernel
+
+* Tue Nov 05 2024 Chris Co <chrco@microsoft.com> - 6.6.57.1-3
+- Bump release to match kernel
+
 * Wed Oct 30 2024 Thien Trung Vuong <tvuong@microsoft.com> - 6.6.57.1-2
 - Bump release to match kernel
 

SPECS-SIGNED/kernel-signed/kernel-signed.spec

@@ -6,7 +6,7 @@
 Summary:        Signed Unified Kernel Image for %{buildarch} systems
 Name:           kernel-uki-signed-%{buildarch}
 Version:        6.6.57.1
-Release:        2%{?dist}
+Release:        4%{?dist}
 License:        GPLv2
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -68,6 +68,12 @@ popd
 /boot/efi/EFI/Linux/vmlinuz-uki-%{kernelver}.efi
 
 %changelog
+* Wed Nov 06 2024 Suresh Babu Chalamalasetty <schalam@microsoft.com> - 6.6.57.1-4
+- Bump release to match kernel
+
+* Tue Nov 05 2024 Chris Co <chrco@microsoft.com> - 6.6.57.1-3
+- Bump release to match kernel
+
 * Wed Oct 30 2024 Thien Trung Vuong <tvuong@microsoft.com> - 6.6.57.1-2
 - Bump release to match kernel
 

SPECS-SIGNED/kernel-uki-signed/kernel-uki-signed.spec

@@ -5,7 +5,7 @@
 Summary:        Azure Linux release files
 Name:           azurelinux-release
 Version:        %{dist_version}.0
-Release:        21%{?dist}
+Release:        22%{?dist}
 License:        MIT
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -118,6 +118,9 @@ install -Dm0644 %{SOURCE4} -t %{buildroot}%{_sysctldir}/
 %{_sysctldir}/*.conf
 
 %changelog
+* Fri Nov 22 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 3.0-22
+- Bump release for December 2024 Update
+
 * Fri Oct 25 2024 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 3.0-21
 - Bump release for November 2024