Source0:	grub2-confidential-computing.macros
%include %{SOURCE0}

Name:		grub2-confidential-computing
Epoch:		1
Version:	1
Release:	2%{?dist}
Summary:	Grub image for use in confidential computing
License:	GPL-3.0-or-later
URL:		http://www.gnu.org/software/grub/

ExclusiveArch:	aarch64 x86_64

BuildRequires:	coreutils
BuildRequires:	efi-srpm-macros
BuildRequires:	findutils
BuildRequires:  git
BuildRequires:	grub2-efi-%{efiarch}
BuildRequires:	grub2-efi-%{efiarch}-modules
BuildRequires:	grub2-tools
BuildRequires:	pesign
BuildRequires:	rpm
BuildRequires:	sed
BuildRequires:	squashfs-tools

Source1:	sbat.csv.in
Source2:	grub_prefix_embedded.cfg
Source3:	grub.cfg


%description
This is a GRUB image for use in Confidential Computing Environments.

%prep
%autosetup -S git -T -c

%build

sed -e 's,@@VERSION@@,%{grub_version},g' \
    -e 's,@@VERSION_RELEASE@@,%{grub_version}-%{grub_release},g' \
    < '%{SOURCE1}' > sbat.csv

mkdir -p memdisk/fonts memdisk/grub2
cp /usr/share/grub/unicode.pf2 memdisk/fonts
cp %{SOURCE3} memdisk/grub2/grub.cfg
mksquashfs memdisk memdisk.squashfs -comp lzo

GRUB_MODULES+=%{grub_modules}
GRUB_MODULES+=%{efi_modules}
GRUB_MODULES+=%{platform_modules}

grub2-mkimage \
	-O %{grub_target_name} \
	-o grub%{efiarch}.efi.orig \
	-d /usr/lib/grub/%{grub_target_name} \
	--disable-tpm-string-pcr \
	--sbat sbat.csv \
	-m memdisk.squashfs \
	-c '%{SOURCE2}' \
	-p /EFI/%{efi_vendor} \
	${GRUB_MODULES}

%pesign -s -i grub%{efiarch}.efi.orig -o grub%{efiarch}.efi

%install
set -e
install -d -m 0700 ${RPM_BUILD_ROOT}%{grub_dir}/
install -m 700 grub%{efiarch}.efi ${RPM_BUILD_ROOT}%{grub_dir}/grub%{efiarch}.efi

%files
%dir %attr(0700,root,root) %{grub_dir}
%attr(0700,root,root) %{grub_dir}/grub%{efiarch}.efi

%changelog
* Thu Aug 06 2026 Leo Sandoval <lsandoval@redhat.com> - 1-2
- refactor

* Wed Nov 19 2025 Peter Jones <pjones@redhat.com> - 1-1
- Sigh.