feat(shim): Update shim to v16.1 w/ dual signatures

SPECS/shim/shim.signatures.json

@@ -1,8 +1,13 @@
 {
  "Signatures": {
-  "mmaa64.efi": "f4e65a70ca294857211a50e05bccbb73b3126b19bc0f3a2c78e9dc7f6131284d",
-  "mmx64.efi": "eb5f6a8a70efbc8fceeb490c7dd2d6f907870069c9045bc2f6dc562f3da1b3cb",
-  "shimaa64.efi": "7d6793523bfcc2bc0ad1042a12ffa9de130e279df06f61e2d30ece914d1d60b6",
-  "shimx64.efi": "1c36d3ce913dfae1a5cadac1d3721092855a5cd3b453100381930001dee715cb"
+  "0001-MicCorUEFCA2011_2011-06-27.der": "48e99b991f57fc52f76149599bff0a58c47154229b9f8d603ac40d3500248507",
+  "0002-microsoft_uefi_ca_2023.der": "f6124e34125bee3fe6d79a574eaa7b91c0e7bd9d929c1a321178efd611dad901",
+  "mmaa64.efi": "7fa0e0366145ec6cdafcb542647d281e4de7a229f65cf0714eff2603b47a0fc1",
+  "mmx64.efi": "c61c8050b1ddf151ba7f64f8ecfd68a2fa582d81ff34553295d27b294b00feae",
+  "shimaa64.efi.signed.MS-2011": "1e5cef920463a75ad049afe55f8ebadfebb6f512f514102e51397d5f975ca331",
+  "shimaa64.efi.signed.MS-2023": "18ba534614205578d982138dbb871874fc31cd090b62df78ae886ba5a6e2804d",
+  "shimx64.efi.signed.MS-2011": "297db23bf2ae1492927762932fbeec67f8eb79ece3c23026ea6592edca05997f",
+  "shimx64.efi.signed.MS-2023": "97b8b941af67f164e84534ae73a2593c5f0bcc30b7af68123f79df573a1b6bf4",
+  "verify_combine_sigs": "0e519f03c159c32078a6df4656d4f9517bccb40bd912bde00e315606dd51467f"
  }
-}
+}

SPECS/shim/shim.spec

@@ -36,8 +36,8 @@
 
 Summary:        First stage UEFI bootloader
 Name:           shim
-Version:        15.8
-Release:        6%{?dist}
+Version:        16.1
+Release:        1%{?dist}
 License:        BSD
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -70,8 +70,8 @@ Obsoletes:      shim-unsigned <= 15.4
 # Obsoletes behavior.
 Provides:       shim-unsigned = %{version}-%{release}
 
-# This is when grub was updated to be signed with the newer Azure Linux certificate
-Conflicts:      grub2-efi-binary < 2.06-22
+# This shim requires grub with SBAT generation 5 or greater. grub 2.06-27 is the first release with `grub,5` SBAT generation support.
+Conflicts:      grub2-efi-binary < 2.06-27
 
 %ifarch x86_64
 BuildRequires:  shim-unsigned-x64 = %{version}
@@ -84,16 +84,29 @@ BuildRequires:  coreutils
 BuildRequires:  efivar
 BuildRequires:  openssl
 BuildRequires:  pesign
+BuildRequires:  python3
+BuildRequires:  python3-cryptography
 BuildRequires:  util-linux
 
 # This is the signed shim which has been reviewed upstream by
 # https://github.com/rhboot/shim-review and then signed by the
-# Microsoft UEFI signing key
-Source0:        shim%{efiarch}.efi
+# Microsoft UEFI signing key. For 16.1, we received two signed
+# shim binaries, one signed with the 2011 signing key and one
+# signed with the 2023 signing key.
+Source0:        shim%{efiarch}.efi.signed.MS-2011
+Source1:        shim%{efiarch}.efi.signed.MS-2023
 
 # This is the MokManager EFI binaries that have been signed by the
 # Azure Linux signing cert.
-Source1:        mm%{efiarch}.efi
+Source2:        mm%{efiarch}.efi
+
+Source10:       verify_combine_sigs
+
+# These are the Microsoft UEFI signing certs that were used to sign the
+# shim binaries. These were obtained from
+# https://github.com/microsoft/secureboot_objects/blob/main/PreSignedObjects/DB/Certificates
+Source20:       0001-MicCorUEFCA2011_2011-06-27.der
+Source21:       0002-microsoft_uefi_ca_2023.der
 
 %description
 Initial UEFI bootloader that handles chaining to a trusted full bootloader
@@ -122,10 +135,13 @@ echo "%{name}" > dnf-protected.conf
 # ADD UCS-2/UTF-16 LE Byte Order Mark (BOM)
 echo -ne '\xff\xfe' | cat - %{shimdir}/BOOT%{EFIARCH}.CSV > BOOT%{EFIARCH}.CSV
 
+# Construct dual-signed shim binary
+./verify_combine_sigs -a %{efiarch} --unsigned-path %{shimdir} %{SOURCE0} %{SOURCE1}
+
 %install
 install -D dnf-protected.conf %{buildroot}%{_sysconfdir}/dnf/protected.d/%{name}.conf
 
-install -D shim%{efiarch}.efi %{buildroot}/boot/efi/EFI/BOOT/boot%{efiarch}.efi
+install -D build/shim%{efiarch}.efi.signed %{buildroot}/boot/efi/EFI/BOOT/boot%{efiarch}.efi
 
 install -D mm%{efiarch}.efi -t %{buildroot}/boot/efi/EFI/%{efidir}
 
@@ -192,6 +208,10 @@ fi
 /boot/efi/EFI/%{efidir}/*
 
 %changelog
+* Fri Jun 19 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 16.1-1
+- Update to version 16.1
+- Generate dual-signed shim
+
 * Mon Mar 02 2026 Lynsey Rydberg <lyrydber@microsoft.com> - 15.8-6
 - Change BuildRequires to allow updating shim-unsigned separately