==> Synchronizing chroot copy [/home/leming/armv8/root] -> [leming]...done
==> Making package: efitools 1.9.2-6 (Thu Aug 28 12:33:57 2025)
==> Retrieving sources...
-> Cloning efitools git repo...
Cloning into bare repository '/home/leming/work/efitools/efitools'...
-> Found efitools-1.9.2-console_warning_typo.patch
-> Found efitools-1.9.2-makefile-enable-harden-local-files.patch
-> Found efitools-1.9.2-fix-make-rule-deps.patch
-> Found efitools-1.9.2-fix-ftbfs.patch
==> WARNING: Skipping verification of source file PGP signatures.
==> Validating source files with sha512sums...
efitools ... Skipped
efitools-1.9.2-console_warning_typo.patch ... Passed
efitools-1.9.2-makefile-enable-harden-local-files.patch ... Passed
efitools-1.9.2-fix-make-rule-deps.patch ... Passed
efitools-1.9.2-fix-ftbfs.patch ... Passed
==> Validating source files with b2sums...
efitools ... Skipped
efitools-1.9.2-console_warning_typo.patch ... Passed
efitools-1.9.2-makefile-enable-harden-local-files.patch ... Passed
efitools-1.9.2-fix-make-rule-deps.patch ... Passed
efitools-1.9.2-fix-ftbfs.patch ... Passed
==> Making package: efitools 1.9.2-6 (Thu 28 Aug 2025 12:34:04 PM MDT)
==> Checking runtime dependencies...
==> Checking buildtime dependencies...
==> Installing missing dependencies...
[?25lresolving dependencies...
looking for conflicting packages...
Packages (10) perl-error-0.17030-2 perl-locale-gettext-1.07-16
perl-mailtools-2.22-2 perl-timedate-2.33-8 zlib-ng-2.2.5-1
git-2.51.0-1 gnu-efi-3.0.18-2 help2man-1.49.3-2
perl-file-slurp-9999.32-5 sbsigntools-0.9.5-3
Total Download Size: 8.34 MiB
Total Installed Size: 48.59 MiB
:: Proceed with installation? [Y/n]
:: Retrieving packages...
git-2.51.0-1-aarch64 downloading...
gnu-efi-3.0.18-2-aarch64 downloading...
help2man-1.49.3-2-aarch64 downloading...
zlib-ng-2.2.5-1-aarch64 downloading...
perl-mailtools-2.22-2-any downloading...
sbsigntools-0.9.5-3-aarch64 downloading...
perl-timedate-2.33-8-any downloading...
perl-error-0.17030-2-any downloading...
perl-file-slurp-9999.32-5-any downloading...
perl-locale-gettext-1.07-16-aarch64 downloading...
checking keyring...
checking package integrity...
loading package files...
checking for file conflicts...
checking available disk space...
:: Processing package changes...
installing perl-error...
installing perl-timedate...
installing perl-mailtools...
installing zlib-ng...
installing git...
Optional dependencies for git
git-zsh-completion: upstream zsh completion
tk: gitk and git gui
openssh: ssh transport and crypto
man: show help with `git command --help`
perl-libwww: git svn
perl-term-readkey: git svn and interactive.singlekey setting
perl-io-socket-ssl: git send-email TLS support
perl-authen-sasl: git send-email TLS support
perl-mediawiki-api: git mediawiki support
perl-datetime-format-iso8601: git mediawiki support
perl-lwp-protocol-https: git mediawiki https support
perl-cgi: gitweb (web interface) support
python: git svn & git p4 [installed]
subversion: git svn
org.freedesktop.secrets: keyring credential helper
libsecret: libsecret credential helper [installed]
less: the default pager for git [installed]
installing gnu-efi...
installing perl-locale-gettext...
installing help2man...
installing perl-file-slurp...
installing sbsigntools...
:: Running post-transaction hooks...
(1/5) Creating system user accounts...
Creating group 'git' with GID 971.
Creating user 'git' (git daemon user) with UID 971 and GID 971.
(2/5) Reloading system manager configuration...
Skipped: Current root is not booted.
(3/5) Arming ConditionNeedsUpdate...
(4/5) Checking for old perl modules...
(5/5) Updating the info directory file...
[?25h==> Retrieving sources...
-> Found efitools-1.9.2-console_warning_typo.patch
-> Found efitools-1.9.2-makefile-enable-harden-local-files.patch
-> Found efitools-1.9.2-fix-make-rule-deps.patch
-> Found efitools-1.9.2-fix-ftbfs.patch
==> WARNING: Skipping all source file integrity checks.
==> Extracting sources...
-> Creating working copy of efitools git repo...
Cloning into 'efitools'...
done.
Switched to a new branch 'makepkg'
==> Starting prepare()...
patching file lib/console.c
patching file Makefile
patching file Make.rules
patching file Make.rules
Hunk #1 succeeded at 15 (offset -2 lines).
patching file cert-to-efi-sig-list.c
patching file efi-keytool.c
patching file efi-readvar.c
patching file efi-updatevar.c
patching file flash-var.c
patching file hash-to-efi-sig-list.c
patching file lib/kernel_efivars.c
patching file sig-list-to-certs.c
patching file sign-efi-sig-list.c
patching file lib/asn1/oid.h
patching file Makefile
==> Starting build()...
make: Entering directory '/build/efitools/src/efitools'
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c cert-to-efi-sig-list.c -o cert-to-efi-sig-list.o
make -C lib lib.a
make[1]: Entering directory '/build/efitools/src/efitools/lib'
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c simple_file.c -o simple_file.o
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c pecoff.c -o pecoff.o
pecoff.c: In function 'pecoff_relocate':
pecoff.c:197:10: warning: too many arguments for format [-Wformat-extra-args]
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c guid.c -o guid.o
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c sha256.c -o sha256.o
sha256.c: In function 'sha256_get_pecoff_digest_mem':
sha256.c:360:10: warning: too many arguments for format [-Wformat-extra-args]
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c console.c -o console.o
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c execute.c -o execute.o
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c configtable.c -o configtable.o
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c shell.c -o shell.o
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c security_policy.c -o security_policy.o
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c shim_protocol.c -o shim_protocol.o
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c pkcs7verify.c -o pkcs7verify.o
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c kernel_efivars.c -o kernel_efivars.o
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c openssl_sign.c -o openssl_sign.o
openssl_sign.c: In function 'read_engine_private_key':
openssl_sign.c:118:2: warning: 'ENGINE_load_builtin_engines' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
In file included from openssl_sign.c:10:
/usr/include/openssl/engine.h:358:58: note: declared here
358 | OSSL_DEPRECATEDIN_3_0 void ENGINE_load_builtin_engines(void);
| ^~~~
openssl_sign.c:119:2: warning: 'ENGINE_by_id' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
/usr/include/openssl/engine.h:336:61: note: declared here
336 | OSSL_DEPRECATEDIN_3_0 ENGINE *ENGINE_by_id(const char *id);
| ^
openssl_sign.c:135:2: warning: 'ENGINE_init' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
/usr/include/openssl/engine.h:620:57: note: declared here
620 | OSSL_DEPRECATEDIN_3_0 int ENGINE_init(ENGINE *e);
| ^
openssl_sign.c:141:2: warning: 'ENGINE_load_private_key' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
/usr/include/openssl/engine.h:638:11: note: declared here
638 | EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
| ^~~~~~~~~~~~~~~~~~~~~~~
openssl_sign.c:142:2: warning: 'ENGINE_finish' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
/usr/include/openssl/engine.h:628:57: note: declared here
628 | OSSL_DEPRECATEDIN_3_0 int ENGINE_finish(ENGINE *e);
| ^
openssl_sign.c:145:2: warning: 'ENGINE_free' is deprecated: Since OpenSSL 3.0 [-Wdeprecated-declarations]
/usr/include/openssl/engine.h:493:57: note: declared here
493 | OSSL_DEPRECATEDIN_3_0 int ENGINE_free(ENGINE *e);
| ^
ar rcv lib.a simple_file.o pecoff.o guid.o sha256.o console.o execute.o configtable.o shell.o security_policy.o shim_protocol.o pkcs7verify.o kernel_efivars.o openssl_sign.o
a - simple_file.o
a - pecoff.o
a - guid.o
a - sha256.o
a - console.o
a - execute.o
a - configtable.o
a - shell.o
a - security_policy.o
a - shim_protocol.o
a - pkcs7verify.o
a - kernel_efivars.o
a - openssl_sign.o
make[1]: Leaving directory '/build/efitools/src/efitools/lib'
cc -o cert-to-efi-sig-list cert-to-efi-sig-list.o -march=armv8-a -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security -fstack-clash-protection -Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now lib/lib.a -lcrypto
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c sig-list-to-certs.c -o sig-list-to-certs.o
cc -o sig-list-to-certs sig-list-to-certs.o -march=armv8-a -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security -fstack-clash-protection -Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now lib/lib.a -lcrypto
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c sign-efi-sig-list.c -o sign-efi-sig-list.o
cc -o sign-efi-sig-list sign-efi-sig-list.o -march=armv8-a -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security -fstack-clash-protection -Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now lib/lib.a -lcrypto
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c hash-to-efi-sig-list.c -o hash-to-efi-sig-list.o
hash-to-efi-sig-list.c: In function 'main':
hash-to-efi-sig-list.c:96:11: warning: format '%d' expects argument of type 'int', but argument 3 has type 'EFI_STATUS' {aka 'long unsigned int'} [-Wformat=]
cc -o hash-to-efi-sig-list hash-to-efi-sig-list.o -march=armv8-a -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security -fstack-clash-protection -Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now lib/lib.a
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c efi-readvar.c -o efi-readvar.o
cc -o efi-readvar efi-readvar.o -march=armv8-a -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security -fstack-clash-protection -Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now lib/lib.a -lcrypto
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c efi-updatevar.c -o efi-updatevar.o
cc -o efi-updatevar efi-updatevar.o -march=armv8-a -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security -fstack-clash-protection -Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now lib/lib.a -lcrypto
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c cert-to-efi-hash-list.c -o cert-to-efi-hash-list.o
cert-to-efi-hash-list.c:9:9: warning: "_XOPEN_SOURCE" redefined
9 | #define _XOPEN_SOURCE
| ^~~~~~~~~~~~~
<command-line>: note: this is the location of the previous definition
cc -o cert-to-efi-hash-list cert-to-efi-hash-list.o -march=armv8-a -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security -fstack-clash-protection -Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now lib/lib.a -lcrypto
cc -I/build/efitools/src/efitools/include/ -I/usr/include/efi -I/usr/include/efi/aarch64 -I/usr/include/efi/protocol -O2 -g -fpic -Wall -fshort-wchar -fno-strict-aliasing -fno-merge-constants -D_XOPEN_SOURCE=700 -DGNU_EFI_USE_MS_ABI -DCONFIG_aarch64 -c flash-var.c -o flash-var.o
flash-var.c: In function 'main':
flash-var.c:185:2: warning: 'memset' offset [0, 56] is out of the bounds [0, 0] [-Warray-bounds=]
cc -o flash-var flash-var.o -march=armv8-a -O2 -pipe -fno-plt -fexceptions -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security -fstack-clash-protection -Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now lib/lib.a
help2man --no-info -i doc/cert-to-efi-hash-list.1.in -o doc/cert-to-efi-hash-list.1 ./cert-to-efi-hash-list
help2man --no-info -i doc/cert-to-efi-sig-list.1.in -o doc/cert-to-efi-sig-list.1 ./cert-to-efi-sig-list
help2man --no-info -i doc/efi-readvar.1.in -o doc/efi-readvar.1 ./efi-readvar
help2man --no-info -i doc/efi-updatevar.1.in -o doc/efi-updatevar.1 ./efi-updatevar
help2man --no-info -i doc/hash-to-efi-sig-list.1.in -o doc/hash-to-efi-sig-list.1 ./hash-to-efi-sig-list
help2man --no-info -i doc/sig-list-to-certs.1.in -o doc/sig-list-to-certs.1 ./sig-list-to-certs
help2man --no-info -i doc/sign-efi-sig-list.1.in -o doc/sign-efi-sig-list.1 ./sign-efi-sig-list
> noPK.esl
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=PK/" -keyout PK.key -out PK.crt -days 3650 -nodes -sha256
.......+.+++++++++++++++++++++++++++++++++++++++*...+.......+........+++++++++++++++++++++++++++++++++++++++*.......+.....+.........+.........+.......+...+.....+.+......++++++
..+....+...........+++++++++++++++++++++++++++++++++++++++*.+.....+.+..+....+.....+....+++++++++++++++++++++++++++++++++++++++*........+.+....................+.+..+.......+.........+......+.........+......+.....+.+.................+............+.........+.+...+..+....+..+...+............+.......+..+...+.......+........................+...........+....+..+....+..............+.......+........+....+...+..+...............+.............+...+......+......+...............+..+...+...+....+...+........+.+...........+......................+..+..................++++++
-----
./sign-efi-sig-list -t "2025-08-28 12:34:25" -c PK.crt -k PK.key PK noPK.esl noPK.auth
Timestamp is 2025-8-28 12:34:25
Authentication Payload size 40
Signature of size 1148
Signature at: 40
./cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc PK.crt PK.esl
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=KEK/" -keyout KEK.key -out KEK.crt -days 3650 -nodes -sha256
..+...+............+.........+....+...+++++++++++++++++++++++++++++++++++++++*..+......+.........+...+.........+.+........+....+......+.....+.......+++++++++++++++++++++++++++++++++++++++*........+.....+.+...+.........+...+.....+....+...+......+.........+.....+.+.....+.......+..............+.+...+..+.......+.....+...+....+..............+......+...+...+.......+..+.........+.+......+..+.+..+..........+..++++++
.+..+.......+++++++++++++++++++++++++++++++++++++++*.+...+++++++++++++++++++++++++++++++++++++++*.+.....+.+.....+...+......+....+...+..................+...........+....+..+............+.+..+.......+......+...........+.+............+..+.+.....+....+...+...........+.......+..+...+.............+.........+.................+...+.......+.....+.+..+.+.....+.+.....+......+....+..............+....+..+...+.+.........+..+....+.........+...+.........+.........+......+......+........+....+..+......+.......+...+...............+...+..............+.+..+....+......+.........+..............+..........+.....+......+...+......+............+..........+..+..........+............+...+...+........+......+...+......+......+....+......+...+............+.....+....+.................+....+...+..+......+....+......+...+..++++++
-----
./sign-efi-sig-list -c PK.crt -k PK.key PK PK.esl PK.auth
Timestamp is 2025-8-28 12:34:25
Authentication Payload size 851
Signature of size 1148
Signature at: 40
./cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc KEK.crt KEK.esl
./sign-efi-sig-list -c PK.crt -k PK.key KEK KEK.esl KEK.auth
Timestamp is 2025-8-28 12:34:26
Authentication Payload size 855
Signature of size 1148
Signature at: 40
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=DB/" -keyout DB.key -out DB.crt -days 3650 -nodes -sha256
.....+...............+.......+....................+...+...+.......+...+..+...+.+++++++++++++++++++++++++++++++++++++++*.+...+++++++++++++++++++++++++++++++++++++++*...........+......+.......+...+..+....+...+...........+..........+..+...+.+.....+.............+..+.........+....+...+...+.........+......+..+....+...+........+....+.....+....+...........+.+...+.....+......+.+.....+...+.......+...+.........+............+...+..+......+..........+..+......+.+..............+.......+..++++++
.+.....................+++++++++++++++++++++++++++++++++++++++*.....+....+...+...............+...+.........+..+...+.......+......+.....+....+........+++++++++++++++++++++++++++++++++++++++*.+...+..+...............+......+.+.....+...................+..+............+.+..+....+.........+......+...+.....+......+....+......+.....+.+.....+.+..............+......+...+.+...........+.......+...+..+............+...+.+.....+.+......++++++
-----
./cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc DB.crt DB.esl
./sign-efi-sig-list -c KEK.crt -k KEK.key db DB.esl DB.auth
Timestamp is 2025-8-28 12:34:26
Authentication Payload size 851
Signature of size 1151
Signature at: 40
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=DB1/" -keyout DB1.key -out DB1.crt -days 3650 -nodes -sha256
.....+.....+.+++++++++++++++++++++++++++++++++++++++*...+....+......+.....+....+............+...........+....+.....+...+...+.......+......+............+...+++++++++++++++++++++++++++++++++++++++*.....+..........+............+......+............+..+.+.....+.........+.........................+..............+................+...+.....+......+......+.............+...+..............................+..+.+..+...............+...+..........+..+....+........+.+.....+................+...+........+...+.....................+.+..+.+..+....+...+..++++++
......+...+...........+......+.......+...........+....+.....+.+..+............+.+..............+...+...+.+...+..+++++++++++++++++++++++++++++++++++++++*....+.......+.........+.....+++++++++++++++++++++++++++++++++++++++*...........+......+..+...+.......+...+...........+......+..........+..+...+............+......+.+.........+..+....+......+..+.......+...+..+.+........+.......+.....+.............+.....+............+..........+........+......+..................+.......+.........+.........+..+...+...+.......+......+.....+.......+..+.+.....+.+........+......+.........+.+......+........+...+...+......+...............+.+...+....................+.+...+...+..+...+....+....................+.+..............++++++
-----
./cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc DB1.crt DB1.esl
./sign-efi-sig-list -c KEK.crt -k KEK.key db DB1.esl DB1.auth
Timestamp is 2025-8-28 12:34:27
Authentication Payload size 853
Signature of size 1151
Signature at: 40
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=DB2/" -keyout DB2.key -out DB2.crt -days 3650 -nodes -sha256
...............+....+..+...+...+.........+..........+........+............+...+.+.....+......+...+.+......+...........+..........+...+..+...............+...............+++++++++++++++++++++++++++++++++++++++*..+++++++++++++++++++++++++++++++++++++++*....+.....+.+.....+.....................+.+........+......+.+...+.........+..+......+.........+....+......+..............+......+.+..+.............+..+...............+.......+...+......+.........+...+..............+.........+....+...+..+......+.+......+..............+..................+.......+..................+..+...+..................+...+.......+.....+....+......+.........+...........+..................++++++
....+..+++++++++++++++++++++++++++++++++++++++*........+++++++++++++++++++++++++++++++++++++++*.....+..............+.+...+......+..+.......+..+.+..+...............+.............+...............+..+......+......+.+.....+...+......................+...+...........+...+.+......+.........+.........+......+..+.......+...........+.+.........+..+....+.....+...+.............+.....+.........+......+.........+....+.....+.+..............+.......+........+.+........+.......+.....+.+..+..........+......+.................+.........+...+.+..+.......+........+....+...+.....+.+.....+.........+..........+...+........+..........+.........++++++
-----
./cert-to-efi-sig-list -g 11111111-2222-3333-4444-123456789abc DB2.crt DB2.esl
./sign-efi-sig-list -c KEK.crt -k KEK.key db DB2.esl DB2.auth
Timestamp is 2025-8-28 12:34:28
Authentication Payload size 853
Signature of size 1151
Signature at: 40
./cert-to-efi-sig-list -g 77FA9ABD-0359-4D32-BD60-28F4E78F784B ms-uefi.crt ms-uefi.esl
./sign-efi-sig-list -c KEK.crt -k KEK.key db ms-uefi.esl ms-uefi.auth
Timestamp is 2025-8-28 12:34:28
Authentication Payload size 1640
Signature of size 1151
Signature at: 40
./cert-to-efi-sig-list -g 77FA9ABD-0359-4D32-BD60-28F4E78F784B ms-kek.crt ms-kek.esl
./sign-efi-sig-list -c KEK.crt -k KEK.key db ms-kek.esl ms-kek.auth
Timestamp is 2025-8-28 12:34:29
Authentication Payload size 1600
Signature of size 1151
Signature at: 40
./sign-efi-sig-list -a -c PK.crt -k PK.key PK PK.esl PK-update.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 851
Signature of size 1148
Signature at: 40
./sign-efi-sig-list -a -c PK.crt -k PK.key KEK KEK.esl KEK-update.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 855
Signature of size 1148
Signature at: 40
./sign-efi-sig-list -a -c KEK.crt -k KEK.key db DB.esl DB-update.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 851
Signature of size 1151
Signature at: 40
./sign-efi-sig-list -a -c KEK.crt -k KEK.key db DB1.esl DB1-update.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 853
Signature of size 1151
Signature at: 40
./sign-efi-sig-list -a -c KEK.crt -k KEK.key db DB2.esl DB2-update.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 853
Signature of size 1151
Signature at: 40
./sign-efi-sig-list -a -c KEK.crt -k KEK.key db ms-uefi.esl ms-uefi-update.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 1640
Signature of size 1151
Signature at: 40
./sign-efi-sig-list -a -c KEK.crt -k KEK.key db ms-kek.esl ms-kek-update.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 1600
Signature of size 1151
Signature at: 40
./sign-efi-sig-list -a -c PK.crt -k PK.key PK PK.esl PK-pkupdate.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 851
Signature of size 1148
Signature at: 40
./sign-efi-sig-list -a -c PK.crt -k PK.key KEK KEK.esl KEK-pkupdate.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 855
Signature of size 1148
Signature at: 40
./sign-efi-sig-list -a -c PK.crt -k PK.key db DB.esl DB-pkupdate.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 851
Signature of size 1148
Signature at: 40
./sign-efi-sig-list -a -c PK.crt -k PK.key db DB1.esl DB1-pkupdate.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 853
Signature of size 1148
Signature at: 40
./sign-efi-sig-list -a -c PK.crt -k PK.key db DB2.esl DB2-pkupdate.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 853
Signature of size 1148
Signature at: 40
./sign-efi-sig-list -a -c PK.crt -k PK.key db ms-uefi.esl ms-uefi-pkupdate.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 1640
Signature of size 1148
Signature at: 40
./sign-efi-sig-list -a -c PK.crt -k PK.key db ms-kek.esl ms-kek-pkupdate.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 1600
Signature of size 1148
Signature at: 40
./cert-to-efi-sig-list PK.crt PK-blacklist.esl
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx PK-blacklist.esl PK-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 853
Signature of size 1151
Signature at: 40
./cert-to-efi-sig-list KEK.crt KEK-blacklist.esl
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx KEK-blacklist.esl KEK-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 855
Signature of size 1151
Signature at: 40
./cert-to-efi-sig-list DB.crt DB-blacklist.esl
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx DB-blacklist.esl DB-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 853
Signature of size 1151
Signature at: 40
./cert-to-efi-sig-list DB1.crt DB1-blacklist.esl
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx DB1-blacklist.esl DB1-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 855
Signature of size 1151
Signature at: 40
./cert-to-efi-sig-list DB2.crt DB2-blacklist.esl
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx DB2-blacklist.esl DB2-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 855
Signature of size 1151
Signature at: 40
./cert-to-efi-sig-list ms-uefi.crt ms-uefi-blacklist.esl
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx ms-uefi-blacklist.esl ms-uefi-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 1642
Signature of size 1151
Signature at: 40
./cert-to-efi-sig-list ms-kek.crt ms-kek-blacklist.esl
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx ms-kek-blacklist.esl ms-kek-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 1602
Signature of size 1151
Signature at: 40
./cert-to-efi-hash-list PK.crt PK-hash-blacklist.esl
TimeOfRevocation is 0-0-0 00:00:00
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx PK-hash-blacklist.esl PK-hash-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 134
Signature of size 1151
Signature at: 40
./cert-to-efi-hash-list KEK.crt KEK-hash-blacklist.esl
TimeOfRevocation is 0-0-0 00:00:00
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx KEK-hash-blacklist.esl KEK-hash-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 134
Signature of size 1151
Signature at: 40
./cert-to-efi-hash-list DB.crt DB-hash-blacklist.esl
TimeOfRevocation is 0-0-0 00:00:00
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx DB-hash-blacklist.esl DB-hash-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 134
Signature of size 1151
Signature at: 40
./cert-to-efi-hash-list DB1.crt DB1-hash-blacklist.esl
TimeOfRevocation is 0-0-0 00:00:00
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx DB1-hash-blacklist.esl DB1-hash-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 134
Signature of size 1151
Signature at: 40
./cert-to-efi-hash-list DB2.crt DB2-hash-blacklist.esl
TimeOfRevocation is 0-0-0 00:00:00
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx DB2-hash-blacklist.esl DB2-hash-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 134
Signature of size 1151
Signature at: 40
./cert-to-efi-hash-list ms-uefi.crt ms-uefi-hash-blacklist.esl
TimeOfRevocation is 0-0-0 00:00:00
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx ms-uefi-hash-blacklist.esl ms-uefi-hash-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 134
Signature of size 1151
Signature at: 40
./cert-to-efi-hash-list ms-kek.crt ms-kek-hash-blacklist.esl
TimeOfRevocation is 0-0-0 00:00:00
./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx ms-kek-hash-blacklist.esl ms-kek-hash-blacklist.auth
Timestamp is 0-0-0 00:00:00
Authentication Payload size 134
Signature of size 1151
Signature at: 40
rm KEK-blacklist.esl ms-kek.esl DB1.crt DB1.esl PK-hash-blacklist.esl DB2-blacklist.esl ms-kek-blacklist.esl ms-uefi-hash-blacklist.esl ms-uefi-blacklist.esl KEK-hash-blacklist.esl DB-blacklist.esl DB1-hash-blacklist.esl ms-uefi.esl DB2.esl DB2.crt ms-kek-hash-blacklist.esl PK-blacklist.esl DB2-hash-blacklist.esl DB-hash-blacklist.esl DB1-blacklist.esl
make: Leaving directory '/build/efitools/src/efitools'
==> Entering fakeroot environment...
==> Starting package()...
make: Entering directory '/build/efitools/src/efitools'
make -C lib lib.a
make[1]: Entering directory '/build/efitools/src/efitools/lib'
make[1]: 'lib.a' is up to date.
make[1]: Leaving directory '/build/efitools/src/efitools/lib'
install -m 755 -d /build/efitools/pkg/efitools/usr/share/man/man1
install -m 644 doc/cert-to-efi-hash-list.1 doc/cert-to-efi-sig-list.1 doc/efi-readvar.1 doc/efi-updatevar.1 doc/hash-to-efi-sig-list.1 doc/sig-list-to-certs.1 doc/sign-efi-sig-list.1 /build/efitools/pkg/efitools/usr/share/man/man1
install -m 755 -d /build/efitools/pkg/efitools/usr/bin
install -m 755 cert-to-efi-sig-list sig-list-to-certs sign-efi-sig-list hash-to-efi-sig-list efi-readvar efi-updatevar cert-to-efi-hash-list flash-var /build/efitools/pkg/efitools/usr/bin
install -m 755 mkusb.sh /build/efitools/pkg/efitools/usr/bin/efitool-mkusb
install -m 755 -d /build/efitools/pkg/efitools/usr/share/efitools
install -m 644 README COPYING /build/efitools/pkg/efitools/usr/share/efitools
make: Leaving directory '/build/efitools/src/efitools'
install: creating directory '/build/efitools/pkg/efitools/usr/share/doc'
install: creating directory '/build/efitools/pkg/efitools/usr/share/doc/efitools'
'efitools/README' -> '/build/efitools/pkg/efitools/usr/share/doc/efitools/README'
==> Tidying install...
-> Removing libtool files...
-> Purging unwanted files...
-> Removing static library files...
-> Stripping unneeded symbols from binaries and libraries...
-> Compressing man and info pages...
==> Checking for packaging issues...
==> Creating package "efitools"...
-> Generating .PKGINFO file...
-> Generating .BUILDINFO file...
-> Generating .MTREE file...
-> Compressing package...
==> Leaving fakeroot environment.
==> Finished making: efitools 1.9.2-6 (Thu 28 Aug 2025 12:34:38 PM MDT)
==> Cleaning up...