edk2-hwe (2026.05-2ubuntu1) stonking; urgency=medium

  * Merge with src:edk2 (LP: #2153188). Remaining changes:
    - hwe: create -hwe packages (LP 2143146)
  * New changes:
    - revert: d/control : add dependencies to -hwe components (LP 2143146)

 -- Hector Cao <hector.cao@canonical.com>  Wed, 19 Aug 2026 11:51:09 +0200

edk2 (2026.05-2ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable (LP: #2153188). Remaining changes:
    - d/rules: remove the relax of strictnx in secure boots variants
      d/t/shell.py: remove tests on no-strictnx firmwares
    - d/t/shell.py : skip PVSCSI test on s390x host (LP 2143351)
    - Add FirmwareSecvarUpdater for adding Microsoft 2023 CAs
      to existing VMs (LP 2146560)
    - Add integration tests for FirmwareSecvarUpdater (LP 2146560)
    - d/control : add dependencies to -hwe components (LP 2143146)
  * Dropped changes:
    - d/control: Add missing separator, thanks lintian.
      [Fixed in Debian 2025.11-4]
    - Drop absolute symlink from future orig.tar.gz's
      [Fixed in Debian 2025.11-4]
    - d/p/no-stack-protector-all-archs.diff: Drop
      [Fixed in Debian 2025.11-4]
    - d/p/x64-baseline-abi.patch: Refresh.
      [Fixed in Debian 2025.11-4]
    - d/control, d/rules: Add ovmf-legacy package, shipping an OVMF.legacy.fd
      firmware that enables deprecated features such as PVSCSI (LP 2129178)
      [Fixed in Debian 2025.11-4]
    - d/tests: Add test-case for PVSCSI, using ovmf-legacy
      [Fixed in Debian 2025.11-4]
    - d/rules: Drop unused OVMF32 flags
      [Fixed in Debian 2025.11-4]
    - d/rules: Use OVMF_4M_COMMON_FLAGS instead of OVMF_COMMON_FLAGS
      for OVMF_4M_NO_SECBOOT_FLAGS
      [Fixed in Debian 2025.11-4]
    - d/rules: Declare AMDSEV variant flags at the top like others
      [Fixed in Debian 2025.11-4]
    - SECURITY UPDATE: Out-of-bounds read in HTTP client no_proxy handling
      + debian/patches/CVE-2025-9232.patch: add missing terminating NUL byte
        in CryptoPkg/Library/OpensslLib/openssl/crypto/http/http_lib.c.
      + CVE-2025-9232
      [Fixed in Debian 2025.11-4]
    - debian: python: fix caching issue with shutil.copyfileobj()
      [Fixed in Debian 2025.11-5]
    - d/p/0006-BaseTools-EfiRom-fix-compiler-warning.patch
      Fix FTBFS with glibc2.43 (LP 2142889)
      [Fixed in upstream edk2-stable202602]
  * The following bugs are fixed in the new merged Debian/Upstream version:
    - d/descriptors/60-edk2-x86_64-amdsev.json: set amd sev
      descriptor device to memory instead of flash
      (LP: #2160129)
      [Fixed in Debian 2026.05-2]

 -- Hector Cao <hector.cao@canonical.com>  Tue, 18 Aug 2026 12:36:40 +0200

edk2 (2026.05-2) unstable; urgency=medium

  [ dann frazier ]
  * d/rules: Enable hardening flags when building BaseTools.

  [ Hector Cao ]
  * ovmf-amdsev: descriptors: set amd sev descriptor device to memory
    instead of flash.

 -- dann frazier <dannf@debian.org>  Thu, 06 Aug 2026 09:33:19 -0600

edk2 (2026.05-1) unstable; urgency=medium

  * New upstream release, based on edk2-stable202605 tag.
    - Drop patches merged upstream:
      + ArmVirtPkg-ArmPlatformLibQemu-Support-early-ID-map-o.patch
      + OvmfPkg-RiscVVirt-PlatformPei-Do-not-set-PcdTpmBaseA.patch
      + BaseTools-Source-C-VfrCompile-Fix-parallel-make-fail.patch
    - Refresh patches:
      + x64-baseline-abi.patch
    - The GCC5 toolchain definition has been removed, switch to GCC.
  * Apply DBXUpdate-2026-06-30.amd64.bin
  * d/watch: Correct version mangling.
  * d/rules: Call BaseTools clean target in override_dh_auto_clean.
  * d/salsa-ci.yml: Disable some blhc checks that are not relevant for edk2.
  * d/*: Reformat with `wrap-and-sort`
  * d/salsa-ci.yml: Enable `wrap-and-sort` check.
  * d/copyright, d/lrc.config: Now licenserecon clean.
  * d/salsa-ci.yml: Enable `licenserecon` check.
  * d/README.source: Document initiating a new upstream release.

 -- dann frazier <dannf@debian.org>  Wed, 05 Aug 2026 15:26:14 -0600

edk2 (2026.02-3) unstable; urgency=medium

  * Try a different backport to hopefully resolve FTBFS on official builders:
    - Drop: BaseTools-VfrCompile-Add-pragma-once-support.patch
    - Add: BaseTools-Source-C-VfrCompile-Fix-parallel-make-fail.patch

 -- dann frazier <dannf@debian.org>  Mon, 27 Jul 2026 10:09:38 -0600

edk2 (2026.02-2) unstable; urgency=medium

  * Backport patch adding #pragma once support to BaseTools/VfrCompile,
    to hopefully resolve FTBFS:
    - BaseTools-VfrCompile-Add-pragma-once-support.patch

 -- dann frazier <dannf@debian.org>  Mon, 27 Jul 2026 08:23:26 -0600

edk2 (2026.02-1) unstable; urgency=medium

  * New upstream release, based on edk2-stable202602 tag.
    - Drop patches merged upstream:
      + fix_nasm_compile.patch
    - Refresh patches:
      + brotlicompress-disable.diff
      + x64-baseline-abi.patch
    - Replace reverts related to ARM LPA2 mode with upstream fix backport:
      + Drop:
        - revert-ArmPkg-UefiCpuPkg-fix-boot-failure-with-LPA2.patch
        - revert-MdePkg-UefiCpuPkg-fix-wrong-DS-bit-and-add-he.patch
        - revert-UefiCpuPkg-ArmMmuLib-Add-support-for-LPA2.patch
      + Add:
        - ArmVirtPkg-ArmPlatformLibQemu-Support-early-ID-map-o.patch
  * qemu-efi-riscv64: Backport upstream fix to avoid boot hang:
    - OvmfPkg-RiscVVirt-PlatformPei-Do-not-set-PcdTpmBaseA.patch

 -- dann frazier <dannf@debian.org>  Sun, 26 Jul 2026 17:58:40 -0600

edk2 (2025.11-5) unstable; urgency=medium

  [ Hector Cao ]
  * debian: python: fix caching issue with shutil.copyfileobj()

  [ Michael Tokarev ]
  * d/patches: revert 3 commits related to ARM LPA2 mode, for now:
    revert-ArmPkg-UefiCpuPkg-fix-boot-failure-with-LPA2.patch
    revert-MdePkg-UefiCpuPkg-fix-wrong-DS-bit-and-add-he.patch
    revert-UefiCpuPkg-ArmMmuLib-Add-support-for-LPA2.patch
    (Closes: #1124168)

 -- Michael Tokarev <mjt@tls.msk.ru>  Fri, 03 Apr 2026 14:28:05 +0300

edk2 (2025.11-4) unstable; urgency=medium

  [ Lukas Märdian ]
  * d/control: Add missing separator, thanks lintian.
  * d/p/no-stack-protector-all-archs.diff: Drop. This patch was
    added over 10 years ago for ARM and has been cargo-culted ever
    since. It's not clear what it fixed, or if it is still necessary.
    Let's find out.
  * d/p/x64-baseline-abi.patch: Refresh.
  * d/control, d/rules: Add ovmf-legacy package, shipping an OVMF.legacy.fd
    firmware that enables deprecated features such as PVSCSI (LP #2129178)
  * d/tests: Add test-case for PVSCSI, using ovmf-legacy

  [ Mate Kukri ]
  * d/rules: Drop unused OVMF32 flags
  * d/rules: Add NO_STRICTNX_COMMON_FLAGS to OVMF legacy target as well
  * d/rules: Use OVMF_4M_COMMON_FLAGS instead of OVMF_COMMON_FLAGS for
    OVMF_4M_NO_SECBOOT_FLAGS
  * d/rules: Declare AMDSEV variant flags at the top like others

  [ Hector Cao ]
  * Fix Out-of-bounds read in HTTP client no_proxy handling, CVE-2025-9232

 -- dann frazier <dannf@debian.org>  Mon, 16 Feb 2026 19:31:14 -0600

edk2-hwe (2025.11-3ubuntu9) stonking; urgency=medium

  * d/tests/secvar_update.py: relicense as GPL-2-or-later (LP: #2155270)

 -- Mate Kukri <mate.kukri@canonical.com>  Thu, 04 Jun 2026 14:29:02 +0100

edk2-hwe (2025.11-3ubuntu8) resolute; urgency=medium

  * Fix secvar update autopkgtest dependencies

 -- Mate Kukri <mate.kukri@canonical.com>  Thu, 09 Apr 2026 11:14:42 +0100

edk2-hwe (2025.11-3ubuntu7) resolute; urgency=medium

  * Add FirmwareSecvarUpdater for adding Microsoft 2023 CAs to existing VMs (LP: #2146560)
  * Add integration tests for FirmwareSecvarUpdater (LP: #2146560)
  * Build loongarch64 target again (LP: #2146540)

 -- Mate Kukri <mate.kukri@canonical.com>  Tue, 31 Mar 2026 14:21:16 +0100

edk2-hwe (2025.11-3ubuntu6) resolute; urgency=medium

  * d/t/shell.py: skip PVSCSI support on s390x host (LP: #2143351)

 -- Hector Cao <hector.cao@canonical.com>  Tue, 17 Mar 2026 10:14:17 +0100

edk2-hwe (2025.11-3ubuntu5) resolute; urgency=medium

  * d/*: creation of hwe packages (LP: #2143146)

 -- Hector Cao <hector.cao@canonical.com>  Mon, 09 Mar 2026 20:02:59 +0100

edk2 (2025.11-3ubuntu4) resolute; urgency=medium

  * d/p/0006-BaseTools-EfiRom-fix-compiler-warning.patch:
    Fix FTBFS with glibc2.43 (LP: #2142889)

 -- Simon Poirier <simon.poirier@canonical.com>  Tue, 03 Mar 2026 15:30:58 -0500

edk2 (2025.11-3ubuntu3) resolute; urgency=medium

  * Merge with Debian latest (LP: #2126016). Remaining changes:
    - SECURITY UPDATE: Out-of-bounds read in HTTP client no_proxy handling
      - debian/patches/CVE-2025-9232.patch: add missing terminating NUL byte
        in CryptoPkg/Library/OpensslLib/openssl/crypto/http/http_lib.c.
      - CVE-2025-9232
  * Dropped:
    - Add firmware for AMD SEV
      - d/rules: Build OVMF.amdsev.fd (LP #2106771)
      - d/descriptors: Add amd-sev JSON
      - d/ovmf.README.Debian: Mention OVMF.amdsev.fd firmware
    - Add firmware for Intel TDX with secure boot capability (LP #2125123)
      - d/rules : Build OVMF.tdx.fd and OVMF.tdx.secboot.fd
      - d/control : add deps on jq and python3-virt-firmware for keys
        import in OVMF.tdx.secboot.fd
      - d/descriptors : add Tdx firmware json files
      - d/ovmf.README.Debian : add doc for OVMF.tdx.*.fd
    - SECURITY UPDATE: Timing side-channel in ECDSA signature computation
      - debian/patches/CVE-2024-13176.patch: fix timing side-channel in
        CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_exp.c,
        CryptoPkg/Library/OpensslLib/openssl/crypto/ec/ec_lib.c,
        CryptoPkg/Library/OpensslLib/openssl/include/crypto/bn.h.
      - CVE-2024-13176
    - SECURITY UPDATE: DoS via integer overflow
      - debian/patches/CVE-2024-38805.patch: fix for out of bound memory
        access in NetworkPkg/IScsiDxe/IScsiProto.c.
      - CVE-2024-38805
    - SECURITY UPDATE: code execution via IDT register
      - debian/patches/CVE-2025-3770.patch: safe handling of IDT register on
        SMM entry in UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm.
      - CVE-2025-3770
  * Unreleased changes from Debian:
    + d/control: Add missing separator, thanks lintian.
    + d/p/no-stack-protector-all-archs.diff: Drop. This patch was
      added over 10 years ago for ARM and has been cargo-culted ever
      since. It's not clear what it fixed, or if it is still necessary.
      Let's find out.
    + d/p/x64-baseline-abi.patch: Refresh.
    + d/control, d/rules: Add ovmf-legacy package, shipping an OVMF.legacy.fd
      firmware that enables deprecated features such as PVSCSI (LP: #2129178)
    + d/tests: Add test-case for PVSCSI, using ovmf-legacy
    + d/rules: Declare AMDSEV variant flags at the top like others
    + d/rules: Use OVMF_4M_COMMON_FLAGS instead of OVMF_COMMON_FLAGS for OVMF_4M_NO_SECBOOT_FLAGS
    + d/rules: Add NO_STRICTNX_COMMON_FLAGS to OVMF legacy target as well
    + d/rules: Drop unused OVMF32 flags
  * New Ubuntu changes:
    + Do not build loongarch64 target
    + Enable NX in all Secure Boot variants and drop strictnx variant
    + d/python: flush the data after shutil.copyfileobj() calls

 -- Mate Kukri <mate.kukri@canonical.com>  Mon, 16 Feb 2026 13:46:23 +0000

edk2 (2025.11-3) unstable; urgency=medium

  * d/tests/control: restrict qemu-system-x86-64 dependency to 64-bit
    architectures.
  * Enable salsa-ci.

 -- dann frazier <dannf@debian.org>  Thu, 08 Jan 2026 13:58:16 -0700

edk2 (2025.11-2) unstable; urgency=medium

  * d/tests/control: restore dependency on qemu-system-aarch64
    (Closes: #1124579)

 -- Michael Tokarev <mjt@tls.msk.ru>  Sat, 03 Jan 2026 13:42:49 +0300

edk2 (2025.11-1) unstable; urgency=medium

  * New upstream release, based on edk2-stable202511 tag.
    - Refresh patches:
      + no-stack-protector-all-archs.diff
      + brotlicompress-disable.diff
      + x64-baseline-abi.patch
      + fix_nasm_compile.patch
    - Clear keyboard queue buffer to avoid leaking the password
      string, CVE-2024-38798. (Closes: #1122288)
  * Remove qemu-efi-arm, upstream has removed support for it.
  * Remove ovmf-ia32, upstream has removed support for it.
  * Split ovmf out into ovmf-generic, ovmf-amdsev, ovmf-inteltdx,
    and transition ovmf into a metapackage that depends on each
    of them. This lets users install only the packages that are
    usable on their CPUs.
  * d/control, d/tests/control: Use architecture-specific qemu-system
    virtual packages.

 -- dann frazier <dannf@debian.org>  Sun, 21 Dec 2025 18:44:07 -0700

edk2 (2025.08.01-6) unstable; urgency=medium

  * d/rules: Restore the inteltdx firmware descriptor that was
    dropped in the previous upload.

 -- dann frazier <dannf@debian.org>  Sun, 07 Dec 2025 14:01:36 -0700

edk2 (2025.08.01-5) unstable; urgency=medium

  * d/rules: Move amdsev image back to /usr/share/ovmf to match
    the firmware descriptor. (Closes: #1121768)
  * d/rules: Move inteltdx image to /usr/share/ovmf to match the
    firmware descriptor.
  * d/tests: Add tests to validate that all files referenced by
    descriptors are present.

 -- dann frazier <dannf@debian.org>  Sun, 07 Dec 2025 13:40:00 -0700

edk2 (2025.08.01-4) unstable; urgency=medium

  * d/rules: fix a typo in previous fix (AAVMF)
    (Really closes: #1121739)

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 02 Dec 2025 08:33:16 +0300

edk2 (2025.08.01-3) unstable; urgency=medium

  * d/rules: expand AAVMF_VARS.ms.fd and AAVMF_VARS.snakeoil.fd
    templates to 64M too (Closes: #1121739)

 -- Michael Tokarev <mjt@tls.msk.ru>  Mon, 01 Dec 2025 18:40:14 +0300

edk2 (2025.08.01-2) unstable; urgency=medium

  * d/tests/control: add python3-virt-firmware dependency
    (Closes: #1121368)

 -- Michael Tokarev <mjt@tls.msk.ru>  Tue, 25 Nov 2025 20:18:20 +0300

edk2 (2025.08.01-1) unstable; urgency=medium

  * New upstream release, based on edk2-stable202508.01 tag.
    - Drop patch merged upstream:
      + 0001-UefiCpuPkg-PiSmmCpuDxeSmm-Safe-handling-of-IDT-regis.patch
  * ovmf: Restore the OVMF.fd unified image that was accidentally
    dropped during the build system refactoring. (Closes: #1117405)

 -- dann frazier <dannf@debian.org>  Wed, 12 Nov 2025 07:22:23 -0700

edk2 (2025.05-2) unstable; urgency=medium

  * ovmf: Add Intel TDX support. Thanks to Hector Cao of Canonical.
  * ovmf, qemu-efi-aarch64: Correct enrolled snakeoil certificate.
    Thanks to Fiona Ebner of Proxmox.

 -- dann frazier <dannf@debian.org>  Sat, 08 Nov 2025 10:03:21 -0700

edk2 (2025.05-1) unstable; urgency=medium

  * New upstream release, based on edk2-stable202505 tag.
    - Drop patches merged upstream:
      + 0001-OvmfPkg-Use-user-specified-opt-ovmf-X-PciMmio64Mb-va.patch
      + 0001-NetworkPkg-IScsiDxe-Fix-for-Remote-Memory-Exposure-i.patch
      + 0001-OvmfPkg-QemuKernelLoaderFsDxe-fix-allocation-failure.patch
      + 0001-SecurityPkg-Out-of-bound-read-in-HashPeImageByType.patch
      + 0002-SecurityPkg-Improving-HashPeImageByType-logic.patch
      + 0003-SecurityPkg-Improving-SecureBootConfigImpl-HashPeIma.patch
      + 0004-SecurityPkg-Update-SecurityFixes.yaml-for-CVE-2024-3.patch
      + 0001-Fix-timing-side-channel-in-ECDSA-signature-computati.patch
      + 0001-NetworkPkg-IScsiDxe-Fix-for-out-of-bound-memory-acce.patch 
    - Refresh patches:
      + OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch
  * debian/tests/shell.py: Upstream has disabled autoboot for the EFI
    Shell for a number of platforms. Create a boot entry for the shell
    before running the test on those platforms.
  * Apply DBXUpdate-2025-10-16.amd64.bin.
  * ovmf: Fix regression in previous upload that dropped the amdsev
    image. Thanks to Hector Cao.
  * d/p/fix_nasm_compile.patch: Add patch to fix FTBFS w/ nasm 3.01.
    (Closes: #1119982)

 -- dann frazier <dannf@debian.org>  Mon, 03 Nov 2025 07:07:21 -0700

edk2 (2025.02-10) unstable; urgency=medium

  * debian/tests: DEB_EDK2_ROOT can now be used to specify an
    alternate install tree.
  * Rework build system:
    - Better parallelism. Previously we could do architecures builds
      in parallel, but each architecture variant was built serially.
      We now give each variant its own hardlinked build tree, so
      all images can now be built in parallel. I got a new laptop.
    - Files are now installed to debian/tmp before being moved to
      the individual packages. This gives us a tree we can test
      during the build.
  * d/control: Remove build-deps no longer needed now that we use
    virt-firmware for key enrollment.
  * Run tests at build time. (Closes: #992259).

 -- dann frazier <dannf@debian.org>  Sat, 27 Sep 2025 10:36:37 -0600

edk2 (2025.02-9) unstable; urgency=medium

  * Cherry-pick openssl fix for timing side-channel in ECDSA signature
    computation, CVE-2024-13176.
    - d/p/0001-Fix-timing-side-channel-in-ECDSA-signature-computati.patch
  * Fix out-of-bounds memory access in NetworkPkg/IScsiDxe, CVE-2024-38805.
    (Closes: #1111100).
    - d/p/0001-NetworkPkg-IScsiDxe-Fix-for-out-of-bound-memory-acce.patch
  * Use virt-firmware to enroll default keys.
  * Initialize the Secure Boot dbx in *.ms.fd with the latest revocations.
    The dbx previously only contained the hash of an empty file.
  * Safe handling of IDT register on SMM entry, CVE-2025-3770.
    (Closes: #1110533).
    - d/p/0001-UefiCpuPkg-PiSmmCpuDxeSmm-Safe-handling-of-IDT-regis.patch
  * Add amdsev image. Thanks to Lukas Märdian. (Closes: #1103961).

 -- dann frazier <dannf@debian.org>  Mon, 01 Sep 2025 14:16:19 -0600

edk2 (2025.02-8ubuntu3) questing; urgency=medium

  * SECURITY UPDATE: Timing side-channel in ECDSA signature computation
    - debian/patches/CVE-2024-13176.patch: fix timing side-channel in
      CryptoPkg/Library/OpensslLib/openssl/crypto/bn/bn_exp.c,
      CryptoPkg/Library/OpensslLib/openssl/crypto/ec/ec_lib.c,
      CryptoPkg/Library/OpensslLib/openssl/include/crypto/bn.h.
    - CVE-2024-13176
  * SECURITY UPDATE: DoS via integer overflow
    - debian/patches/CVE-2024-38805.patch: fix for out of bound memory
      access in NetworkPkg/IScsiDxe/IScsiProto.c.
    - CVE-2024-38805
  * SECURITY UPDATE: code execution via IDT register
    - debian/patches/CVE-2025-3770.patch: safe handling of IDT register on
      SMM entry in UefiCpuPkg/PiSmmCpuDxeSmm/X64/SmiEntry.nasm.
    - CVE-2025-3770
  * SECURITY UPDATE: Out-of-bounds read in HTTP client no_proxy handling
    - debian/patches/CVE-2025-9232.patch: add missing terminating NUL byte
      in CryptoPkg/Library/OpensslLib/openssl/crypto/http/http_lib.c.
    - CVE-2025-9232

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 08 Oct 2025 09:44:23 -0400

edk2 (2025.02-8ubuntu2) questing; urgency=medium

  * Add firmware for Intel TDX with secure boot capability (LP: #2125123)
    - d/rules : Build OVMF.tdx.fd and OVMF.tdx.secboot.fd
    - d/control : add deps on jq and python3-virt-firmware for keys
      import in OVMF.tdx.secboot.fd
    - d/descriptors : add Tdx firmware json files
    - d/ovmf.README.Debian : add doc for OVMF.tdx.*.fd

 -- Hector Cao <hector.cao@canonical.com>  Mon, 22 Sep 2025 12:05:25 +0000

edk2 (2025.02-8ubuntu1) questing; urgency=medium

  * d/rules: Build OVMF.amdsev.fd (LP: #2106771)
  * d/descriptors: Add amd-sev JSON
  * d/ovmf.README.Debian: Mention OVMF.amdsev.fd firmware

 -- Lukas Märdian <slyon@ubuntu.com>  Wed, 11 Jun 2025 10:03:12 +0200

edk2 (2025.02-8) unstable; urgency=medium

  * ovmf, ovmf-ia32, qemu-efi-aarch64: Uninstall the EFI_MEMORY_ATTRIBUTE
    protocol by default in the *.secboot.fd variants to avoid boot crashes
    with incompatible guest operating systems. This is to give virtual
    machine managers like libvirt and incus a release cycle to determine how
    to handle these guests. Add new *.secboot.strictnx.fd variants that users
    can opt-in to to benefit from NX security features. EFI_MEMORY_ATTRIBUTE
    support will be restored for all *.secboot.fd images at the start of
    the next devel cycle, at which point *.secboot.strictnx.fd will become
    symlink aliases. Note this in NEWS.Debian and README.Debian files.
    (Closes: #1103906).
  * Fix out-of-bounds read in HashPeImageByType(), CVE-2024-38797.
    (Closes: #1102519):
    - d/p/0001-SecurityPkg-Out-of-bound-read-in-HashPeImageByType.patch
    - d/p/0002-SecurityPkg-Improving-HashPeImageByType-logic.patch
    - d/p/0003-SecurityPkg-Improving-SecureBootConfigImpl-HashPeIma.patch
    - d/p/0004-SecurityPkg-Update-SecurityFixes.yaml-for-CVE-2024-3.patch

 -- dann frazier <dannf@debian.org>  Mon, 12 May 2025 20:18:11 -0600

edk2 (2025.02-7) unstable; urgency=medium

  * qemu-efi-aarch64: Fix regression with QEMU -kernel (Closes: #1101152):
    - d/p/0001-OvmfPkg-QemuKernelLoaderFsDxe-fix-allocation-failure.patch

 -- dann frazier <dannf@debian.org>  Wed, 16 Apr 2025 08:42:58 -0600

edk2 (2025.02-6) unstable; urgency=medium

  * d/python/UEFI/Qemu.py: Use qemu-system-arm instead of
    qemu-system-aarch64 for testing AAVMF32. I'm not sure why we weren't
    doing this before, but it is required now that QEMU is removing
    64-on-32 support.
  * d/tests/shell.py: Fix DpkgArch initialization.

 -- dann frazier <dannf@debian.org>  Mon, 07 Apr 2025 20:01:37 -0600

edk2 (2025.02-5) unstable; urgency=medium

  * qemu-efi-aarch64: Use PcdUninstallMemAttrProtocol=TRUE instead of
    reverting EFI_MEMORY_ATTRIBUTE protocol support. Drops:
    - d/p/Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch
    - d/p/ArmVirtPkg-disable-the-EFI_MEMORY_ATTRIBUTE-protocol.patch
  * qemu-efi-aarch64: Only uninstall MemAttrProtocol support in the
    no-secboot image. Users can override this with the QEMU flag:
    -fw_cfg name=opt/org.tianocore/UninstallMemAttrProtocol,string=y
  * ovmf, ovmf32: Add non-upstream patch to add support for
    PcdUninstallMemAttrProtocol and use it to disable the protocol
    on the non-secboot images by default. (Closes: #1099500). Also likely
    addresses LP: #2104316.
  * d/tests/shell.py: Create and use a DpkgArch class to load all of the
    `dpkg-architecture` variables instead of just the host arch.
  * d/tests: Only run tests for 64-bit architectures on 64-bit hosts,
    as QEMU 10 has dropped support for 64-bit architectures on 32-bit hosts.

 -- dann frazier <dannf@debian.org>  Fri, 28 Mar 2025 17:32:23 -0600

edk2 (2025.02-4) unstable; urgency=medium

  * d/tests/shell.py: Add tests to confirm that the built-in shell
    is not available in secboot variants.
  * qemu-efi-aarch64: README.Debian: Correct cut & paste errors that
    reference OVMF images.
  * ovmf: README.Debian: Explain why some images contain a built-in
    shell and others do not.
  * qemu-efi-aarch64: README.Debian: Update to describe the no-secboot
    and secboot images. Warn users that the AAVMF_CODE.fd path is a
    compat symlink that will be removed in the future.
  * Fix remote memory exposure in iSCSI DXE. CVE-2025-2295. (Closes: #1100594)
    - d/p/0001-NetworkPkg-IScsiDxe-Fix-for-Remote-Memory-Exposure-i.patch
  * ovmf, qemu-efi-aarch64: Correct typo in NEWS entry.

 -- dann frazier <dannf@debian.org>  Sun, 23 Mar 2025 12:05:21 -0600

edk2 (2025.02-3) unstable; urgency=medium

  * Return to running Secure Boot tests only for the native architecture
    until #1100819 is fixed.

 -- dann frazier <dannf@debian.org>  Tue, 18 Mar 2025 22:16:33 -0700

edk2 (2025.02-2) unstable; urgency=medium

  * ovmf, qemu-efi-aarch64: Add NEWS to tell users that network boot
    now requires the availability of a random number generator.
    LP: #2069439.
  * qemu-efi-aarch64: Restore the shell in QEMU_EFI.fd. (Closes: #1099424)
    Note: this image is deprecated and will be removed in a future update.
    Please switch to the AAVMF_CODE.* images instead. See README.Debian
    for an overview of these images.
  * ovmf: cherry-pick patch from upstream to "use user-specified
    opt/ovmf/X-PciMmio64Mb value unconditionally". LP: #2101903.
     - d/p/0001-OvmfPkg-Use-user-specified-opt-ovmf-X-PciMmio64Mb-va.patch
    Thanks to Mitchell Augustin.
  * d/tests: autopkgtest doesn't seem to support foreign arch deps in
    d/tests/control when doing native testing. Manually install signed
    grub and shim packages for amd64 and arm64 for Secure Boot tests.

 -- dann frazier <dannf@debian.org>  Sat, 15 Mar 2025 15:16:39 -0600

edk2 (2025.02-1) unstable; urgency=medium

  * New upstream release, based on edk2-stable202502 tag:
    - Drop patches merged upstream:
      + 0001-UefiCpuPkg-Adjust-the-exception-handler-logic-on-Loo.patch
      + 0002-UefiCpuPkg-Add-dump-interrupt-type-on-LoongArch64.patch
      + 0003-OvmfPkg-LoongArch-Enabling-some-base-libraries.patch
      + OvmfPkg-RiscVVirtQemu.dsc-enable-VGA-support.patch
    - d/binary-check.ignore: Update.
    - Refresh patches:
      + no-stack-protector-all-archs.diff
      + x64-baseline-abi.patch
      + Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch
      + ArmVirtPkg-disable-the-EFI_MEMORY_ATTRIBUTE-protocol.patch
  * d/tests/shell.py: Align aarch64 snakeoil tests w/ x64.
  * d/tests/shell.py: Enable test_aavmf_ms_secure_boot_signed case on
    Debian, which again provides a signed shim for arm64.
  * d/tests: Use foreign test dependencies to allow running secure_boot
    tests for amd64 and arm64 on all host architectures.
  * d/control: Update Uploaders. Thank you for everything Steve. I
    still use your notes each time I prepare a new upstream release.
    Budeš mi chybět.

 -- dann frazier <dannf@debian.org>  Sun, 02 Mar 2025 13:45:53 -0700

edk2 (2024.11-5) unstable; urgency=medium

  * qemu-efi-riscv64: enable VGA support. Thanks to Heinrich Schuchardt,
    LP: #2096703.

 -- dann frazier <dannf@debian.org>  Mon, 27 Jan 2025 17:55:52 -0700

edk2 (2024.11-4) unstable; urgency=medium

  * debian/python/UEFI/Qemu: Fix FTBFS w/ python 3.13 caused by a typo
    in the QemuEfiFlashSize class. (Closes: #1092541)

 -- dann frazier <dannf@debian.org>  Thu, 16 Jan 2025 21:50:24 -0700

edk2 (2024.11-3) unstable; urgency=medium

  [ Dandan Zhang ]
  * Add loongarch64 support. (Closes: #1091191)
    - Add qemu-efi-loongarch64 package.
      + qemu-efi-loongarch64/QEMU_EFI.fd
      + qemu-efi-loongarch64/QEMU_VARS.fd
      + qemu/firmware/60-edk2-loongarch64.json
    - Add efi-shell-loongarch64 package.
      + efi-shell-loongarch64/shellloongarch64.efi

  [ dann frazier ]
  * Cherry-pick upstream loongarch64 patches recommended by Dandan Zhang:
    - d/p/0001-UefiCpuPkg-Adjust-the-exception-handler-logic-on-Loo.patch
    - d/p/0002-UefiCpuPkg-Add-dump-interrupt-type-on-LoongArch64.patch
    - d/p/0003-OvmfPkg-LoongArch-Enabling-some-base-libraries.patch
  * debian/python/UEFI/Qemu: Drop virtio-serial-device from loongarch.
    QEMU does not currently seem to support it.

 -- dann frazier <dannf@debian.org>  Tue, 24 Dec 2024 14:19:55 -0700

edk2 (2024.11-2) unstable; urgency=medium

  * qemu-efi-riscv64: Add 60-edk2-riscv64.json firmware descriptor,
    thanks to Heinrich Schuchardt.

 -- dann frazier <dannf@debian.org>  Sun, 15 Dec 2024 21:05:33 -0700

edk2 (2024.11-1) unstable; urgency=medium

  * New upstream release, based on edk2-stable202411 tag:
    - d/rules: Vendor MbedTlsLib submodule. This is now required
      for building ARM.
      + Drop d/p/mbedtls-disable.diff
    - Drop patches merged upstream:
      + d/p/0001-MdePkg-BaseLib-RISC-V-Add-FPU-CSR-constants.patch
      + d/p/0002-UefiCpuPkg-RiscV64-initialize-FPU.patch
      + d/p/0003-OvmfPkg-RiscV64-build-BaseRiscVFpuLib.patch
      + d/p/0001-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch
      + d/p/0002-MdePkg-Improving-readability-of-CVE-patch-for-PeCoff.patch
      + d/p/0001-Avoid-type-errors-in-EAI-related-name-check-logic.patch
    - Refresh patches:
      + d/p/Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch
      + d/p/no-stack-protector-all-archs.diff
      + d/p/x64-baseline-abi.patch

 -- dann frazier <dannf@debian.org>  Mon, 25 Nov 2024 06:51:27 -0700

edk2 (2024.08-4) unstable; urgency=medium

  * d/control, d/tests/control: Update relationships to use
    qemu-system-riscv64 instead of qemu-system-misc. Thanks to
    Michael Tokarev.

 -- dann frazier <dannf@debian.org>  Fri, 25 Oct 2024 11:46:04 -0600

edk2 (2024.08-3) unstable; urgency=medium

  * Fix overflow condition in PeCoffLoaderRelocateImage(), CVE-2024-38796:
    - d/p/0001-MdePkg-Fix-overflow-issue-in-BasePeCoffLib.patch
    - d/p/0002-MdePkg-Improving-readability-of-CVE-patch-for-PeCoff.patch
    (Closes: #1084055)
  * OpenSSL: Avoid type errors in EAI-related name check logic, CVE-2024-6119:
    - d/p/0001-Avoid-type-errors-in-EAI-related-name-check-logic.patch

 -- dann frazier <dannf@debian.org>  Thu, 24 Oct 2024 11:11:27 -0600

edk2 (2024.08-2) unstable; urgency=medium

  * qemu-efi-riscv64: Fix crash in KVM-based emulation (LP: #2036604):
    - d/p/0001-MdePkg-BaseLib-RISC-V-Add-FPU-CSR-constants.patch
    - d/p/0002-UefiCpuPkg-RiscV64-initialize-FPU.patch
    - d/p/0003-OvmfPkg-RiscV64-build-BaseRiscVFpuLib.patch

 -- dann frazier <dannf@debian.org>  Fri, 04 Oct 2024 14:48:54 -0400

edk2 (2024.08-1) unstable; urgency=medium

  * New upstream release, based on edk2-stable202408 tag:
    - Vendor in the MdePkg/Library/BaseFdtLib/libfdt submodule, now
      required for building ArmVirtQemu.
    - Refresh patches:
      + d/p/no-stack-protector-all-archs.diff
      + d/p/x64-baseline-abi.patch
      + d/p/Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch
      + d/p/ArmVirtPkg-disable-the-EFI_MEMORY_ATTRIBUTE-protocol.patch

 -- dann frazier <dannf@debian.org>  Wed, 18 Sep 2024 14:37:47 -0600

edk2 (2024.05-2) unstable; urgency=medium

  [ Sergio Durigan Junior ]
  * d/rules: Unexport ELF_PACKAGE_METADATA, which causes an FTBFS due
   to misalignment issues on ELF sections. (LP: #2078252)

 -- dann frazier <dannf@debian.org>  Wed, 04 Sep 2024 20:07:05 -0600

edk2 (2024.05-1) unstable; urgency=medium

  * New upstream release, based on edk2-stable202405 tag:
    - Include new SpdmLib submodule.
    - d/binary-check.ignore: Add new upstream files.

 -- dann frazier <dannf@debian.org>  Tue, 04 Jun 2024 10:56:31 -0600

edk2 (2024.02-2) unstable; urgency=medium

  * Drop unused build-dependency on python3-distutils. (Closes: #1065854).

 -- dann frazier <dannf@debian.org>  Mon, 11 Mar 2024 08:25:33 -0600

edk2 (2024.02-1) unstable; urgency=medium

  * New upstream release, based on edk2-stable202402 tag:
    - Stop including unused mbedtls source to avoid unnecessary
      security triage:
      + d/p/mbedtls-disable.diff
    - Drop patches merged upstream:
      + d/p/0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch
      + d/p/0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch
      + d/p/0003-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch
      + d/p/0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-2.patch
      + d/p/0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch
      + d/p/0003-SecurityPkg-Adding-CVE-2022-36764-to-SecurityFixes.y.patch
      + d/p/0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-3.patch
      + d/p/0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117-2.patch
      + d/p/0003-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch
      + d/p/0001-UefiPayloadPkg-Hob-Integer-Overflow-in-CreateHob.patch
      + d/p/0001-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch
      + d/p/0002-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch
      + d/p/0003-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch
      + d/p/0004-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch
      + d/p/0005-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Un.patch
      + d/p/0006-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch
      + d/p/0007-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch
      + d/p/0008-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch
      + d/p/0009-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch
      + d/p/0010-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
      + d/p/0011-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
      + d/p/0012-MdePkg-Test-Add-gRT_GetTime-Google-Test-Mock.patch
      + d/p/0013-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
      + d/p/0014-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
      + d/p/0015-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch
   * d/binary-check.ignore: Remove globs that no longer match anything.

 -- dann frazier <dannf@debian.org>  Sun, 25 Feb 2024 15:34:27 -0700

edk2 (2023.11-8) unstable; urgency=medium

  * debian/rules: Add debug flag to edk2-vars-generator.py commands.
  * debian/python/UEFI/Qemu: Fix var template for snakeoil commands.
  * debian/rules: Fix OVMF snakeoil enrollment by using the secboot
    CODE variant.
  * debian/tests/shell.py: Detect "Access Denied" message to fix
    test_*_ms_secure_boot_unsigned cases.
  * debian/rules: switch to 64bit PEI for OVMF(X64) images now that
    it supports S3 suspend. Thanks Hector Cao.

 -- dann frazier <dannf@debian.org>  Wed, 21 Feb 2024 16:25:20 -0700

edk2 (2023.11-7) unstable; urgency=medium

  * ovmf, qemu-efi-*: Stop building Secure Boot code into non-secboot
    images so they can include a built-in shell which is unsafe in
    Secure Boot mode.
  * ovmf-ia32: Add non-secboot image. Thanks to Lionel Debroux.
    (Closes: #1023491).
  * debian/tests/shell.py: Add tests for ovmf-ia32 non-secboot image.
  * qemu-efi-aarch64: Add non-secboot variant. AAVMF_CODE.fd is the
    secboot variant, so name it AAVMF_CODE.no-secboot.fd.
  * qemu-efi-aarch64: Rename the secboot variant, AAVMF_CODE.fd,
    to AAVMF_CODE.secboot.fd and add a compat symlink.
  * ovmf, ovmf-ia32, qemu-efi-aarch64: Stop including a built-in shell
    in secboot variants, CVE-2023-48733. Thanks to Mate Kukri.
    LP: #2040137.
    - d/tests: Drop the boot-to-shell tests for images w/ Secure Boot.
    - d/tests: Update run_cmd_check_secure_boot() to not expect shell
      interaction.

 -- dann frazier <dannf@debian.org>  Wed, 14 Feb 2024 07:35:13 -0700

edk2 (2023.11-6) unstable; urgency=medium

  * Cherry-pick security fixes from upstream:
    - Fix a buffer overflow via a long server ID option in DHCPv6
      client, CVE-2023-45230:
      + 0001-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch
      + 0002-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch
      + 0003-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch
    - Fix an out-of-bounds read vulnerability when processing the IA_NA
      or IA_TA option in a DHCPv6 Advertise message, CVE-2023-45229:
      + 0004-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch
      + 0005-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Un.patch
    - Fix an out-of-bounds read when processing Neighbor Discovery
      Redirect messages, CVE-2023-45231:
      + 0006-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch
      + 0007-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch
    - Avoid an infinite loop when parsing unknown options in the
      Destination Options header of IPv6, CVE-2023-45232:
      + 0008-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch
      + 0009-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch
    - Avoid an infinite loop when parsing a PadN option in the
      Destination Options header of IPv6, CVE-2023-45233:
      + 0010-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
      + 0011-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
    - Fix a potential buffer overflow when processing a DNS Servers
      option from a DHCPv6 Advertise message, CVE-2023-45234:
      + 0013-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
    - Fix a potential buffer overflow when handling a Server ID option
      from a DHCPv6 proxy Advertise message, CVE-2023-45235:
      + 0012-MdePkg-Test-Add-gRT_GetTime-Google-Test-Mock.patch
      + 0014-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch
    - Record fixes in a SecurityFix.yaml file:
      + 0015-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch

 -- dann frazier <dannf@debian.org>  Sat, 10 Feb 2024 14:02:37 -0700

edk2 (2023.11-5) unstable; urgency=medium

  * Cherry-pick security fixes from upstream (Closes: #1060408):
    - Fix heap buffer overflow in Tcg2MeasureGptTable(), CVE-2022-36763
      + 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch
      + 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch
      + 0003-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch
    - Fix heap buffer overflow in Tcg2MeasurePeImage(), CVE-2022-36764
      + 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-2.patch
      + 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch
      + 0003-SecurityPkg-Adding-CVE-2022-36764-to-SecurityFixes.y.patch
    - Fix build failure due to symbol collision in above patches:
      + 0001-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411-3.patch
      + 0002-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117-2.patch
      + 0003-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch
    - Fix integer overflow in CreateHob(), CVE-2022-36765
      + 0001-UefiPayloadPkg-Hob-Integer-Overflow-in-CreateHob.patch

 -- dann frazier <dannf@debian.org>  Sat, 20 Jan 2024 09:13:36 -0700

edk2 (2023.11-4) unstable; urgency=medium

  * ovmf: Enable EFI_CC_MEASUREMENT_PROTOCOL. LP: #2047922.

 -- dann frazier <dannf@debian.org>  Sat, 06 Jan 2024 11:16:34 -0700

edk2 (2023.11-3) unstable; urgency=medium

  * ovmf: Fix link to migration doc (missing .gz). Closes: #1059506.
  * Add efi-shell-riscv64 package, thanks to Heinrich Schuchardt.

 -- dann frazier <dannf@debian.org>  Sun, 31 Dec 2023 11:48:34 -0700

edk2 (2023.11-2) unstable; urgency=medium

  * ovmf: Remove dangling symlink to removed 2M image:
    - /usr/share/OVMF/OVMF_CODE.ms.fd
  * autopkgtest: Add missing dependency on qemu-efi-riscv64.
  * ovmf: Add guide and tool for migrating VMs using 2M images to 4M
    images now that python3-virt-firmware is available in Debian.
  * ovmf: Restore the combined CODE/VARS image OVMF.fd, this time
    as a 4M image. Document that it is being provided as a convenience
    for testing purposes only.

 -- dann frazier <dannf@debian.org>  Sun, 24 Dec 2023 16:24:28 -0700

edk2 (2023.11-1) experimental; urgency=medium

  * New upstream release, based on edk2-stable202311 tag.
    - Include new MbedTlsLib submodule.
    - d/binary-check.ignore: Add new upstream files.
  * qemu-efi-riscv64: Add a README.Debian, thanks to Heinrich Schuchardt.
    Closes: #1054651.
  * ovmf/qemu-efi-*: Add a Suggests for the appropriate QEMU system package.
  * d/find-binaries.py: Replace nameOK() with globs in d/binary-check.ignore.
  * d/find-binaries.py: Replace extensionOK() with globs in
    d/binary-check.ignore.
  * d/copyright: Remove superfluous file patterns. Thanks lintian.
  * d/copyright: Correct globbing order. Thanks lintian.

 -- dann frazier <dannf@debian.org>  Tue, 19 Dec 2023 14:22:47 -0700

edk2 (2023.08-1) experimental; urgency=medium

  * New upstream release, based on edk2-stable202308 tag.
  * Add qemu-efi-riscv64 package.
  * Use an infinite timeout for pyexpect scripts that run during build
    to avoid build failures due to slow builders. Closes: #1049840.
  * ovmf: Drop 2M compatibility images. See README.Debian for details.
  * Add ${misc:Depends} to efi-shell-* to address lintian warning.

 -- dann frazier <dannf@debian.org>  Wed, 25 Oct 2023 07:51:53 -0600

edk2 (2023.05-2) unstable; urgency=medium

  * qemu-efi-aarch64/qemu-efi-arm: Disable the EFI_MEMORY_ATTRIBUTE
    protocol temporarily to workaround a bug in shim until distributions
    have had a chance to fix it. Closes: #1042438, LP: #2036604.
  * Drop qemu-efi transitional package. Closes: #1032695.

 -- dann frazier <dannf@debian.org>  Sat, 23 Sep 2023 08:35:39 -0600

edk2 (2023.05-1) unstable; urgency=medium

  * New upstream release, based on edk2-stable202305 tag.
    - Update debian/copyright, including change to BSD-2-Clause-Patent
      license that happened in 2019.
    - Refresh patches:
      + d/p/no-stack-protector-all-archs.diff
      + d/p/x64-baseline-abi.patch
      + d/p/Revert-ArmVirtPkg-make-EFI_LOADER_DATA-non-executabl.patch

 -- dann frazier <dannf@debian.org>  Sat, 22 Jul 2023 17:17:53 -0600

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog qemu-efi-aarch64-hwe`.
