2026-08-31  Leo Sandoval  <lsandova@redhat.com>

	Release 2.16~rc2

2026-08-31  Leo Sandoval  <lsandova@redhat.com>

	CI: Create a 'Release' Pipeline
	The idea is to automate the whole release process, candidate or final,
	where maintainer tags a commit (and pushes) then the proposed pipeline
	kicks and produce the release similar as [1].

	[1] https://gitlab.freedesktop.org/lsandova/grub/-/releases/grub-2.16-rc1

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Reviewed-by: Josue Hernandez <josherna@redhat.com>
	Reviewed-by: Michael Chang <mchang@suse.com>
	Reviewed-by: Peter Jones <pjones@redhat.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Suggested-by: Daniel Kiper <daniel.kiper@oracle.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/238>

2026-08-27  Mate Kukri  <mate.kukri@canonical.com>

	Makefile.extra-dist: Add missing libtasn1 patch to EXTRA_DIST
	Without this the release tarball will be unbuildable.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/251>

2026-08-25  Mate Kukri  <mate.kukri@canonical.com>
	    Mate Kukri  <mate.kukri@canonical.com>

	efi/linux: set the loaded image device path when it is missing
	Under Secure Boot grub verifies the kernel in its verifier framework
	(grub-core/kern/efi/sb.c). The verifier loads it through the shim image loader
	protocol, passing only the image buffer and a NULL device path, because the
	device path is not available at that point. The verified image handle, which
	linux reuses, is therefore left with no device path: both
	loaded_image->file_path and the LOADED_IMAGE_DEVICE_PATH protocol are NULL.

	This is a consequence of grub loading the image inside the verifier, separate
	from where the device path is built. The kernel should see the same memory
	mapped path it would get from a normal load.

	A memory mapped device path is already built for grub_efi_load_image(). Also
	point loaded_image->file_path and the LOADED_IMAGE_DEVICE_PATH protocol at it.
	The image's loader owns those fields and frees them with the EFI pool
	allocator, so save the originals and restore them before unloading the image if
	it returns.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Peter Jones <pjones@redhat.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Pavel Valena <pvalena@redhat.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/226>

2026-08-25  Mate Kukri  <mate.kukri@canonical.com>
	    Mate Kukri  <mate.kukri@canonical.com>

	efi/chainloader: set the loaded image device path when it is missing
	Under Secure Boot grub verifies images in its verifier framework
	(grub-core/kern/efi/sb.c). The verifier loads the image through the shim image
	loader protocol, passing only the image buffer and a NULL device path, because
	the device path is not available at that point. The verified image handle,
	which the chainloader reuses, is therefore left with no device path: both
	loaded_image->file_path and the LOADED_IMAGE_DEVICE_PATH protocol are NULL.

	This is a consequence of grub loading the image inside the verifier, separate
	from where the device path is built. Images that walk their own device path
	then loop forever looking for the end node. Windows' bootmgfw.efi does this and
	the machine hangs.

	The chainloader already builds the file's device path. Also point
	loaded_image->file_path and the LOADED_IMAGE_DEVICE_PATH protocol at it. The
	image's loader owns those fields and frees them with the EFI pool allocator, so
	save the originals and restore them before unloading the image if it returns.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Peter Jones <pjones@redhat.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Pavel Valena <pvalena@redhat.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/226>

2026-08-25  Artie Poole  <stuart.poole@canonical.com>

	efi/api: add GRUB_EFI_LOADED_IMAGE_DEVICE_PATH_PROTOCOL_GUID macro
	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Peter Jones <pjones@redhat.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Pavel Valena <pvalena@redhat.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/226>

2026-08-24  Leo Sandoval  <lsandova@redhat.com>

	Revert "docs/grub.texi: Document Deprecation Plan for GRUB"
	This reverts commit 86d5dbeede1ee4dabe300fff77fa84a8d7bd0425.

	This reason: it was merged too soon and discussion is still on-going
	on the corresponding MR [207].

	[207] https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/207

2026-08-24  Andrew Hamilton  <adhamilt@gmail.com>

	build: Distribute the dilithium include-only sources
	dilithium.c is compiled, but it #includes dilithium-common.c and
	dilithium-dep.c rather than linking against them. Neither file appears
	in any _SOURCES variable, so automake leaves both out of the tarball.

	Building an extracted release tarball therefore fails:

	  lib/libgcrypt-grub/cipher/dilithium.c:518:10: fatal error:
	  'dilithium-common.c' file not found

	List both files with extra_dist.

	Assisted-by: Claude:Opus-5

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/236>

2026-08-24  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	docs/grub: Document signed attributes support in appendedsig verification
	Update the appendedsig documentation to clarify how signatures are verified
	with respect to PKCS#7 signed attributes (`signedAttrs`).

	Specify that verification will honor and validate the signed attributes if
	they are present in the signature block. If they are absent, it falls
	back to validating the raw payload directly.

	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/229>

2026-08-24  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	appendedsig/x509: Prevent accidental reuse by clearing spki in x509_cert_release
	Explicitly clears the Subject Public Key Info (`spki`) structure with
	`grub_memset` during `x509_cert_release()`. This ensures that dangling
	internal pointers and key metadata are securely zeroed out immediately
	after liberation to prevent accidental reuse.

	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/228>

2026-08-19  Andrew Hamilton  <adhamilt@gmail.com>

	docs/grub.texi: Document Deprecation Plan for GRUB
	Document which modules and architectures will be deprecated for
	GRUB.

	Closes: https://gitlab.freedesktop.org/gnu-grub/grub/-/work_items/44

	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/207>

2026-08-19  Jiaqing Zhao  <Zhao.Jiaqing@amd.com>

	relocator/x86: Clear unused entries in preamble page table
	The preamble page table is built in the relocs chunk allocated by
	malloc_in_range(), which doesn't zero the memory. As only entries
	covering [0, max_ram_size) are written, pt4[npt3pages..511] and
	pt3[npt2pages..] are left with random bytes and any of them with
	present bit set maps arbitrary physical memory instead of faulting
	cleanly. Clear the PML4 and the PDPT pages before filling them in.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/184>

2026-08-19  Jiaqing Zhao  <Zhao.Jiaqing@amd.com>

	Revert "relocator/x86: inherit firmware PML4 in preamble page table"
	This reverts commit f40e41a31dc3197e6c145a49bca0917a6a68026a.

	Since preamble table is now only used for booting FreeBSD, which does
	not use EFI boot services, this fix is no longer needed. A preamble
	page table covering [0, MEM_SIZE) is enough.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/184>

2026-08-19  Jiaqing Zhao  <Zhao.Jiaqing@amd.com>

	Revert "relocator/x86: map entire 512G in every replaced PML4 entry"
	This reverts commit 07923ac0c71f70f53a758f37ee33769af40b2029.

	Since preamble table is now only used for booting FreeBSD, which does
	not use EFI boot services, this fix is no longer needed. A preamble
	page table covering [0, MEM_SIZE) is enough.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/184>

2026-08-19  Jiaqing Zhao  <Zhao.Jiaqing@amd.com>

	relocator: Enable preamble page table for FreeBSD only
	Commit 6898fcf74d13 ("relocator: Switch to own page table while moving
	chunks") changed the x86_64 EFI relocator to build a GRUB-owned page
	table so that the page table won't be clobbered by moving chunks,
	resolving a GhostBSD boot issue.

	However, this brought a bunch of boot regressions to other boot targets
	that require relocation, e.g. Xen hypervisor with multiboot2. Several
	fixes, f40e41a31dc3 ("relocator/x86: inherit firmware PML4 in preamble
	page table") and 07923ac0c71f ("relocator/x86: map entire 512G in every
	replaced PML4 entry") were introduced but still not fully resolve them.
	Worse, some of them only happen on retail machines with no debug builds
	of EFI firmware available, making it impossible to locate what went
	wrong.

	FreeBSD exits EFI boot services and switches to its own CR3 built by
	fill_bsd64_pagetable() right after relocation, so a preamble page table
	covering [0, MEM_SIZE) is enough. However, as Xen requires keeping EFI
	boot services (via multiboot2 header flag), the preamble table won't
	work.

	Considering the behavior prior to 6898fcf74d13 had worked well for over
	a decade, a new relocator flag use_preamble is introduced to make the
	preamble page table optional. It can be enabled through grub_relocator_
	use_preamble(). So far, only grub_freebsd_boot() enables it for 64-bit
	kernel. This keeps both the fix for GhostBSD and known-good behavior
	for other boot targets.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/184>

2026-08-19  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	appendedsig/pkcs7: Parse signedAttrs and perform implicit tag correction
	Add support for extracting, parsing, and verifying signed attributes
	(`signedAttrs`) within PKCS#7 structures.

	Introduce a new static helper function, `pkcs7_get_signerinfo_signed_attrs()`,
	to extract the raw DER-encoded signed attributes block using the asn1
	decoding API. Correct the PKCS#7 ASN.1 implicit context tag (`[0] IMPLICIT
	SET OF Attribute` / `0xA0`) to a basic `SET` tag (`0x31`) so the buffer
	can be validated properly by standard cryptographic verifiers.

	Update `pkcs7_get_signerinfos()` and `pkcs7_parse_signed_data()` to handle the
	underlying raw binary buffers required for calculating offsets. Flatten the
	deeply nested arrow-anti-pattern loop structure within `pkcs7_get_signerinfos()`
	into sequential early-return `break` condition evaluations to make the function
	maintainable.

	Finally, adapt `pkcs7_signed_data_verify()` to forward the raw corrected
	`signedAttrs` byte-stream for signature verification if present; otherwise,
	fall back to checking the detached raw payload message data directly.

	grub-core/commands/appendedsig/pkcs7.c:
	- (pkcs7_get_signerinfo_signed_attrs): New function.
	- (pkcs7_get_signerinfos): Propagate raw data parameters; flatten validation sequence.
	- (pkcs7_parse_signed_data): Pass down raw file data buffers to signer info processors.
	- (pkcs7_signed_data_verify): Conditionally feed signed attributes buffer to validation routine.

	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/225>

2026-08-19  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	appendedsig/pkcs7: Find trusted certificate by PKCS#7 signer serial and issuer
	Move the loop that searches the trusted certificate list using the
	signer's serial number and issuer fields into a new standalone helper
	function, pkcs7_get_signer_cert().

	The function iterates through the trusted certificates list, performs
	exact memory matches on both the serial and issuer data lengths and
	values, verifies the found certificate against the revocation list (rcl),
	and returns the matched certificate if not present in the revocation list.

	grub-core/commands/appendedsig/pkcs7.c:
	- (pkcs7_get_signer_cert): New function.
	- (pkcs7_signed_data_verify): Use pkcs7_get_signer_cert().

	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/225>

2026-08-19  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	appendedsig/pkcs7: Enforce signature length validation for crypto algorithms
	Extend the `struct sig_algo` structure with a fixed-size `sig_len` array
	to store up to three valid signature lengths for each cryptographic
	algorithm profile.

	Update the `sig_algos` instances to define these matching sizes (e.g.,
	RSA size variations and fixed ML-DSA public key token lengths). Finally,
	modify `pkcs7_get_signerinfo_signature()` to cross-check extracted ASN.1
	signatures against these expected sizes. If the parsed length does not
	explicitly match an allowed size option, the signature buffer is freed
	and a `GRUB_ERR_NOT_IMPLEMENTED_YET` error is returned.

	grub-core/commands/appendedsig/pkcs7.h:
	- (struct sig_algo): Add sig_len field.

	grub-core/commands/appendedsig/pkcs7.c:
	- (sig_algos): Define valid signature lengths.
	- (pkcs7_get_signerinfo_signature): Add length verification and cleanup logic.

	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/225>

2026-08-17  Andrew Hamilton  <adhamilt@gmail.com>

	libgcrypt-patches: Update ML-DSA pubkey-dilithium to Add Missing Comma
	When cipher/pubkey-dilithium.c is built with GRUB_UTIL conditional
	compile enabled, GRUB_UTIL_MODNAME is expanded (which is different than
	normal builds which do not define GRUB_UTIL anywhere currently for
	this file). This causes a syntax / compile error in this file because
	the previous '.raw_verify = mldsa_raw_verify' struct member patched in
	by 21_add_mldsa_raw_verify.patch does not include the comma for this
	new GRUB-specific struct member.

	Currently this is not exposed anywhere in the GRUB build environment
	in master that I could find, but does get exposed in the in-work
	fuzzing environment.

	Add the missing comma to the patch as it should be correct in any
	case.

	Assisted-by: Claude:Sonnet-5

	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/220>

2026-08-14  Leo Sandoval  <lsandova@redhat.com>

	Release 2.16~rc1
