edk2 (2025.11-5) unstable; urgency=medium . [ Hector Cao ] * debian: python: fix caching issue with shutil.copyfileobj() . [ Michael Tokarev ] * d/patches: revert 3 commits related to ARM LPA2 mode, for now: revert-ArmPkg-UefiCpuPkg-fix-boot-failure-with-LPA2.patch revert-MdePkg-UefiCpuPkg-fix-wrong-DS-bit-and-add-he.patch revert-UefiCpuPkg-ArmMmuLib-Add-support-for-LPA2.patch (Closes: #1124168) edk2 (2025.11-4) unstable; urgency=medium . [ Lukas Märdian ] * d/control: Add missing separator, thanks lintian. * d/p/no-stack-protector-all-archs.diff: Drop. This patch was added over 10 years ago for ARM and has been cargo-culted ever since. It's not clear what it fixed, or if it is still necessary. Let's find out. * d/p/x64-baseline-abi.patch: Refresh. * d/control, d/rules: Add ovmf-legacy package, shipping an OVMF.legacy.fd firmware that enables deprecated features such as PVSCSI (LP: #2129178) * d/tests: Add test-case for PVSCSI, using ovmf-legacy . [ Mate Kukri ] * d/rules: Drop unused OVMF32 flags * d/rules: Add NO_STRICTNX_COMMON_FLAGS to OVMF legacy target as well * d/rules: Use OVMF_4M_COMMON_FLAGS instead of OVMF_COMMON_FLAGS for OVMF_4M_NO_SECBOOT_FLAGS * d/rules: Declare AMDSEV variant flags at the top like others . [ Hector Cao ] * Fix Out-of-bounds read in HTTP client no_proxy handling, CVE-2025-9232 edk2 (2025.11-3) unstable; urgency=medium . * d/tests/control: restrict qemu-system-x86-64 dependency to 64-bit architectures. * Enable salsa-ci. edk2 (2025.11-2) unstable; urgency=medium . * d/tests/control: restore dependency on qemu-system-aarch64 (Closes: #1124579) edk2 (2025.11-1) unstable; urgency=medium . * New upstream release, based on edk2-stable202511 tag. - Refresh patches: + no-stack-protector-all-archs.diff + brotlicompress-disable.diff + x64-baseline-abi.patch + fix_nasm_compile.patch - Clear keyboard queue buffer to avoid leaking the password string, CVE-2024-38798. (Closes: #1122288) * Remove qemu-efi-arm, upstream has removed support for it. * Remove ovmf-ia32, upstream has removed support for it. * Split ovmf out into ovmf-generic, ovmf-amdsev, ovmf-inteltdx, and transition ovmf into a metapackage that depends on each of them. This lets users install only the packages that are usable on their CPUs. * d/control, d/tests/control: Use architecture-specific qemu-system virtual packages. edk2 (2025.08.01-6) unstable; urgency=medium . * d/rules: Restore the inteltdx firmware descriptor that was dropped in the previous upload. edk2 (2025.08.01-5) unstable; urgency=medium . * d/rules: Move amdsev image back to /usr/share/ovmf to match the firmware descriptor. (Closes: #1121768) * d/rules: Move inteltdx image to /usr/share/ovmf to match the firmware descriptor. * d/tests: Add tests to validate that all files referenced by descriptors are present. edk2 (2025.08.01-4) unstable; urgency=medium . * d/rules: fix a typo in previous fix (AAVMF) (Really closes: #1121739) edk2 (2025.08.01-3) unstable; urgency=medium . * d/rules: expand AAVMF_VARS.ms.fd and AAVMF_VARS.snakeoil.fd templates to 64M too (Closes: #1121739) edk2 (2025.08.01-2) unstable; urgency=medium . * d/tests/control: add python3-virt-firmware dependency (Closes: #1121368) edk2 (2025.08.01-1) unstable; urgency=medium . * New upstream release, based on edk2-stable202508.01 tag. - Drop patch merged upstream: + 0001-UefiCpuPkg-PiSmmCpuDxeSmm-Safe-handling-of-IDT-regis.patch * ovmf: Restore the OVMF.fd unified image that was accidentally dropped during the build system refactoring. (Closes: #1117405) edk2 (2025.05-2) unstable; urgency=medium . * ovmf: Add Intel TDX support. Thanks to Hector Cao of Canonical. * ovmf, qemu-efi-aarch64: Correct enrolled snakeoil certificate. Thanks to Fiona Ebner of Proxmox. edk2 (2025.05-1) unstable; urgency=medium . * New upstream release, based on edk2-stable202505 tag. - Drop patches merged upstream: + 0001-OvmfPkg-Use-user-specified-opt-ovmf-X-PciMmio64Mb-va.patch + 0001-NetworkPkg-IScsiDxe-Fix-for-Remote-Memory-Exposure-i.patch + 0001-OvmfPkg-QemuKernelLoaderFsDxe-fix-allocation-failure.patch + 0001-SecurityPkg-Out-of-bound-read-in-HashPeImageByType.patch + 0002-SecurityPkg-Improving-HashPeImageByType-logic.patch + 0003-SecurityPkg-Improving-SecureBootConfigImpl-HashPeIma.patch + 0004-SecurityPkg-Update-SecurityFixes.yaml-for-CVE-2024-3.patch + 0001-Fix-timing-side-channel-in-ECDSA-signature-computati.patch + 0001-NetworkPkg-IScsiDxe-Fix-for-out-of-bound-memory-acce.patch - Refresh patches: + OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch * debian/tests/shell.py: Upstream has disabled autoboot for the EFI Shell for a number of platforms. Create a boot entry for the shell before running the test on those platforms. * Apply DBXUpdate-2025-10-16.amd64.bin. * ovmf: Fix regression in previous upload that dropped the amdsev image. Thanks to Hector Cao. * d/p/fix_nasm_compile.patch: Add patch to fix FTBFS w/ nasm 3.01. (Closes: #1119982) edk2 (2025.02-10) unstable; urgency=medium . * debian/tests: DEB_EDK2_ROOT can now be used to specify an alternate install tree. * Rework build system: - Better parallelism. Previously we could do architecures builds in parallel, but each architecture variant was built serially. We now give each variant its own hardlinked build tree, so all images can now be built in parallel. I got a new laptop. - Files are now installed to debian/tmp before being moved to the individual packages. This gives us a tree we can test during the build. * d/control: Remove build-deps no longer needed now that we use virt-firmware for key enrollment. * Run tests at build time. (Closes: #992259). rust-chrono (0.4.45-1) unstable; urgency=medium . * Team upload. * Package chrono 0.4.45 from crates.io using debcargo 2.8.3 * Refresh patches * Use breaks instead of extra-lines * Relax deps on similar-asserts rust-sha1-0.10 (0.10.7-1) unstable; urgency=medium . * Team upload. * Package sha1 0.10.7 from crates.io using debcargo 2.8.3 sysbench (1.0.20+ds-9) unstable; urgency=medium . * Control: add ppc64el to the list of restricted archs. * Control: add a build-dep on "unsupported-architecture" to disallow specific architectures, avoiding the need to list all supported ones in the Architecture field. * Control: replace build-dep on default-libmysqlclient-dev with libmariadb-dev-compat | libmysqlclient-dev. (Closes: #1137774) * Control: bump Standards-Version to 4.7.4 (from 4.7.3). REMOVED: golang-github-willf-bloom 3.7.0-1 REMOVED: libmarkdown-php 1.0.2-3 REMOVED: fcitx-anthy 0.2.4-1 REMOVED: themole 0.3-3.1 REMOVED: mini-httpd-run 1.0+nmu1 REMOVED: fcitx-table-other 0.2.4-3.1 REMOVED: libquazip1-qt5 1.5-1 REMOVED: rust-sha1-asm 0.5.3-1 REMOVED: libquazip1-qt6 1.5-2 REMOVED: id3tool 1.2a-14