2026-09-21  Leo Sandoval  <lsandova@redhat.com>

	Release 2.16

2026-09-18  Andrew Hamilton  <adhamilt@gmail.com>

	term/serial: Reject caller-supplied port addresses under lockdown
	The serial command is available in lockdown mode and the port option
	accepts a raw port address or a raw mmio base address. This can be
	misused to allow an attacker to write to local memory and do things
	including disabling / bypassing secure boot as long as the
	console is available or an unsigned GRUB configuration is under
	the attacker's control.

	Update the serial logic to only accept a raw address in lockdown when
	a port is already registered at it, which means the platform described
	that UART: grub_ns8250_init() for the legacy com<N> ports,
	grub_pciserial_init() for an enumerated PCI device, or an ACPI SPCR
	UART once "auto" has parsed the table. Names that are not addresses
	are untouched, so "auto", efi<N> from grub_efiserial_init() - the
	route on arm64, which has neither ns8250 nor SPCR support - and
	lookups by registered name all keep working.

	Behavior without lockdown (no secure boot) is unchanged.

	Assisted-by: Claude:Opus-5

	Suggested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/266>

2026-09-18  Andrew Hamilton  <adhamilt@gmail.com>

	docs/grub: Document serial port restrictions under lockdown
	Document that the serial command with the raw address is restricted
	in lockdown mode to avoid misuse by an attacker (except for if the
	given address is already associated with a platform provided
	device).

	Assisted-by: Claude:Opus-5

	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/266>

2026-09-18  Daniel Kiper  <daniel.kiper@oracle.com>

	docs: Add missing connectefi to list of "Command-line commands"
	Fixes: 80d59ed3e (efi: new 'connectefi' command)

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Reviewed-by: Pavel Valena <pvalena@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/258>

2026-09-10  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	appendedsig: Simplify signature validation return codes and drop cert_revoked
	Refactor the signature verification path to use distinct error handling codes,
	removing the redundant `cert_revoked` boolean state tracking variable.

	- Drop the `cert_revoked` boolean flag from `appendedsig.c`, `pkcs7.c`, and the
	  `grub_pkcs7_verify_t` function signature pointer interface.
	- Return `GRUB_ERR_FILE_NOT_FOUND` instead of `GRUB_ERR_BAD_SIGNATURE` from
	  `pkcs7_get_signer_cert()` when a matching certificate cannot be discovered in the
	  trusted keys list.
	- Adjust `grub_verify_appended_signature()` to correctly approve verification if a
	  binary hash match succeeds (`err == GRUB_ERR_NONE`) when the signature tracking loop
	  fails due to a missing signer certificate (`GRUB_ERR_FILE_NOT_FOUND`).

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/232>

2026-09-10  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	appendedsig/pkcs7: verify signedAttrs against content and certificate
	Consolidate per-signer verification into pkcs7_verify_one() and add
	three new checks when signedAttrs are present:

	- contentType: reject if the signedAttrs contentType OID does not match
	  the encapContentInfo.eContentType from the SignedData.

	- messageDigest: compute the hash of the signed data and reject if it
	  does not match the messageDigest authenticated attribute, enforcing
	  that signedAttrs must carry a messageDigest.

	- signingTime: if present, reject if the signing time falls outside the
	  signing certificate's notBefore/notAfter validity window. The system
	  clock is not consulted since it may not be reliable at boot time.

	Extract pkcs7_verify_signature() to encapsulate the raw signature
	verification and its debug logging. In pkcs7_signed_data_verify(),
	propagate GRUB_ERR_OUT_OF_MEMORY immediately but continue to the next
	signer on all other failures.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/232>

2026-09-10  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	appendedsig/pkcs7: parse signingTime attribute from PKCS#7 signedAttrs
	Parse the signingTime authenticated attribute (OID 1.2.840.113549.1.9.5)
	from each SignerInfo's signedAttrs. The attribute value is ANY-encoded
	and carries either a UTCTime (0x17) or GeneralizedTime (0x18) — validate
	the tag and decode the time string to a Unix timestamp via
	grub_asn1_decode_datetime().

	Add pkcs7_get_signing_time() and wire it into pkcs7_read_attribute()
	alongside the existing contentType and messageDigest handlers. Store
	the result in a new signing_time field in grub_pkcs7_signedattr_t.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/232>

2026-09-10  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	appendedsig/pkcs7: Parse messageDigest attribute from PKCS#7 signedAttrs
	Introduce support for extracting and storing the authenticated `messageDigest`
	attribute from a PKCS#7 signer's signed attributes list (`signedAttrs`).

	- Define `oid_msg_digest` and its length to locate the standard
	  `1.2.840.113549.1.9.4` OID within the `signedAttrs` structure.
	- Implement `pkcs7_get_msg_digest()` to read the raw message digest from the
	  ASN.1 path under `signedAttrs`, adjust for tag overhead, and extract it.
	- Update `pkcs7_read_attribute()` to handle both `messageDigest` and `signingTime`
	  OIDs, making sure to cleanly propagate processing errors.
	- Update `pkcs7_free_signers()` to release the memory allocated for the
	  `msg_digest` field when freeing the signature context structures.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/232>

2026-09-10  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	appendedsig/pkcs7: parse contentType attribute from PKCS#7 signedAttrs
	RFC 5652 Section 11.1 requires the contentType authenticated attribute
	to be present in signedAttrs. Parse it from each SignerInfo to enable
	validation against encapContentInfo.eContentType.

	The attribute value is encoded as ANY, so the raw DER is read via
	grub_asn1_allocate_and_read(), the OID tag (0x06) is validated, and
	the dotted-decimal OID string is decoded using asn1_get_object_id_der().

	Add pkcs7_read_attribute() to walk the signedAttrs SET and dispatch to
	pkcs7_get_content_type() on a match. Hook it into
	pkcs7_get_signerinfo_signed_attrs() once the raw attribute blob is saved.
	Add ctype/ctype_len to grub_pkcs7_signedattr_t and free ctype on release.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/232>

2026-09-10  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	appendedsig/pkcs7: parse encapsulatedContentInfo from SignedData
	Add pkcs7_get_econtent_info() to process the encapContentInfo field of
	SignedData. Reject messages where eContent is present since only
	detached signatures are supported. Read and store the eContentType OID
	in a new grub_pkcs7_eci_t struct embedded in grub_pkcs7_signed_data_t.

	Call pkcs7_get_econtent_info() from pkcs7_parse_signed_data() after the
	digest algorithms are parsed. Free the buffer in pkcs7_signed_data_release().

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/232>

2026-09-10  Sudhakar Kuppusamy  <sudhakar@linux.ibm.com>

	appendedsig/x509: Parse and decode X.509 certificate validity periods
	Extract and decode the `notBefore` and `notAfter` validity fields during
	X.509 certificate parsing.

	- Implement `grub_asn1_decode_datetime()` in `asn1_util.c` to support parsing
	  both ASN.1 `UTCTime` (YYMMDDHHMMSSZ) and `GeneralizedTime` (YYYYMMDDHHMMSSZ)
	  formats into Unix epoch timestamps, incorporating standard calendar bounds
	  and leap-year handling.
	- Implement `x509_get_validity()` in `x509.c` to navigate the certificate's
	  validity elements, read their underlying values, and store the decoded dates
	  directly into the `grub_x509_validity_t` fields.
	- Integrate the validity parser into the main parsing loop within
	  `x509_cert_parse_der()` and guarantee structural memory cleanup
	  inside `x509_cert_release()`.

	This populates the required infrastructure to execute static cryptographic
	lifetime checks on loaded keys without runtime system clock dependencies.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/232>

2026-09-15  Andrew Hamilton  <adhamilt@gmail.com>

	util/grub-protect: Fix compilation error when optimization is O2
	When the host utilities are compiled with optimization level O2
	or higher, grub_protect.c fails to compile with an error like:
	In function ‘protect_tpm2_seal’,
	    inlined from ‘protect_tpm2_add’ at util/grub-protect.c:1014:9:
	util/grub-protect.c:637:35: error: ‘key_size’ may be used
	uninitialized [-Werror=maybe-uninitialized]
	  637 |   inSensitive.sensitive.data.size = clearTextLength;

	This is only detected by the compiler with higher levels of
	optimization because the compiler does a deeper program analysis.

	Correct this by initializing key_size to zero at declaration.

	Reviewed-by: Gary Lin <glin@suse.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/261>

2026-09-15  Artie Poole  <stuart.poole@canonical.com>

	gnulib: patch argp-help.c to fix dropped const
	When building debian packages, compile errors caused by warnings.

	Original error:
	../../../../../grub-core/lib/gnulib/argp-help.c: In function 'argp_doc':
	../../../../../grub-core/lib/gnulib/argp-help.c:1601:18: warning: initialization discards 'const' qualifier from pointer target type [-Wdiscarded-qualifiers]
	 1601 |       char *vt = strchr (doc, '\v');
	      |                  ^~~~~~

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/259>

2026-09-04  Artie Poole  <stuart.poole@canonical.com>

	grub-core/osdep/linux/ofpath.c fix unused fscanf result
	the safety of the call is already checked and handled. The return value can safely be ignored.

	Original error:

	../../grub-core/osdep/linux/ofpath.c: In function 'of_find_fc_host':
	../../grub-core/osdep/linux/ofpath.c:540:7: warning: ignoring return value of 'fscanf' declared with attribute 'warn_unused_result' [-Wunused-result]
	  540 |       fscanf (fp, "%511s", buf);
	      |       ^~~~~~~~~~~~~~~~~~~~~~~~~
	../../grub-core/osdep/linux/ofpath.c: In function 'of_path_get_nvme_nsid':
	../../grub-core/osdep/linux/ofpath.c:715:3: warning: ignoring return value of 'fscanf' declared with attribute 'warn_unused_result' [-Wunused-result]
	  715 |   fscanf (fp, "%u", &(nsid));
	      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Pavel Valena <pvalena@redhat.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/253>

2026-09-04  Artie Poole  <stuart.poole@canonical.com>

	grub-core/net/bootp.c fix uninitialized variable warning
	Original error

	../../../grub-core/net/bootp.c: In function 'grub_net_configure_by_dhcp_ack':
	../../../grub-core/net/bootp.c:558:16: warning: 'boot_file_len' may be used uninitialized [-Wmaybe-uninitialized]
	  558 |           if (!dissect_url (boot_file, boot_file_len, &proto, &ip, &pa))
	      |                ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	../../../grub-core/net/bootp.c:351:15: note: 'boot_file_len' was declared here
	  351 |   grub_size_t boot_file_len, server_name_len;
	      |               ^~~~~~~~~~~~~

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Pavel Valena <pvalena@redhat.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/253>

2026-09-04  Artie Poole  <stuart.poole@canonical.com>

	grub-core/osdeps/unix/platform.c fix truncated strncpy warning by using memcpy instead
	replace strncpy with memcpy to suppress -Wstringop-truncation error. This is fine because
	the nul termination is added manually at the end.
	We deliberately don't want to nul terminate here because this is a string concatenation
	operation.

	Original error:

	In file included from ../../grub-core/osdep/platform_unix.c:2:
	../../grub-core/osdep/unix/platform.c: In function 'add_multiple_nvme_bootdevices':
	../../grub-core/osdep/unix/platform.c:186:7: warning: '__builtin_strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Wstringop-truncation]
	  186 |       strncpy (ptr, non_splitter_path, strlen (non_splitter_path));
	      |       ^
	../../grub-core/osdep/unix/platform.c:186:40: note: length computed here
	  186 |       strncpy (ptr, non_splitter_path, strlen (non_splitter_path));
	      |                                        ^~~~~~~~~~~~~~~~~~~~~~~~~~
	../../grub-core/osdep/unix/platform.c:208:15: warning: '__builtin_strncpy' output truncated before terminating nul copying as many bytes from a string as its length [-Wstringop-truncation]
	  208 |               strncpy (ptr, path, strlen (path));
	      |               ^
	../../grub-core/osdep/unix/platform.c:202:46: note: length computed here
	  202 |               if ((strlen (multipath_boot) + strlen (path)) > BOOTDEV_BUFFER)
	      |                                              ^~~~~~~~~~~~~

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Pavel Valena <pvalena@redhat.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/253>

2026-08-31  Leo Sandoval  <lsandova@redhat.com>

	Release 2.16~rc2

2026-08-31  Leo Sandoval  <lsandova@redhat.com>

	CI: Create a 'Release' Pipeline
	The idea is to automate the whole release process, candidate or final,
	where maintainer tags a commit (and pushes) then the proposed pipeline
	kicks and produce the release similar as [1].

	[1] https://gitlab.freedesktop.org/lsandova/grub/-/releases/grub-2.16-rc1

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Reviewed-by: Josue Hernandez <josherna@redhat.com>
	Reviewed-by: Michael Chang <mchang@suse.com>
	Reviewed-by: Peter Jones <pjones@redhat.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Suggested-by: Daniel Kiper <daniel.kiper@oracle.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/238>

2026-08-27  Mate Kukri  <mate.kukri@canonical.com>

	Makefile.extra-dist: Add missing libtasn1 patch to EXTRA_DIST
	Without this the release tarball will be unbuildable.

	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/251>

2026-08-25  Mate Kukri  <mate.kukri@canonical.com>
	    Mate Kukri  <mate.kukri@canonical.com>

	efi/linux: set the loaded image device path when it is missing
	Under Secure Boot grub verifies the kernel in its verifier framework
	(grub-core/kern/efi/sb.c). The verifier loads it through the shim image loader
	protocol, passing only the image buffer and a NULL device path, because the
	device path is not available at that point. The verified image handle, which
	linux reuses, is therefore left with no device path: both
	loaded_image->file_path and the LOADED_IMAGE_DEVICE_PATH protocol are NULL.

	This is a consequence of grub loading the image inside the verifier, separate
	from where the device path is built. The kernel should see the same memory
	mapped path it would get from a normal load.

	A memory mapped device path is already built for grub_efi_load_image(). Also
	point loaded_image->file_path and the LOADED_IMAGE_DEVICE_PATH protocol at it.
	The image's loader owns those fields and frees them with the EFI pool
	allocator, so save the originals and restore them before unloading the image if
	it returns.

	Reviewed-by: Andrew Hamilton <adhamilt@gmail.com>
	Reviewed-by: Peter Jones <pjones@redhat.com>
	Reviewed-by: Avnish Chouhan <avnish@linux.ibm.com>
	Reviewed-by: Sudhakar Kuppusamy <sudhakar@linux.ibm.com>
	Reviewed-by: Pavel Valena <pvalena@redhat.com>
	Reviewed-by: Leo Sandoval <lsandova@redhat.com>
	Part-of: <https://gitlab.freedesktop.org/gnu-grub/grub/-/merge_requests/226>
