[rpms/grub2] rawhide: bli: Allow overriding PACKAGE_STRING via grub-mkimage

[rpms/grub2] rawhide: bli: Allow overriding PACKAGE_STRING via grub-mkimage

[Leo Sandoval]

            A new commit has been pushed.

            Repo   : rpms/grub2
            Branch : rawhide
            Commit : 89a6a08bfb05ab7deeb53f05c60fc91a719441f0
            Author : Leo Sandoval <lsandova@redhat.com>
            Date   : 2026-08-10T17:37:50-06:00
            Stats  : +267/-2 in 4 file(s)
            URL    : https://src.fedoraproject.org/rpms/grub2/c/89a6a08bfb05ab7deeb53f05c60fc91a719441f0?branch=rawhide

            Log:
            bli: Allow overriding PACKAGE_STRING via grub-mkimage

This change proposal is intended to enhance the grub2-mkimage tool and
include the parameter '--package-string' which would be further used
by the new grub2-confidential-computing package [1,2]. Ultimately this would
be reflected into the LoaderInfor EFI variable set by the 'bli' module, e.g.

    # cat /sys/firmware/efi/efivars/LoaderInfo-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f
    GRUB CC 2.12-75.fc45

Signed-off-by: Leo Sandoval <lsandova@redhat.com>

---
diff --git a/0448-bli-Allow-overriding-PACKAGE_STRING-via-grub-mkimage.patch b/0448-bli-Allow-overriding-PACKAGE_STRING-via-grub-mkimage.patch
new file mode 100644
index 0000000..a8f5504
--- /dev/null
+++ b/0448-bli-Allow-overriding-PACKAGE_STRING-via-grub-mkimage.patch
@@ -0,0 +1,259 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Leo Sandoval <lsandova@redhat.com>
+Date: Mon, 10 Aug 2026 13:53:23 -0600
+Subject: [PATCH] bli: Allow overriding PACKAGE_STRING via grub-mkimage
+
+Add a --package-string option to grub-mkimage and grub-install that
+embeds a custom version string into the GRUB image. The bli module reads
+this string at initialization and uses it for the LoaderInfo EFI variable
+instead of the compile-time PACKAGE_STRING.
+
+This allows distributions to set a distro-specific version string (e.g.
+"GRUB CC 2.12-45" for Confidential Computing) at image creation time
+without rebuilding from source which is desired for packages like
+incoming grub2-confidential-computing [1].
+
+The implementation follows the existing OBJ_TYPE pattern used by
+OBJ_TYPE_PREFIX and OBJ_TYPE_DISABLE_TPM_STRING_PCR: grub-mkimage
+embeds the string as a module header with type OBJ_TYPE_PACKAGE_STRING,
+and the bli module iterates the embedded modules with FOR_MODULES to
+find it. If no --package-string was given, the compile-time
+PACKAGE_STRING is used as a fallback.
+
+[1]
+https://fedoraproject.org/wiki/Changes/Grub2LightForConfidentialComputing
+[2] https://bugzilla.redhat.com/show_bug.cgi?id=2513599
+
+Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
+Signed-off-by: Leo Sandoval <lsandova@redhat.com>
+---
+ grub-core/commands/bli.c    | 15 ++++++++++++++-
+ include/grub/kernel.h       |  3 ++-
+ include/grub/util/install.h |  8 ++++++--
+ util/grub-install-common.c  | 13 +++++++++++--
+ util/grub-mkimage.c         | 12 +++++++++++-
+ util/mkimage.c              | 24 ++++++++++++++++++++++--
+ 6 files changed, 66 insertions(+), 9 deletions(-)
+
+diff --git a/grub-core/commands/bli.c b/grub-core/commands/bli.c
+index 298c5f70a..53c8ff01c 100644
+--- a/grub-core/commands/bli.c
++++ b/grub-core/commands/bli.c
+@@ -28,6 +28,7 @@
+ #include <grub/misc.h>
+ #include <grub/mm.h>
+ #include <grub/partition.h>
++#include <grub/kernel.h>
+ #include <grub/types.h>
+ 
+ GRUB_MOD_LICENSE ("GPLv3+");
+@@ -129,7 +130,19 @@ set_loader_device_part_uuid (void)
+ 
+ GRUB_MOD_INIT (bli)
+ {
+-  grub_efi_set_variable_to_string ("LoaderInfo", &bli_vendor_guid, PACKAGE_STRING,
++  const char *loader_info = PACKAGE_STRING;
++  struct grub_module_header *header;
++
++  FOR_MODULES (header)
++    {
++      if (header->type == OBJ_TYPE_PACKAGE_STRING)
++	{
++	  loader_info = (const char *) (header + 1);
++	  break;
++	}
++    }
++
++  grub_efi_set_variable_to_string ("LoaderInfo", &bli_vendor_guid, loader_info,
+ 				   GRUB_EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ 				   GRUB_EFI_VARIABLE_RUNTIME_ACCESS);
+   set_loader_device_part_uuid ();
+diff --git a/include/grub/kernel.h b/include/grub/kernel.h
+index 0e9ad9fa5..43e7f43c3 100644
+--- a/include/grub/kernel.h
++++ b/include/grub/kernel.h
+@@ -34,7 +34,8 @@ enum
+   OBJ_TYPE_GPG_PUBKEY,
+   OBJ_TYPE_X509_PUBKEY,
+   OBJ_TYPE_DISABLE_CLI,
+-  OBJ_TYPE_DISABLE_TPM_STRING_PCR
++  OBJ_TYPE_DISABLE_TPM_STRING_PCR,
++  OBJ_TYPE_PACKAGE_STRING
+ };
+ 
+ /* The module header.  */
+diff --git a/include/grub/util/install.h b/include/grub/util/install.h
+index e3e672e83..370a20938 100644
+--- a/include/grub/util/install.h
++++ b/include/grub/util/install.h
+@@ -76,6 +76,8 @@
+     N_("disabled command line interface access"), 0 },			\
+   { "disable-tpm-string-pcr", GRUB_INSTALL_OPTIONS_DISABLE_TPM_STRING_PCR, 0, 0, \
+       N_("disable TPM string PCR measurements"), 0 },			\
++  { "package-string", GRUB_INSTALL_OPTIONS_PACKAGE_STRING, N_("STRING"), 0, \
++      N_("override the package version string embedded in the image"), 0 }, \
+   { "verbose", 'v', 0, 0,						\
+     N_("print verbose messages."), 1 }
+ 
+@@ -141,7 +143,8 @@ enum grub_install_options {
+   GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK,
+   GRUB_INSTALL_OPTIONS_APPENDED_SIGNATURE_SIZE,
+   GRUB_INSTALL_OPTIONS_DISABLE_CLI,
+-  GRUB_INSTALL_OPTIONS_DISABLE_TPM_STRING_PCR
++  GRUB_INSTALL_OPTIONS_DISABLE_TPM_STRING_PCR,
++  GRUB_INSTALL_OPTIONS_PACKAGE_STRING
+ };
+ 
+ extern char *grub_install_source_directory;
+@@ -206,7 +209,8 @@ grub_install_generate_image (const char *dir, const char *prefix,
+ 			     grub_compression_t comp, const char *dtb_file,
+ 			     const char *sbat_path, const int disable_shim_lock,
+ 			     const int disable_cli,
+-			     const int disable_tpm_string_pcr);
++			     const int disable_tpm_string_pcr,
++			     const char *package_string);
+ 
+ const struct grub_install_image_target_desc *
+ grub_install_get_image_target (const char *arg);
+diff --git a/util/grub-install-common.c b/util/grub-install-common.c
+index 9cfa14acc..b0ee2d91d 100644
+--- a/util/grub-install-common.c
++++ b/util/grub-install-common.c
+@@ -471,6 +471,7 @@ static grub_compression_t compression;
+ static size_t appsig_size;
+ static int disable_cli;
+ static int disable_tpm_string_pcr;
++static char *package_string;
+ 
+ int
+ grub_install_parse (int key, char *arg)
+@@ -522,6 +523,12 @@ grub_install_parse (int key, char *arg)
+     case GRUB_INSTALL_OPTIONS_DISABLE_TPM_STRING_PCR:
+       disable_tpm_string_pcr = 1;
+       return 1;
++    case GRUB_INSTALL_OPTIONS_PACKAGE_STRING:
++      if (package_string)
++	free (package_string);
++
++      package_string = xstrdup (arg);
++      return 1;
+ 
+     case GRUB_INSTALL_OPTIONS_VERBOSITY:
+       verbosity++;
+@@ -723,7 +730,8 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix,
+ 		  note ? " --note" : "",
+ 		  disable_shim_lock ? " --disable-shim-lock" : "",
+ 		  disable_cli ? " --disable-cli" : "",
+-		  disable_tpm_string_pcr ? " --disable-tpm-string-pcr" : "", s);
++		  disable_tpm_string_pcr ? " --disable-tpm-string-pcr" : "",
++		  package_string ? " --package-string" : "", s);
+   free (s);
+ 
+   tgt = grub_install_get_image_target (mkimage_target);
+@@ -737,7 +745,8 @@ grub_install_make_image_wrap_file (const char *dir, const char *prefix,
+ 			       config_path, tgt,
+ 			       note, appsig_size, compression, dtb, sbat,
+ 			       disable_shim_lock, disable_cli,
+-			       disable_tpm_string_pcr);
++			       disable_tpm_string_pcr,
++			       package_string);
+   while (dc--)
+     grub_install_pop_module ();
+ }
+diff --git a/util/grub-mkimage.c b/util/grub-mkimage.c
+index 99d5c6046..1bc64fbbb 100644
+--- a/util/grub-mkimage.c
++++ b/util/grub-mkimage.c
+@@ -86,6 +86,7 @@ static struct argp_option options[] = {
+   {"disable-shim-lock", GRUB_INSTALL_OPTIONS_DISABLE_SHIM_LOCK, 0, 0, N_("disable shim_lock verifier"), 0},
+   {"disable-cli", GRUB_INSTALL_OPTIONS_DISABLE_CLI, 0, 0, N_("disable command line interface access"), 0},
+   {"disable-tpm-string-pcr", GRUB_INSTALL_OPTIONS_DISABLE_TPM_STRING_PCR, 0, 0, N_("disable TPM string PCR measurements"), 0},
++  {"package-string", GRUB_INSTALL_OPTIONS_PACKAGE_STRING, N_("STRING"), 0, N_("override the package version string embedded in the image"), 0},
+   {"verbose",     'v', 0,      0, N_("print verbose messages."), 0},
+   {"appended-signature-size", 'S', N_("SIZE"), 0, N_("Add a note segment reserving SIZE bytes for an appended signature"), 0},
+   { 0, 0, 0, 0, 0, 0 }
+@@ -137,6 +138,7 @@ struct arguments
+   size_t appsig_size;
+   int disable_cli;
+   int disable_tpm_string_pcr;
++  char *package_string;
+   const struct grub_install_image_target_desc *image_target;
+   grub_compression_t comp;
+ };
+@@ -271,6 +273,13 @@ argp_parser (int key, char *arg, struct argp_state *state)
+       arguments->disable_tpm_string_pcr = 1;
+       break;
+ 
++    case GRUB_INSTALL_OPTIONS_PACKAGE_STRING:
++      if (arguments->package_string)
++	free (arguments->package_string);
++
++      arguments->package_string = xstrdup (arg);
++      break;
++
+     case 'v':
+       verbosity++;
+       break;
+@@ -361,7 +370,8 @@ main (int argc, char *argv[])
+ 			       arguments.dtb, arguments.sbat,
+ 			       arguments.disable_shim_lock,
+ 			       arguments.disable_cli,
+-			       arguments.disable_tpm_string_pcr);
++			       arguments.disable_tpm_string_pcr,
++			       arguments.package_string);
+ 
+   if (grub_util_file_sync (fp) < 0)
+     grub_util_error (_("cannot sync `%s': %s"), arguments.output ? : "stdout",
+diff --git a/util/mkimage.c b/util/mkimage.c
+index 7275a1b92..de1386cfc 100644
+--- a/util/mkimage.c
++++ b/util/mkimage.c
+@@ -889,12 +889,13 @@ grub_install_generate_image (const char *dir, const char *prefix,
+ 			     int note, size_t appsig_size, grub_compression_t comp,
+ 			     const char *dtb_path, const char *sbat_path,
+ 			     int disable_shim_lock, int disable_cli,
+-			     int disable_tpm_string_pcr)
++			     int disable_tpm_string_pcr,
++			     const char *package_string)
+ {
+   char *kernel_img, *core_img;
+   size_t total_module_size, core_size;
+   size_t memdisk_size = 0, config_size = 0;
+-  size_t prefix_size = 0, dtb_size = 0, sbat_size = 0;
++  size_t prefix_size = 0, dtb_size = 0, sbat_size = 0, package_string_size = 0;
+   char *kernel_path;
+   size_t offset;
+   struct grub_util_path_list *path_list, *p;
+@@ -970,6 +971,12 @@ grub_install_generate_image (const char *dir, const char *prefix,
+   if (disable_tpm_string_pcr)
+     total_module_size += sizeof (struct grub_module_header);
+ 
++  if (package_string)
++    {
++      package_string_size = ALIGN_ADDR (strlen (package_string) + 1);
++      total_module_size += package_string_size + sizeof (struct grub_module_header);
++    }
++
+   if (config_path)
+     {
+       config_size = ALIGN_ADDR (grub_util_get_image_size (config_path) + 1);
+@@ -1156,6 +1163,19 @@ grub_install_generate_image (const char *dir, const char *prefix,
+       offset += sizeof (*header);
+     }
+ 
++  if (package_string)
++    {
++      struct grub_module_header *header;
++
++      header = (struct grub_module_header *) (kernel_img + offset);
++      header->type = grub_host_to_target32 (OBJ_TYPE_PACKAGE_STRING);
++      header->size = grub_host_to_target32 (package_string_size + sizeof (*header));
++      offset += sizeof (*header);
++
++      grub_strcpy (kernel_img + offset, package_string);
++      offset += package_string_size;
++    }
++
+   if (config_path)
+     {
+       struct grub_module_header *header;

diff --git a/grub-cc.macros b/grub-cc.macros
index 73684c1..e5fa35c 100644
--- a/grub-cc.macros
+++ b/grub-cc.macros
@@ -62,6 +62,7 @@ mksquashfs memdisk memdisk.squashfs -comp lzo			\
 	-c '%{SOURCE17}'                                        \\\
 	-p /EFI/%{efi_vendor}					\\\
 	--disable-tpm-string-pcr                                \\\
+	--package-string "GRUB CC %{version}-%{release}"	\\\
 	${GRUB_MODULES}						\
 %{4}./grub-mkimage -O %{1} -o %{3}.orig				\\\
 	-d grub-core						\\\
@@ -70,6 +71,7 @@ mksquashfs memdisk memdisk.squashfs -comp lzo			\
 	-m memdisk.squashfs					\\\
 	-p /EFI/BOOT						\\\
 	--disable-tpm-string-pcr                                \\\
+	--package-string "GRUB CC %{version}-%{release}"	\\\
 	${GRUB_CC_MODULES}						\
 %{expand:%%define ___pesign_client_cert %{?___pesign_client_cert}%{!?___pesign_client_cert:%{__pesign_client_cert}}} \
 %{?__pesign_client_cert:%{expand:%%define __pesign_client_cert %{___pesign_client_cert}}} \

diff --git a/grub.patches b/grub.patches
index 2eb4021..9e91e08 100644
--- a/grub.patches
+++ b/grub.patches
@@ -438,4 +438,5 @@ Patch0443: 0443-ieee1275-support-added-for-multiple-nvme-bootpaths.patch
 Patch0444: 0444-ieee1275-add-support-for-NVMeoFC.patch
 Patch0445: 0445-grub-get-kernel-settings-Treate-kernel-uki-dtbloader.patch
 Patch0446: 0446-mm-try-allocating-regions-above-defined-limit-as-las.patch
-Patch0447: 0447-tpm-Only-skip-TPM-string-PCR-measurements-with-expli.patch
\ No newline at end of file
+Patch0447: 0447-tpm-Only-skip-TPM-string-PCR-measurements-with-expli.patch
+Patch0448: 0448-bli-Allow-overriding-PACKAGE_STRING-via-grub-mkimage.patch
\ No newline at end of file

diff --git a/grub2.spec b/grub2.spec
index 7c32f1c..bdcbfab 100644
--- a/grub2.spec
+++ b/grub2.spec
@@ -17,7 +17,7 @@
 Name:		grub2
 Epoch:		1
 Version:	2.12
-Release:	74%{?dist}
+Release:	75%{?dist}
 Summary:	Bootloader with support for Linux, Multiboot and more
 License:	GPL-3.0-or-later
 URL:		http://www.gnu.org/software/grub/
@@ -694,6 +694,9 @@ fi
 %endif
 
 %changelog
+* Mon Aug 10 2026 Leo Sandoval <lsandova@redhat.com> - 2.12-75
+- bli: Allow overriding PACKAGE_STRING via grub-mkimage
+
 * Mon Aug 3 2026 Leo Sandoval <lsandova@redhat.com> - 2.12-74
 - grub-efi-cc: disable TPM string measurements at runtime