obs: fix sign-efi-sig-list parameter format

It wants a date in the format Y-m-d H:M:S rather than unix seconds.
Also if SOURCE_DATE_EPOCH is not defined, use actual epoch, as the
timestamps must match when creating the signature and when attaching
it

diff --git a/mkosi/resources/mkosi-obs/mkosi.build b/mkosi/resources/mkosi-obs/mkosi.build
index b4e71d7590dc4aa74c8a4b031b653403ff22d2c5..7b5503687ca50b2baa98addd59ad1163bcb61d0b 100755 (executable)
--- a/mkosi/resources/mkosi-obs/mkosi.build
+++ b/mkosi/resources/mkosi-obs/mkosi.build
@@ -229,7 +229,7 @@ while read -r SIG; do
     fbase="${fbase%.auth}"
     fbase="${fbase%%-*}"
     perl -0777 -npe 's/\A(?:[\040-\176]\0)+.{18}\0\0.{14}\0\0//s' < "$f" > "$f.orig"
-    sign-efi-sig-list -t "${SOURCE_DATE_EPOCH:-$(date +%s)}" -i "$f.p7sd" "$fbase" "$f.orig" "$f.tmp"
+    sign-efi-sig-list -t "$(date -d "@${SOURCE_DATE_EPOCH:-0}" "+%Y-%m-%d %H:%M:%S")" -i "$f.p7sd" "$fbase" "$f.orig" "$f.tmp"
     mv "$f.tmp" "$f"
     rm -f "$f.p7s" "$f.p7sd" "$f.orig"
 done < <(find hashes/authvars -type f -name '*.auth.sig')

diff --git a/mkosi/resources/mkosi-obs/mkosi.postoutput b/mkosi/resources/mkosi-obs/mkosi.postoutput
index 1857c8273a331b5b1cc5855fca1f45fec213acb2..e1fb12ee585a68fae83e4f2ffa65601498eb06da 100755 (executable)
--- a/mkosi/resources/mkosi-obs/mkosi.postoutput
+++ b/mkosi/resources/mkosi-obs/mkosi.postoutput
@@ -111,7 +111,7 @@ if ((${#DDIS[@]} > 0)); then
     cp db.esl KEK.esl
     cp db.esl PK.esl
     for i in *.esl; do
-        sign-efi-sig-list -o -g "$guid" -t "${SOURCE_DATE_EPOCH:-$(date +%s)}" "${i%.esl}" "$i" "${i%.esl}.auth"
+        sign-efi-sig-list -o -g "$guid" -t "$(date -d "@${SOURCE_DATE_EPOCH:-0}" "+%Y-%m-%d %H:%M:%S")" "${i%.esl}" "$i" "${i%.esl}.auth"
     done
     popd 2>/dev/null
 fi