On Fri, Sep 18, 2026 at 04:21 AM, Felix Moessbauer wrote:

On Fri, 2026-09-18 at 13:01 +0200, Jan Kiszka wrote:

On 18.09.26 12:54, Moessbauer, Felix (FT RPD CED OES-DE) wrote:

On Fri, 2026-09-18 at 14:20 +0530, Kunijadar Shivanand wrote:

From: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>

Closes https://gitlab.com/cip-project/cip-core/isar-cip-core/-/work_items/162

Signed-off-by: Shivanand Kunijadar <Shivanand.Kunijadar@toshiba-tsip.com>
---
.../secure-boot-efi-certs/single-key-to-efi-certs_0.1.bb | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/recipes-devtools/secure-boot-efi-certs/single-key-to-efi-certs_0.1.bb b/recipes-devtools/secure-boot-efi-certs/single-key-to-efi-certs_0.1.bb
index 263f794..6a5357d 100644
--- a/recipes-devtools/secure-boot-efi-certs/single-key-to-efi-certs_0.1.bb
+++ b/recipes-devtools/secure-boot-efi-certs/single-key-to-efi-certs_0.1.bb
@@ -24,6 +24,12 @@ DPKG_ARCH = "all"

do_prepare_build() {
deb_debianize
+ if [ -n "${SOURCE_DATE_EPOCH}" ]; then

Good catch! Thanks for debugging this. Please just use
DEBIAN_CHANGELOG_TIMESTAMP instead of the SDE. This variable is always
available and aligns the timestamp of SB parts with the one from the
changelog.

 

Thanks, sent v2 patch to use DEBIAN_CHANGELOG_TIMESTAMP instead of SDE.

And simpler code - even better.

Thanks for debugging my bug! :)

 

Thanks, the v2 patch has a simpler code now, removed condition check. 

The recipe is updated to use timestamp option by default.

While thinking about it, I'm wondering if the timestamp actually has
security relevance (e.g. for checking the freshness of the DB). I know
that timestamps in general are pointless in this context, but I'm
wondering why it can be set in the first place.

The DEBIAN_CHANGELOG_TIMESTAMP usually is set to 1h after unix epoch
(for technical reasons 0 cannot be used as this is "magic").

If we need a proper timestamp here, we should provide a way to set the
DEBIAN_CHANGELOG_TIMESTAMP just for that package (e.g. by introducing a
variable).

But still, the code should use DEBIAN_CHANGELOG_TIMESTAMP to align the
changelog timestamp with the SB one.

Felix

Thanks & Regards

Shivanand K