According to KernelCare Security Assessment (2025) from
Anvil Secure the image_validation tool should be used
to produce the final binary. Set the required NX_COMPAT
flag using image validation tool [1][2]:

Link[1]: https://learn.microsoft.com/en-us/windows-hardware/drivers/bringup/uefi-ca-memory-mitigation-requirements#if-implemented-pecoff-dll-attestation
Link[2]: https://github.com/tianocore/edk2-pytool-extensions
Signed-off-by: Andrei Kanner <akanner@cloudlinux.com>

Old one from [1] and the new longterm_2032:
curl -LO https://patches.kernelcare.com/kernelcare_pub.der
curl -LO https://patches.kernelcare.com/kernelcare_pub_longterm_2032.der

Link[1]: https://docs.tuxcare.com/live-patching-services/#uefi-secure-boot-support-1
Signed-off-by: Andrei Kanner <akanner@cloudlinux.com>

Signed-off-by: Andrei Kanner <akanner@cloudlinux.com>

build-all.sh builds shim_certificate_kernelcare for x86_64 and aarch64
in almalinux:9 containers (aarch64 via qemu-user-static) and saves each
.efi + .log under kernelcare-result-<date>/.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Andrei Kanner <akanner@cloudlinux.com>

Signed-off-by: Andrei Kanner <akanner@cloudlinux.com>

Signed-off-by: Andrei Kanner <akanner@cloudlinux.com>

KernelCare certwrapper build 2026-06-04 (plus automated scripts)