From 8b1469b787e5da02441b3c7ee513caf91469dc3b Mon Sep 17 00:00:00 2001
From: "flowzone-app[bot]"
 <124931076+flowzone-app[bot]@users.noreply.github.com>
Date: Tue, 11 Jun 2024 18:42:44 +0000
Subject: [PATCH] v5.3.20

---
 .versionbot/CHANGELOG.yml | 54 +++++++++++++++++++++++++++++++++++++++
 CHANGELOG.md              | 15 +++++++++++
 VERSION                   |  2 +-
 3 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/.versionbot/CHANGELOG.yml b/.versionbot/CHANGELOG.yml
index 0fb19fbb..03510ef3 100644
--- a/.versionbot/CHANGELOG.yml
+++ b/.versionbot/CHANGELOG.yml
@@ -1,3 +1,57 @@
+- commits:
+    - subject: Update layers/meta-balena to 4b3ccea138ea87cf44be8ac421faa6e4dfc0a8c0
+      hash: b9dd864dee54dc5964572a62bbf19a2e650d16ea
+      body: Update layers/meta-balena
+      footer:
+        Changelog-entry: Update layers/meta-balena to 4b3ccea138ea87cf44be8ac421faa6e4dfc0a8c0
+        changelog-entry: Update layers/meta-balena to 4b3ccea138ea87cf44be8ac421faa6e4dfc0a8c0
+      author: Self-hosted Renovate Bot
+      nested:
+        - commits:
+            - subject: "hostapp-update-hooks: Re-add check for UEFI to signed-update hook"
+              hash: 972ef5f6090fc48a94a313bf01d8d59c6a3570d9
+              body: >
+                In 328222014146f0116e0208443f3e255d0e85ef15 we have removed
+
+                the signed-update hook from systems that do not have EFI
+
+                in MACHINE_FEATURES. This on its own makes sense, however
+                together
+
+                with it we have also removed the runtime check for whether the
+                running
+
+                system is actually booted in UEFI mode.
+
+
+                This effectively means it is no longer possible to update the
+                host OS
+
+                on a device type able to boot in both UEFI and BIOS modes
+
+                (intel-nuc and genericx86-64-ext) when booted in BIOS mode,
+
+                as the signed-update hook is executed unconditionally and fails
+
+                if the device is not running UEFI.
+
+
+                This patch re-adds the runtime check to only execute the hook
+
+                if the system is actually booted in UEFI mode.
+              footer:
+                Change-type: patch
+                change-type: patch
+                Signed-off-by: Michal Toman <michalt@balena.io>
+                signed-off-by: Michal Toman <michalt@balena.io>
+              author: Michal Toman
+              nested: []
+          version: meta-balena-5.3.20
+          title: ""
+          date: 2024-06-11T12:55:22.727Z
+  version: 5.3.20
+  title: ""
+  date: 2024-06-11T18:42:39.728Z
 - commits:
     - subject: Update layers/meta-balena to 6d6ebe2b54ad45236c5fe53c1cc046cf350efdbe
       hash: 689c0a139c6f8771451b4eaee463e36c6f66a55a
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58b43367..ca1c91f4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,21 @@
 Change log
 -----------
 
+# v5.3.20
+## (2024-06-11)
+
+
+<details>
+<summary> Update layers/meta-balena to 4b3ccea138ea87cf44be8ac421faa6e4dfc0a8c0 [Self-hosted Renovate Bot] </summary>
+
+> ## meta-balena-5.3.20
+> ### (2024-06-11)
+> 
+> * hostapp-update-hooks: Re-add check for UEFI to signed-update hook [Michal Toman]
+> 
+
+</details>
+
 # v5.3.19
 ## (2024-06-10)
 
diff --git a/VERSION b/VERSION
index 71992038..121f4c2b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-5.3.19
\ No newline at end of file
+5.3.20
\ No newline at end of file