From f5e803640c80604f1c20518ab24250090798e018 Mon Sep 17 00:00:00 2001
From: "flowzone-app[bot]"
 <124931076+flowzone-app[bot]@users.noreply.github.com>
Date: Tue, 11 Jun 2024 15:42:06 +0000
Subject: [PATCH] v5.3.20

---
 .versionbot/CHANGELOG.yml | 54 +++++++++++++++++++++++++++++++++++++++
 CHANGELOG.md              | 15 +++++++++++
 VERSION                   |  2 +-
 3 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/.versionbot/CHANGELOG.yml b/.versionbot/CHANGELOG.yml
index 93458b3f..f2b56342 100644
--- a/.versionbot/CHANGELOG.yml
+++ b/.versionbot/CHANGELOG.yml
@@ -1,3 +1,57 @@
+- commits:
+    - subject: Update layers/meta-balena to 4b3ccea138ea87cf44be8ac421faa6e4dfc0a8c0
+      hash: d7e393b13cd3f497b88488adaf709bfd4b9d094d
+      body: Update layers/meta-balena
+      footer:
+        Changelog-entry: Update layers/meta-balena to 4b3ccea138ea87cf44be8ac421faa6e4dfc0a8c0
+        changelog-entry: Update layers/meta-balena to 4b3ccea138ea87cf44be8ac421faa6e4dfc0a8c0
+      author: Self-hosted Renovate Bot
+      nested:
+        - commits:
+            - subject: "hostapp-update-hooks: Re-add check for UEFI to signed-update hook"
+              hash: 972ef5f6090fc48a94a313bf01d8d59c6a3570d9
+              body: >
+                In 328222014146f0116e0208443f3e255d0e85ef15 we have removed
+
+                the signed-update hook from systems that do not have EFI
+
+                in MACHINE_FEATURES. This on its own makes sense, however
+                together
+
+                with it we have also removed the runtime check for whether the
+                running
+
+                system is actually booted in UEFI mode.
+
+
+                This effectively means it is no longer possible to update the
+                host OS
+
+                on a device type able to boot in both UEFI and BIOS modes
+
+                (intel-nuc and genericx86-64-ext) when booted in BIOS mode,
+
+                as the signed-update hook is executed unconditionally and fails
+
+                if the device is not running UEFI.
+
+
+                This patch re-adds the runtime check to only execute the hook
+
+                if the system is actually booted in UEFI mode.
+              footer:
+                Change-type: patch
+                change-type: patch
+                Signed-off-by: Michal Toman <michalt@balena.io>
+                signed-off-by: Michal Toman <michalt@balena.io>
+              author: Michal Toman
+              nested: []
+          version: meta-balena-5.3.20
+          title: ""
+          date: 2024-06-11T12:55:22.727Z
+  version: 5.3.20
+  title: ""
+  date: 2024-06-11T15:42:01.279Z
 - commits:
     - subject: Update layers/meta-balena to 6d6ebe2b54ad45236c5fe53c1cc046cf350efdbe
       hash: c07659dda78ac43866bc7e690467418fa7c6cfa4
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 45be34a8..b8171ea3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,21 @@
 Change log
 -----------
 
+# v5.3.20
+## (2024-06-11)
+
+
+<details>
+<summary> Update layers/meta-balena to 4b3ccea138ea87cf44be8ac421faa6e4dfc0a8c0 [Self-hosted Renovate Bot] </summary>
+
+> ## meta-balena-5.3.20
+> ### (2024-06-11)
+> 
+> * hostapp-update-hooks: Re-add check for UEFI to signed-update hook [Michal Toman]
+> 
+
+</details>
+
 # v5.3.19
 ## (2024-06-10)
 
diff --git a/VERSION b/VERSION
index 71992038..121f4c2b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-5.3.19
\ No newline at end of file
+5.3.20
\ No newline at end of file