From 36bd904434ac793ee9e3cbf5873847fd642d1f09 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 4 Mar 2026 14:03:50 -0500 Subject: [PATCH 01/17] abixml: less chaff in the updates. This changes our abixml generation in a few ways: - no longer include file locations - no longer include architecture information - uses hashes for the type-ids instead of enumerating them This should enhance the ability to read updates to these files in the future. Signed-off-by: Peter Jones --- src/include/rules.mk | 9 +- src/libefiboot.abixml | 2370 ++++++++++++++++---------------- src/libefisec.abixml | 638 ++++----- src/libefivar.abixml | 3034 ++++++++++++++++++++--------------------- 4 files changed, 3029 insertions(+), 3022 deletions(-) diff --git a/src/include/rules.mk b/src/include/rules.mk index 8d0b68a2..bcaa39f9 100644 --- a/src/include/rules.mk +++ b/src/include/rules.mk @@ -39,12 +39,19 @@ family = $(foreach FAMILY_SUFFIX,$(FAMILY_SUFFIXES),$($(1)_$(FAMILY_SUFFIX))) ln -vfs $@ $@.1 %.abixml : %.so - $(ABIDW) --headers-dir $(TOPDIR)/src/include/efivar/ --out-file $@ $^ + $(ABIDW) \ + --headers-dir $(TOPDIR)/src/include/efivar/ \ + --no-show-locs \ + --no-architecture \ + --type-id-style hash \ + --out-file $@ $^ @sed -i -s 's,$(TOPDIR)/,,g' $@ %.abicheck : %.so $(ABIDIFF) \ --suppr abignore \ + --no-show-locs \ + --no-architecture \ --headers-dir2 $(TOPDIR)/src/include/efivar/ \ $(patsubst %.so,%.abixml,$<) \ $< diff --git a/src/libefiboot.abixml b/src/libefiboot.abixml index 9ca69e07..8998d14f 100644 --- a/src/libefiboot.abixml +++ b/src/libefiboot.abixml @@ -1,4 +1,4 @@ - + @@ -112,2010 +112,2010 @@ - - + + - - - - + + + + - - + + - - - - + + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - - - - - - - - - - - - - + + + + + + + + + + + + + - + - - - - - + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - - + + - - - + + + - - + + - - - - - + + + + + - - + + - - - + + + - + - - - - + + + + - - - + + + - - - + + + - - - + + + - - - + + + - + - - - - - + + + + + - - - + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - + - + - + - + - + - + - + - + - - - - - - + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - + - + - + - + - + - + - + - - - - - - - + + + + + + + - + - - - + + + - - - - - + + + + + - - - + + + - - - + + + - - + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - + + + + + + + + + - - - - + + + + - - - + + + - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + - - - - + + + + - - - - - - - - - - + + + + + + + + + + - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + - - - - - - - - - + + + + + + + + + - - + + - - + + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - + + + + + + + + + + + - - - + + + - - - + + + - - - + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - + + + + + + + diff --git a/src/libefisec.abixml b/src/libefisec.abixml index b4155ee3..385b0753 100644 --- a/src/libefisec.abixml +++ b/src/libefisec.abixml @@ -1,4 +1,4 @@ - + @@ -56,93 +56,93 @@ - - - - - - - + + + + + + + - - + + - + - - + + - - - + + + - - - + + + - + - - - - - + + + + + - - - - + + + + - - - + + + - - - - - + + + + + - - - - - + + + + + - - - + + + - - - - - - - - + + + + + + + + - + - - - - + + + + - - + + - - + + - - + + @@ -157,437 +157,437 @@ - - + + - - - - + + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - - - - + + + + - + - + - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + - - - - - - - + + + + + + + - - - - - - - + + + + + + + - - - - - + + + + + - - - - - + + + + + - - - - - + + + + + - - - + + + - - - - - - - - - - + + + + + + + + + + - - - - - - - + + + + + + + - - - - - + + + + + - - - - - - - - + + + + + + + + - - - - - - + + + + + + diff --git a/src/libefivar.abixml b/src/libefivar.abixml index dd85051c..8a958a7c 100644 --- a/src/libefivar.abixml +++ b/src/libefivar.abixml @@ -1,4 +1,4 @@ - + @@ -215,2354 +215,2354 @@ - - + + - - + + - - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - + + + + + + + + + + + + - + - - - - + + + + - - - + + + - - - - + + + + - - - - + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - + + + - - + + - - - + + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - - + + - - + + - - + + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - - - + + + - + - - - + + + - + - - + + - - - - + + + + - - - - + + + + - - - + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - + + + + + - - - + + + - - - - - + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - + - + - - - - - - + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - - - - + + + + - + - + - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - + + - - - - - - - - + + + + + + + + - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + From a31102cad92040561f1463d45b2b1d8944216ad6 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 22 Sep 2025 14:51:58 -0400 Subject: [PATCH 02/17] Fix minor makefile error. EFISECDB_SOURCES was missing from ALL_SOURCES. Signed-off-by: Peter Jones --- src/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/src/Makefile b/src/Makefile index 6fc2a622..84c8ea84 100644 --- a/src/Makefile +++ b/src/Makefile @@ -36,6 +36,7 @@ util-makeguids.c : util.c ALL_SOURCES=$(LIBEFISEC_SOURCES) $(LIBEFIBOOT_SOURCES) $(LIBEFIVAR_SOURCES) \ $(MAKEGUIDS_SOURCES) $(GENERATED_SOURCES) $(EFIVAR_SOURCES) \ + $(EFISECDB_SOURCES) \ $(sort $(wildcard include/efivar/*.h)) ifneq ($(MAKECMDGOALS),clean) From 0bed0356086b198d828908347232296a9aa7b45b Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 4 Mar 2026 10:25:22 -0500 Subject: [PATCH 03/17] tests: minor gitignore fix. Signed-off-by: Peter Jones --- tests/.gitignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/.gitignore b/tests/.gitignore index 65a59f48..c9b50528 100644 --- a/tests/.gitignore +++ b/tests/.gitignore @@ -1,7 +1,7 @@ !*.cer !*.esl *.esl.txt -*.result.* +*.result* !*.var *.export.var test.*.result.var From 9f924ad191e7e972a48107606d74aa7f53cb3648 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 3 Mar 2026 11:32:34 -0500 Subject: [PATCH 04/17] Make a few tests less noisy. Signed-off-by: Peter Jones --- tests/Makefile | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/Makefile b/tests/Makefile index 4b1e62a5..aa903615 100644 --- a/tests/Makefile +++ b/tests/Makefile @@ -27,9 +27,11 @@ V ?= 0 ifeq ($(V),0) quiet=@ rmverbose= + makequiet=--quiet else quiet= rmverbose=-v + makequiet= endif ifeq ($(V),2) loud=-vvvv @@ -255,7 +257,7 @@ test.esl.cert.addition.esl.result: test.esl.cert.addition: $(quiet)echo testing ESL entry addition with x509 cert - $(quiet)$(MAKE) test.esl.cert.addition.esl.result.txt test.esl.cert.addition.esl.goal.txt + $(quiet)$(MAKE) $(makequiet) test.esl.cert.addition.esl.result.txt test.esl.cert.addition.esl.goal.txt $(quiet)if ! cmp test.esl.cert.addition.esl.goal test.esl.cert.addition.esl.result ; then \ diff -U 200 test.esl.cert.addition.esl.goal.txt test.esl.cert.addition.esl.result.txt ; \ exit 1 ; \ @@ -272,7 +274,7 @@ test.esl.cert.removal.esl.result: test.esl.cert.removal: $(quiet)echo testing ESL entry removal with x509 cert - $(quiet)$(MAKE) test.esl.cert.removal.esl.goal.txt test.esl.cert.removal.esl.result.txt + $(quiet)$(MAKE) $(makequiet) test.esl.cert.removal.esl.goal.txt test.esl.cert.removal.esl.result.txt $(quiet)if ! cmp test.esl.cert.removal.esl.goal test.esl.cert.removal.esl.result ; then \ diff -U 200 test.esl.cert.removal.esl.goal.txt test.esl.cert.removal.esl.result.txt ; \ exit 1 ; \ From 4849a3c431c28d69cb6f8f3909d3ecdbb7b2ec43 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 15 Jan 2026 13:31:08 -0500 Subject: [PATCH 05/17] Add a make rule for compile_commands.json Signed-off-by: Peter Jones --- Makefile | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/Makefile b/Makefile index 5f1dc886..7f075f5c 100644 --- a/Makefile +++ b/Makefile @@ -49,6 +49,10 @@ clean-toplevel: @rm -vf efivar.spec vgcore.* core.* @$(MAKE) -C tests clean +compile_commands.json : Makefile + make clean + bear -- make COMPILER=clang test all + test : all @$(MAKE) -C tests From bcd80b806d58a6e7e3d81f1caf709577bd6ef1a2 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 20 Jan 2026 16:33:27 -0500 Subject: [PATCH 06/17] includes: use #pragma once on /internal/ headers. It's 2026 and we have compilers that support '#pragma once' instead of '#define' include guards. It's really a lot nicer. Unfortunately we can't really use it for the external headers, because we need the names to make sure we're always including the development versions instead of the system versions. Signed-off-by: Peter Jones --- src/compiler.h | 4 +--- src/crc32.h | 7 +------ src/diag.h | 5 +---- src/disk.h | 5 +---- src/dp.h | 5 +---- src/efiboot.h | 6 +----- src/efisec.h | 6 +----- src/efivar.h | 6 +----- src/efivar_endian.h | 5 +---- src/esl-iter.h | 5 +---- src/fix_coverity.h | 6 +----- src/generics.h | 4 +--- src/gpt.h | 6 +----- src/guid.h | 5 +---- src/hexdump.h | 5 +---- src/lib.h | 6 +----- src/linux.h | 5 +---- src/list.h | 6 +----- src/makeguids.h | 5 +---- src/path-helpers.h | 8 +------- src/safemath.h | 6 +----- src/secdb.h | 5 ++--- src/ucs2.h | 5 +---- src/util.h | 5 +---- src/x509.h | 4 +--- 25 files changed, 26 insertions(+), 109 deletions(-) diff --git a/src/compiler.h b/src/compiler.h index d95fb014..2700fe64 100644 --- a/src/compiler.h +++ b/src/compiler.h @@ -4,8 +4,7 @@ * Copyright Peter Jones */ -#ifndef COMPILER_H_ -#define COMPILER_H_ +#pragma once /* GCC version checking borrowed from glibc. */ #if defined(__GNUC__) && defined(__GNUC_MINOR__) @@ -80,5 +79,4 @@ #define ALIGNMENT_PADDING(value, align) ((align - (value % align)) % align) #define ALIGN_UP(value, align) ((value) + ALIGNMENT_PADDING(value, align)) -#endif /* !COMPILER_H_ */ // vim:fenc=utf-8:tw=75:noet diff --git a/src/crc32.h b/src/crc32.h index 1027d2be..225ab9c3 100644 --- a/src/crc32.h +++ b/src/crc32.h @@ -3,9 +3,7 @@ * crc32.h - headers for crc32 * */ - -#ifndef _CRC32_H -#define _CRC32_H +#pragma once #include @@ -34,7 +32,4 @@ efi_crc32(const void *buf, unsigned long len) return (crc32(buf, len, ~0L) ^ ~0L); } - -#endif /* _CRC32_H */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/diag.h b/src/diag.h index 83991f0c..6d8b0cef 100644 --- a/src/diag.h +++ b/src/diag.h @@ -3,9 +3,7 @@ * diag.h - Set up appropriate -W flags based on which compiler is in use * Copyright Peter Jones */ - -#ifndef PRIVATE_DIAG_H_ -#define PRIVATE_DIAG_H_ +#pragma once #if defined(__clang__) #pragma clang diagnostic ignored "-Wpointer-bool-conversion" @@ -55,5 +53,4 @@ #endif /* !defined(EFIVAR_SYNTAX_CHECKING) */ #endif -#endif /* !PRIVATE_DIAG_H_ */ // vim:fenc=utf-8:tw=75:noet diff --git a/src/disk.h b/src/disk.h index 100b8d1e..3e780c47 100644 --- a/src/disk.h +++ b/src/disk.h @@ -4,14 +4,11 @@ * Copyright 2012-2015 Red Hat, Inc. * Copyright (C) 2001 Dell Computer Corporation */ -#ifndef _EFIBOOT_DISK_H -#define _EFIBOOT_DISK_H +#pragma once extern bool HIDDEN is_partitioned(int fd); extern HIDDEN ssize_t make_hd_dn(uint8_t *buf, ssize_t size, int fd, int32_t partition, uint32_t options); -#endif /* _EFIBOOT_DISK_H */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/dp.h b/src/dp.h index 59f436a0..95c26382 100644 --- a/src/dp.h +++ b/src/dp.h @@ -3,8 +3,7 @@ * libefivar - library for the manipulation of EFI variables * Copyright 2012-2015 Red Hat, Inc. */ -#ifndef _EFIVAR_INTERNAL_DP_H -#define _EFIVAR_INTERNAL_DP_H +#pragma once #include #include @@ -179,6 +178,4 @@ extern ssize_t _format_bios_boot_dn(unsigned char *buf, size_t size, const_efidp #define format_bios_boot_dn(buf, size, off, dp) \ format_helper_2(_format_bios_boot_dn, buf, size, off, dp) -#endif /* _EFIVAR_INTERNAL_DP_H */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/efiboot.h b/src/efiboot.h index f3e32362..bf68d300 100644 --- a/src/efiboot.h +++ b/src/efiboot.h @@ -3,13 +3,9 @@ * efiboot.h * Copyright 2018 Peter Jones */ - -#ifndef PRIVATE_EFIBOOT_H_ -#define PRIVATE_EFIBOOT_H_ +#pragma once #include "efivar.h" #include -#endif /* !PRIVATE_EFIBOOT_H_ */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/efisec.h b/src/efisec.h index c0fdd205..4bc8bc12 100644 --- a/src/efisec.h +++ b/src/efisec.h @@ -3,9 +3,7 @@ * efisec.h * Copyright 2018 Peter Jones */ - -#ifndef PRIVATE_EFISEC_H_ -#define PRIVATE_EFISEC_H_ +#pragma once #include "fix_coverity.h" @@ -26,6 +24,4 @@ #include "secdb.h" #include "x509.h" -#endif /* !PRIVATE_EFISEC_H_ */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/efivar.h b/src/efivar.h index a94f2b53..0304b32a 100644 --- a/src/efivar.h +++ b/src/efivar.h @@ -3,9 +3,7 @@ * efivar.h * Copyright 2018 Peter Jones */ - -#ifndef PRIVATE_EFIVAR_H_ -#define PRIVATE_EFIVAR_H_ +#pragma once #pragma GCC diagnostic warning "-Wcpp" @@ -31,6 +29,4 @@ #include "path-helpers.h" #include "makeguids.h" -#endif /* !PRIVATE_EFIVAR_H_ */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/efivar_endian.h b/src/efivar_endian.h index 46077849..b71424f4 100644 --- a/src/efivar_endian.h +++ b/src/efivar_endian.h @@ -4,8 +4,7 @@ * * Author: Peter Jones */ -#ifndef _EFIVAR_ENDIAN_H -#define _EFIVAR_ENDIAN_H +#pragma once #include @@ -37,6 +36,4 @@ #define le64_to_cpu(x) ((uint64_t)__builtin_bswap64(x)) #endif -#endif /* _EFIVAR_ENDIAN_H */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/esl-iter.h b/src/esl-iter.h index 1f61e1a6..fc985968 100644 --- a/src/esl-iter.h +++ b/src/esl-iter.h @@ -5,8 +5,7 @@ * * Author(s): Peter Jones */ -#ifndef PRIVATE_ESL_ITER_H_ -#define PRIVATE_ESL_ITER_H_ 1 +#pragma once #include "efisec.h" @@ -78,5 +77,3 @@ extern int esl_iter_get_line(esl_iter *iter) intptr_t esd_get_esl_offset(esl_iter *iter) __attribute__((__nonnull__(1))); - -#endif /* PRIVATE_ESL_ITER_H_ */ diff --git a/src/fix_coverity.h b/src/fix_coverity.h index 5c92c4db..e61728fb 100644 --- a/src/fix_coverity.h +++ b/src/fix_coverity.h @@ -4,9 +4,7 @@ * Copyright 2017 Peter Jones * */ - -#ifndef FIX_COVERITY_H -#define FIX_COVERITY_H +#pragma once #ifndef _GNU_SOURCE #define _GNU_SOURCE @@ -106,6 +104,4 @@ typedef _Complex float __cfloat128 __attribute__ ((__mode__ (__TC__))); #undef __COVERITY_GCC_VERSION_AT_LEAST #endif -#endif /* !FIX_COVERITY_H */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/generics.h b/src/generics.h index 26377d94..f349c2b1 100644 --- a/src/generics.h +++ b/src/generics.h @@ -4,8 +4,7 @@ */ #ifndef EFIVAR_BUILD_ENVIRONMENT -#ifndef LIBEFIVAR_GENERIC_NEXT_VARIABLE_NAME_H -#define LIBEFIVAR_GENERIC_NEXT_VARIABLE_NAME_H 1 +#pragma once #include #include @@ -166,7 +165,6 @@ generic_append_variable(efi_guid_t guid, const char *name, return rc; } -#endif /* LIBEFIVAR_GENERIC_NEXT_VARIABLE_NAME_H */ #endif /* EFIVAR_BUILD_ENVIRONMENT */ // vim:fenc=utf-8:tw=75:noet diff --git a/src/gpt.h b/src/gpt.h index fe5029d8..80e1d192 100644 --- a/src/gpt.h +++ b/src/gpt.h @@ -9,9 +9,7 @@ * Per Intel EFI Specification v1.02 * http://developer.intel.com/technology/efi/efi.htm */ - -#ifndef _EFIBOOT_GPT_H -#define _EFIBOOT_GPT_H +#pragma once #include #include "include/efivar/efivar-types.h" @@ -151,6 +149,4 @@ gpt_disk_get_partition_info (int fd, uint32_t num, uint64_t *start, uint8_t *mbr_type, uint8_t *signature_type, int ignore_pmbr_error, int logical_sector_size); -#endif /* _EFIBOOT_GPT_H */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/guid.h b/src/guid.h index bb0198d3..39849bf9 100644 --- a/src/guid.h +++ b/src/guid.h @@ -3,8 +3,7 @@ * libefivar - library for the manipulation of EFI variables * Copyright 2012-2013 Red Hat, Inc. */ -#ifndef LIBEFIVAR_GUID_H -#define LIBEFIVAR_GUID_H 1 +#pragma once #include #include @@ -217,6 +216,4 @@ efi_str_to_guid_(const char *s, efi_guid_t *guid) return rc; } -#endif /* LIBEFIVAR_GUID */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/hexdump.h b/src/hexdump.h index eb8b2339..550a8921 100644 --- a/src/hexdump.h +++ b/src/hexdump.h @@ -3,8 +3,7 @@ * libefivar - library for the manipulation of EFI variables * Copyright 2018-2020 Peter M. Jones */ -#ifndef STATIC_HEXDUMP_H -#define STATIC_HEXDUMP_H +#pragma once #include #include @@ -151,6 +150,4 @@ hexdumpat(uint8_t *data, unsigned long size, size_t at) fhexdumpf(stdout, "", data, size, at); } -#endif /* STATIC_HEXDUMP_H */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/lib.h b/src/lib.h index 75d20788..076a2eea 100644 --- a/src/lib.h +++ b/src/lib.h @@ -3,9 +3,7 @@ * libefivar - library for the manipulation of EFI variables * Copyright 2012-2013 Red Hat, Inc. */ - -#ifndef LIBEFIVAR_LIB_H -#define LIBEFIVAR_LIB_H 1 +#pragma once #include #include @@ -47,6 +45,4 @@ typedef unsigned long efi_status_t; extern struct efi_var_operations vars_ops; extern struct efi_var_operations efivarfs_ops; -#endif /* LIBEFIVAR_LIB_H */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/linux.h b/src/linux.h index de3b5b01..c276b350 100644 --- a/src/linux.h +++ b/src/linux.h @@ -4,8 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. * Copyright (C) 2001 Dell Computer Corporation */ -#ifndef _EFIBOOT_LINUX_H -#define _EFIBOOT_LINUX_H +#pragma once #include #include @@ -359,6 +358,4 @@ extern struct dev_probe scsi_parser; extern struct dev_probe ata_parser; extern struct dev_probe emmc_parser; -#endif /* _EFIBOOT_LINUX_H */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/list.h b/src/list.h index 2cb6819e..109ca4c1 100644 --- a/src/list.h +++ b/src/list.h @@ -2,9 +2,7 @@ /* * list.h - simple list primitives */ - -#ifndef LIST_H_ -#define LIST_H_ +#pragma once #include @@ -162,6 +160,4 @@ list_sort(struct list_head *head, return 0; } - -#endif /* !LIST_H_ */ // vim:fenc=utf-8:tw=75:noet diff --git a/src/makeguids.h b/src/makeguids.h index 6168df26..2816c88c 100644 --- a/src/makeguids.h +++ b/src/makeguids.h @@ -3,9 +3,7 @@ * makeguids.h - stuff makeguids needs that we also need at runtime * Copyright Peter Jones */ - -#ifndef EFIVAR_MAKEGUIDS_H_ -#define EFIVAR_MAKEGUIDS_H_ +#pragma once #include #include @@ -272,5 +270,4 @@ read_guids_at(const int dirfd, const char * const path, return rc; } -#endif /* !EFIVAR_MAKEGUIDS_H_ */ // vim:fenc=utf-8:tw=75:noet diff --git a/src/path-helpers.h b/src/path-helpers.h index 6665eec8..3e30e3c9 100644 --- a/src/path-helpers.h +++ b/src/path-helpers.h @@ -3,9 +3,7 @@ * path-helper.h * Copyright 2018 Peter Jones */ - -#ifndef PATH_HELPER_H_ -#define PATH_HELPER_H_ +#pragma once void HIDDEN fill_spans(const char *str, const char *reject, void *spanbuf); unsigned int HIDDEN count_spans(const char *str, const char *reject, unsigned int *chars); @@ -29,8 +27,4 @@ int HIDDEN find_path_segment(const char *path, int segment, const char **pos, si ret_; \ }) - - -#endif /* !PATH_HELPER_H_ */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/safemath.h b/src/safemath.h index 8d98fb61..8802b063 100644 --- a/src/safemath.h +++ b/src/safemath.h @@ -3,9 +3,7 @@ * safemath.h * Copyright 2016-2019 Peter Jones */ - -#ifndef SAFEMATH_H_ -#define SAFEMATH_H_ +#pragma once #include "compiler.h" @@ -240,6 +238,4 @@ }) #endif - -#endif /* !SAFEMATH_H_ */ // vim:fenc=utf-8:tw=75:noet diff --git a/src/secdb.h b/src/secdb.h index 1fb6c004..70f6320d 100644 --- a/src/secdb.h +++ b/src/secdb.h @@ -4,8 +4,7 @@ * Copyright Peter Jones * Copyright Red Hat, Inc. */ -#ifndef PRIVATE_SECDB_H -#define PRIVATE_SECDB_H 1 +#pragma once #include "efisec.h" #include @@ -224,4 +223,4 @@ extern int secdb_cmp_descending(const void *a, const void *b, void *state); */ extern void secdb_dump(efi_secdb_t *secdb, bool annotate); -#endif /* PRIVATE_SECDB_H */ +// vim:fenc=utf-8:tw=75:noet diff --git a/src/ucs2.h b/src/ucs2.h index f4c51c1f..620c170b 100644 --- a/src/ucs2.h +++ b/src/ucs2.h @@ -2,8 +2,7 @@ /* * Copyright 2012-2016 Red Hat, Inc. */ -#ifndef _EFIVAR_UCS2_H -#define _EFIVAR_UCS2_H +#pragma once #define ev_bits(val, mask, shift) \ (((val) & ((mask) << (shift))) >> (shift)) @@ -230,6 +229,4 @@ utf8_to_ucs2(void *s, ssize_t size, bool terminate, const unsigned char *utf8) return j; }; -#endif /* _EFIVAR_UCS2_H */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/util.h b/src/util.h index b7b62736..a53fab77 100644 --- a/src/util.h +++ b/src/util.h @@ -5,8 +5,7 @@ * * Author(s): Peter Jones */ -#ifndef EFIVAR_UTIL_H -#define EFIVAR_UTIL_H 1 +#pragma once #include #include @@ -502,6 +501,4 @@ safe_to_print(const int c) return true; } -#endif /* EFIVAR_UTIL_H */ - // vim:fenc=utf-8:tw=75:noet diff --git a/src/x509.h b/src/x509.h index 97a9186d..610e9088 100644 --- a/src/x509.h +++ b/src/x509.h @@ -3,8 +3,7 @@ * x509.h - X.509/ASN.1 helper functions * Copyright 2019-2020 Peter M. Jones */ -#ifndef EFIVAR_X509_H -#define EFIVAR_X509_H +#pragma once #define SMALLEST_POSSIBLE_DER_SEQ 3 @@ -71,5 +70,4 @@ get_asn1_seq_size(uint8_t *location, uint32_t size) #undef SMALLEST_POSSIBLE_DER_SEQ -#endif // vim:fenc=utf-8:tw=75:noet From e5fcaf98ca1804a3322819b139cf144ede591dd1 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 19 Feb 2026 14:21:19 -0500 Subject: [PATCH 07/17] secdb: fix a minor error in the dump code GCC says this buffer is too small. I don't quite see how, but it matters little. Signed-off-by: Peter Jones --- src/secdb-dump.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/secdb-dump.c b/src/secdb-dump.c index 17f64411..33044e6a 100644 --- a/src/secdb-dump.c +++ b/src/secdb-dump.c @@ -58,7 +58,7 @@ secdb_buffer(char *val, size_t valsz, ssize_t offset) static inline ssize_t secdb_dump_value(char *val, size_t size, ssize_t offset, char *fmt, ...) { - char posbuf[9]; + char posbuf[17]; char hexbuf[49]; char textbuf[19]; From 326b27188dee5798147781e583ab9cf57c2600af Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Thu, 19 Feb 2026 11:55:29 -0500 Subject: [PATCH 08/17] esl: fix some misleading or unhelpful debug prints There are a few changes to efi_signature_list_t debug prints here: - at a few places, add display sizes in hex as well, to make comparing to x509 dumps easier. - at the place where we complain about not having valid x509 and then do nothing with that, the address it's comparing is wrong. This leads to making it look like the "invalid" x509 is related to the problem you're debugging, when it isn't related and may not even be invalid. This patch fixes that location. Signed-off-by: Peter Jones --- src/esl-iter.c | 12 +++++++----- src/secdb.c | 2 +- src/secdb.h | 2 +- src/x509.h | 4 ++-- 4 files changed, 11 insertions(+), 9 deletions(-) diff --git a/src/esl-iter.c b/src/esl-iter.c index e4c8fb89..28d94cac 100644 --- a/src/esl-iter.c +++ b/src/esl-iter.c @@ -125,9 +125,10 @@ esl_iter_next_with_size_correction(esl_iter *iter, efi_guid_t *type, asn1size = get_asn1_seq_size(iter->esd->signature_data, iter->len - sizeof(iter->esd->signature_owner)); - debug("iter->len:%zu sizeof(owner):%zd bufsz:%zd asn1sz:%d", + debug("iter->len:%zu sizeof(owner):%zd bufsz:%zd asn1sz:%d (0x%x)", iter->len, sizeof(iter->esd->signature_owner), - iter->len - sizeof(iter->esd->signature_owner), asn1size); + iter->len - sizeof(iter->esd->signature_owner), asn1size, + asn1size); if (asn1size < 0) { debug("iterator data claims to be an X.509 Cert but is not valid ASN.1 DER"); @@ -377,9 +378,10 @@ esl_list_iter_next_with_size_correction(esl_list_iter *iter, efi_guid_t *type, if (!efi_guid_cmp(&type, &efi_guid_x509_cert)) { int32_t asn1size; - asn1size = get_asn1_seq_size( - iter->buf + iter->offset + sizeof(efi_guid_t), - *len - sizeof(efi_guid_t)); + asn1size = get_asn1_seq_size(iter->buf + iter->offset + + sizeof(efi_signature_list_t) + + sizeof(efi_guid_t), + *len - sizeof(efi_guid_t)); if (asn1size < 0) { debug("iterator data claims to be an X.509 Cert but is not valid ASN.1 DER"); } else if ((uint32_t)asn1size != iter->esl->signature_size diff --git a/src/secdb.c b/src/secdb.c index 00d107b2..5c165752 100644 --- a/src/secdb.c +++ b/src/secdb.c @@ -264,7 +264,7 @@ efi_secdb_add_entry_or_secdb(efi_secdb_t *top, return 0; } - debug("adding %zd(0x%zd) bytes of data", datasz, datasz); + debug("adding %zd(0x%lx) bytes of data", datasz, datasz); secdb_add_entry_data(secdb, owner, data, datasz); if (sort_data && secdb->sigsz) { debug("sorting data %s", sort_descending ? "desc" : "asc"); diff --git a/src/secdb.h b/src/secdb.h index 70f6320d..c4c94ca9 100644 --- a/src/secdb.h +++ b/src/secdb.h @@ -180,7 +180,7 @@ secdb_entry_size(efi_secdb_t *secdb) sz = sizeof(efi_signature_list_t) + secdb->hdrsz + secdb->sigsz * secdb->nsigs; - debug("secdb:%p sz:%zd", secdb, sz); + debug("secdb:%p sz:%zd (0x%lx)", secdb, sz, sz); return sz; } diff --git a/src/x509.h b/src/x509.h index 610e9088..57b8ef8c 100644 --- a/src/x509.h +++ b/src/x509.h @@ -23,13 +23,13 @@ get_asn1_seq_size(uint8_t *location, uint32_t size) // If it's not a CONSTRUCTED SEQUENCE it's not a certificate if (location[0] != 0x30) { - debug("%p: %d != 0x30", &location[0], location[0]); + debug("%p: 0x%02x != 0x30", &location[0], location[0]); return -1; } if (!(location[1] & 0x80)) { // Short form, which is too small to hold a certificate. - debug("%p: %d & 0x80 == 1", &location[1], location[1]); + debug("%p: 0x%02x & 0x80 == 1", &location[1], location[1]); return -1; } From c888a5cdc5a2a766fd1cc5aa942bad40ede2a822 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 20 Jan 2026 15:41:51 -0500 Subject: [PATCH 09/17] libefisec: rename enum values in our public API. enums in C are absolutely hopeless in many ways, and one of them is that they don't get their own namespace. Unfortunately that means if you named a value in an enum "SHA256" (for example) and you want to include a header that also names something entirely different "SHA256", it doesn't work. This changes the name of our enum values in libefisec's public API so that they're prefixed appropriately so as not to conflict with e.g. openssl. Hopefully this doesn't break any consumers, but it's how it always should have been. Unfortunately (and for reasons that aren't quite clear to me) these values show up in our public ABI, and their /names/ show up in the .abixml files, so it might be a (minor) breaking change. Signed-off-by: Peter Jones --- src/efisecdb.c | 8 ++-- src/include/efivar/efisec-secdb.h | 36 ++++++++-------- src/libefisec.abixml | 40 +++++++++--------- src/secdb.c | 68 +++++++++++++++---------------- src/secdb.h | 14 +++---- 5 files changed, 83 insertions(+), 83 deletions(-) diff --git a/src/efisecdb.c b/src/efisecdb.c index 70fa1847..34aee322 100644 --- a/src/efisecdb.c +++ b/src/efisecdb.c @@ -38,17 +38,17 @@ struct hash_param { static struct hash_param hash_params[] = { {.name = "sha512", - .algorithm = SHA512, + .algorithm = EFI_SECDB_TYPE_SHA512, .size = 64, .def = false, }, {.name = "sha256", - .algorithm = SHA256, + .algorithm = EFI_SECDB_TYPE_SHA256, .size = 32, .def = true, }, {.name = "sha1", - .algorithm = SHA1, + .algorithm = EFI_SECDB_TYPE_SHA1, .size = 20, .def = false, }, @@ -394,7 +394,7 @@ main(int argc, char *argv[]) mode == ADD ? "adding" : "removing", datasz); if (mode == ADD) wants_add_actions = true; - add_action(&actions, mode, &owner, X509_CERT, data, datasz); + add_action(&actions, mode, &owner, EFI_SECDB_TYPE_X509_CERT, data, datasz); break; case 'd': dump = true; diff --git a/src/include/efivar/efisec-secdb.h b/src/include/efivar/efisec-secdb.h index ece4a7d7..4f1f52a2 100644 --- a/src/include/efivar/efisec-secdb.h +++ b/src/include/efivar/efisec-secdb.h @@ -28,23 +28,23 @@ typedef union { uint8_t raw[0]; } efi_secdb_data_t; -typedef enum { - X509_CERT, // a raw x509 cert - X509_SHA256, // SHA-256 hash of the TBSData - SHA256, // SHA-256 hash - X509_SHA512, // SHA-512 hash of the TBSData - SHA512, // SHA-512 hash - X509_SHA384, // SHA-384 hash of the TBSData - SHA224, // SHA-224 hash - SHA384, // SHA-384 hash - SHA1, // SHA-1 hash - RSA2048, // RSA-2048 pubkey (m, e=0x10001) - RSA2048_SHA1, // RSA-2048 signature of a SHA-1 hash - RSA2048_SHA256, // RSA-2048 signature of a SHA-256 hash - MAX_SECDB_TYPE +typedef enum efi_secdb_type { + EFI_SECDB_TYPE_X509_CERT, // a raw x509 cert + EFI_SECDB_TYPE_X509_SHA256, // SHA-256 hash of the TBSData + EFI_SECDB_TYPE_SHA256, // SHA-256 hash + EFI_SECDB_TYPE_X509_SHA512, // SHA-512 hash of the TBSData + EFI_SECDB_TYPE_SHA512, // SHA-512 hash + EFI_SECDB_TYPE_X509_SHA384, // SHA-384 hash of the TBSData + EFI_SECDB_TYPE_SHA224, // SHA-224 hash + EFI_SECDB_TYPE_SHA384, // SHA-384 hash + EFI_SECDB_TYPE_SHA1, // SHA-1 hash + EFI_SECDB_TYPE_RSA2048, // RSA-2048 pubkey (m, e=0x10001) + EFI_SECDB_TYPE_RSA2048_SHA1, // RSA-2048 signature of a SHA-1 hash + EFI_SECDB_TYPE_RSA2048_SHA256, // RSA-2048 signature of a SHA-256 hash + EFI_SECDB_TYPE_MAX } efi_secdb_type_t; -typedef enum { +typedef enum efi_secdb_flag { EFI_SECDB_SORT, EFI_SECDB_SORT_DATA, EFI_SECDB_SORT_DESCENDING, @@ -74,9 +74,9 @@ extern int efi_secdb_realize(efi_secdb_t *secdb, extern void efi_secdb_free(efi_secdb_t *secdb); typedef enum { - ERROR = -1, - BREAK = 0, - CONTINUE = 1, + EFI_SECDB_VISITOR_ERROR = -1, + EFI_SECDB_VISITOR_BREAK = 0, + EFI_SECDB_VISITOR_CONTINUE = 1, } efi_secdb_visitor_status_t; typedef efi_secdb_visitor_status_t diff --git a/src/libefisec.abixml b/src/libefisec.abixml index 385b0753..da2dc36a 100644 --- a/src/libefisec.abixml +++ b/src/libefisec.abixml @@ -135,27 +135,27 @@ - + - + - - - - - - - - - - - - - + + + + + + + + + + + + + @@ -366,8 +366,8 @@ - - + + @@ -508,7 +508,7 @@ - + @@ -516,7 +516,7 @@ - + @@ -524,7 +524,7 @@ - + diff --git a/src/secdb.c b/src/secdb.c index 5c165752..4cf39a07 100644 --- a/src/secdb.c +++ b/src/secdb.c @@ -42,7 +42,7 @@ find_secdb_entry(efi_secdb_t *top, efi_secdb_type_t algorithm, size_t datasz) size_t sigsz = datasz + sizeof(efi_guid_t); char *algstr = NULL; - if (algorithm != X509_CERT) + if (algorithm != EFI_SECDB_TYPE_X509_CERT) sigsz = secdb_entry_size_from_type(algorithm); efi_guid_to_id_guid(secdb_guid_from_type(algorithm), &algstr); @@ -54,7 +54,7 @@ find_secdb_entry(efi_secdb_t *top, efi_secdb_type_t algorithm, size_t datasz) efi_secdb_t *candidate = list_entry(pos, efi_secdb_t, list); if (candidate->listsz == 0 || - candidate->algorithm == MAX_SECDB_TYPE || + candidate->algorithm == EFI_SECDB_TYPE_MAX || (candidate->algorithm == algorithm && candidate->sigsz == sigsz)) { secdb = candidate; @@ -75,7 +75,7 @@ alloc_secdb_entry(efi_secdb_t *top, efi_secdb_t *secdb = NULL; size_t sigsz = datasz; - if (algorithm != X509_CERT) + if (algorithm != EFI_SECDB_TYPE_X509_CERT) sigsz = secdb_entry_size_from_type(algorithm); debug("allocating new secdb entry alg %d", algorithm); @@ -108,7 +108,7 @@ find_or_alloc_secdb_entry(efi_secdb_t *top, efi_secdb_t *secdb = NULL; size_t sigsz = datasz; - if (algorithm != X509_CERT) + if (algorithm != EFI_SECDB_TYPE_X509_CERT) sigsz = secdb_entry_size_from_type(algorithm); secdb = find_secdb_entry(top, algorithm, datasz); @@ -140,7 +140,7 @@ efi_secdb_del_entry(efi_secdb_t *top, size_t sigsz = datasz; bool has_owner = false; - if (algorithm != X509_CERT) + if (algorithm != EFI_SECDB_TYPE_X509_CERT) sigsz = secdb_entry_size_from_type(algorithm); if (secdb_entry_has_owner_from_type(algorithm, &has_owner) < 0) @@ -200,7 +200,7 @@ secdb_add_entry_data(efi_secdb_t *secdb, debug("nsigs:%zd -> %zd", secdb->nsigs, secdb->nsigs+1); secdb->nsigs += 1; if (secdb->nsigs == 1 && - secdb->algorithm == X509_CERT && + secdb->algorithm == EFI_SECDB_TYPE_X509_CERT && secdb->sigsz == sizeof(efi_guid_t)) { debug("secdb->sigsz:%"PRIu32"(0x%"PRIx32") -> %"PRIu32"(0x%"PRIx32") datasz:%"PRIu32"(0x%"PRIx32")", secdb->sigsz, secdb->sigsz, secdb->sigsz + datasz, @@ -483,7 +483,7 @@ secdb_realize_visitor(unsigned int listnum, buf = realloc(state->buf, allocsz); if (!buf) { efi_error("could not allocate %zd bytes", allocsz); - return ERROR; + return EFI_SECDB_VISITOR_ERROR; } esl = (efi_signature_list_t *)(buf + state->pos); state->buf = buf; @@ -505,7 +505,7 @@ secdb_realize_visitor(unsigned int listnum, skew = buf - state->buf; if (!buf) { efi_error("could not allocate %zd bytes", allocsz); - return ERROR; + return EFI_SECDB_VISITOR_ERROR; } memset(buf + state->pos, 0, allocsz - state->pos); esl = (efi_signature_list_t *)((char *)state->esl + skew); @@ -522,7 +522,7 @@ secdb_realize_visitor(unsigned int listnum, state->pos += esdsz; state->listnum = listnum; - return CONTINUE; + return EFI_SECDB_VISITOR_CONTINUE; } /* @@ -538,7 +538,7 @@ efi_secdb_realize(efi_secdb_t *secdb, void **out, size_t *outsize) state.esl = (efi_signature_list_t *)state.buf; if (!state.buf) { efi_error("could not allocate %zd bytes", page_size); - return ERROR; + return EFI_SECDB_VISITOR_ERROR; } efi_secdb_visit_entries(secdb, secdb_realize_visitor, &state); @@ -611,7 +611,7 @@ secdb_visit_entries(efi_secdb_t *secdb, int i, rc = secdb_entry_has_owner_from_type(secdb->algorithm, &has_owner); if (rc < 0) { efi_error("could not determine signature type"); - return ERROR; + return EFI_SECDB_VISITOR_ERROR; } datasz = secdb->sigsz - (has_owner ? sizeof(efi_guid_t) : 0); @@ -627,12 +627,12 @@ secdb_visit_entries(efi_secdb_t *secdb, int i, &entry->data, &entry->data+datasz, datasz); status = visitor(i, j++, &entry->owner, secdb->algorithm, NULL, 0, &entry->data, datasz, closure); - if (status == ERROR) - return ERROR; - if (status == BREAK) - return BREAK; + if (status == EFI_SECDB_VISITOR_ERROR) + return EFI_SECDB_VISITOR_ERROR; + if (status == EFI_SECDB_VISITOR_BREAK) + return EFI_SECDB_VISITOR_BREAK; } - return CONTINUE; + return EFI_SECDB_VISITOR_CONTINUE; } PUBLIC int @@ -640,7 +640,7 @@ efi_secdb_visit_entries(efi_secdb_t *top, efi_secdb_visitor_t *visitor, void *closure) { - efi_secdb_visitor_status_t status = CONTINUE; + efi_secdb_visitor_status_t status = EFI_SECDB_VISITOR_CONTINUE; list_t *pos = NULL, *tmp = NULL; int i = 0; @@ -652,9 +652,9 @@ efi_secdb_visit_entries(efi_secdb_t *top, debug("secdb[%d]:%p nsigs:%zu sigsz:%d", i, secdb, secdb->nsigs, secdb->sigsz); status = secdb_visit_entries(secdb, i++, visitor, closure); - if (status == ERROR) + if (status == EFI_SECDB_VISITOR_ERROR) return -1; - if (status == BREAK) + if (status == EFI_SECDB_VISITOR_BREAK) break; } return 0; @@ -721,12 +721,12 @@ secdb_cmp(const void *ap, const void *bp, void * state UNUSED) a = *(efi_secdb_t **)ap; b = *(efi_secdb_t **)bp; - if (a->algorithm == MAX_SECDB_TYPE) { + if (a->algorithm == EFI_SECDB_TYPE_MAX) { debug("sorting unready data from secdb:%p", a); return -1; } - if (b->algorithm == MAX_SECDB_TYPE) { + if (b->algorithm == EFI_SECDB_TYPE_MAX) { debug("sorting unready data from secdb:%p", b); return 1; } @@ -748,85 +748,85 @@ secdb_cmp_descending(const void *ap, const void *bp, void * state) return secdb_cmp(bp, ap, state); } -const secdb_alg_t PUBLIC efi_secdb_algs_[MAX_SECDB_TYPE] = { - [SHA1] = { +const secdb_alg_t PUBLIC efi_secdb_algs_[EFI_SECDB_TYPE_MAX] = { + [EFI_SECDB_TYPE_SHA1] = { .class = HASH, .guid = &efi_guid_sha1, .header_size = 0, .has_owner = true, .size = 20, }, - [SHA224] = { + [EFI_SECDB_TYPE_SHA224] = { .class = HASH, .guid = &efi_guid_sha224, .header_size = 0, .has_owner = true, .size = 28, }, - [SHA256] = { + [EFI_SECDB_TYPE_SHA256] = { .class = HASH, .guid = &efi_guid_sha256, .header_size = 0, .has_owner = true, .size = 32, }, - [SHA384] = { + [EFI_SECDB_TYPE_SHA384] = { .class = HASH, .guid = &efi_guid_sha384, .header_size = 0, .has_owner = true, .size = 48, }, - [SHA512] = { + [EFI_SECDB_TYPE_SHA512] = { .class = HASH, .guid = &efi_guid_sha512, .header_size = 0, .has_owner = true, .size = 64, }, - [RSA2048] = { + [EFI_SECDB_TYPE_RSA2048] = { .class = SIGNATURE, .guid = &efi_guid_rsa2048, .header_size = 0, .has_owner = true, .size = 256, }, - [RSA2048_SHA1] = { + [EFI_SECDB_TYPE_RSA2048_SHA1] = { .class = SIGNATURE, .guid = &efi_guid_rsa2048_sha1, .header_size = 0, .has_owner = true, .size = 256, }, - [RSA2048_SHA256] = { + [EFI_SECDB_TYPE_RSA2048_SHA256] = { .class = SIGNATURE, .guid = &efi_guid_rsa2048_sha256, .header_size = 0, .has_owner = true, .size = 256, }, - [X509_SHA256] = { + [EFI_SECDB_TYPE_X509_SHA256] = { .class = CERTIFICATE_HASH, .guid = &efi_guid_x509_sha256, .header_size = 0, .has_owner = true, .size = 256, }, - [X509_SHA384] = { + [EFI_SECDB_TYPE_X509_SHA384] = { .class = CERTIFICATE_HASH, .guid = &efi_guid_x509_sha384, .header_size = 0, .has_owner = true, .size = 384, }, - [X509_SHA512] = { + [EFI_SECDB_TYPE_X509_SHA512] = { .class = CERTIFICATE_HASH, .guid = &efi_guid_x509_sha512, .header_size = 0, .has_owner = true, .size = 512, }, - [X509_CERT] = { + [EFI_SECDB_TYPE_X509_CERT] = { .class = CERTIFICATE, .guid = &efi_guid_x509_cert, .header_size = 0, diff --git a/src/secdb.h b/src/secdb.h index c4c94ca9..43bb837e 100644 --- a/src/secdb.h +++ b/src/secdb.h @@ -58,7 +58,7 @@ struct efi_secdb { #define for_each_secdb_entry(pos, head) list_for_each(pos, head) #define for_each_secdb_entry_safe(pos, n, head) list_for_each_safe(pos, n, head) -extern const secdb_alg_t PUBLIC efi_secdb_algs_[MAX_SECDB_TYPE]; +extern const secdb_alg_t PUBLIC efi_secdb_algs_[EFI_SECDB_TYPE_MAX]; /********************************************************* * some helpers to look up sizes for each algorithm type * @@ -70,7 +70,7 @@ extern const secdb_alg_t PUBLIC efi_secdb_algs_[MAX_SECDB_TYPE]; static inline int secdb_entry_has_owner_from_guid(efi_guid_t *alg_guid, bool *answer) { - for (efi_secdb_type_t i = 0; i < MAX_SECDB_TYPE; i++) { + for (efi_secdb_type_t i = 0; i < EFI_SECDB_TYPE_MAX; i++) { if (!memcmp(alg_guid, efi_secdb_algs_[i].guid, sizeof(*alg_guid))) { *answer = efi_secdb_algs_[i].has_owner; return 0; @@ -86,7 +86,7 @@ secdb_entry_has_owner_from_guid(efi_guid_t *alg_guid, bool *answer) static inline int secdb_entry_has_owner_from_type(efi_secdb_type_t secdb_type, bool *answer) { - if (secdb_type < 0 || secdb_type >= MAX_SECDB_TYPE) { + if (secdb_type < 0 || secdb_type >= EFI_SECDB_TYPE_MAX) { errno = EINVAL; return -1; } @@ -100,7 +100,7 @@ secdb_entry_has_owner_from_type(efi_secdb_type_t secdb_type, bool *answer) static inline efi_secdb_type_t secdb_entry_type_from_guid(const efi_guid_t * const guid) { - for (efi_secdb_type_t i = 0; i < MAX_SECDB_TYPE; i++) { + for (efi_secdb_type_t i = 0; i < EFI_SECDB_TYPE_MAX; i++) { if (!memcmp(guid, efi_secdb_algs_[i].guid, sizeof(*guid))) return i; } @@ -113,7 +113,7 @@ secdb_entry_type_from_guid(const efi_guid_t * const guid) static inline efi_guid_t const * secdb_guid_from_type(const efi_secdb_type_t secdb_type) { - if (secdb_type < 0 || secdb_type >= MAX_SECDB_TYPE) { + if (secdb_type < 0 || secdb_type >= EFI_SECDB_TYPE_MAX) { errno = EINVAL; return NULL; } @@ -143,7 +143,7 @@ secdb_entry_size_from_guid(const efi_guid_t * const alg_guid) static inline size_t secdb_entry_size_from_type(const efi_secdb_type_t secdb_type) { - if (secdb_type < 0 || secdb_type >= MAX_SECDB_TYPE) { + if (secdb_type < 0 || secdb_type >= EFI_SECDB_TYPE_MAX) { errno = EINVAL; return -1; } @@ -158,7 +158,7 @@ secdb_entry_size_from_type(const efi_secdb_type_t secdb_type) static inline int32_t secdb_header_size_from_type(const efi_secdb_type_t secdb_type) { - if (secdb_type < 0 || secdb_type >= MAX_SECDB_TYPE) { + if (secdb_type < 0 || secdb_type >= EFI_SECDB_TYPE_MAX) { errno = EINVAL; return -1; } From eeae06f41db79a34103f99d819ad0f31b24fb2cc Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 21 Jan 2026 10:57:42 -0500 Subject: [PATCH 10/17] libefisec: export efi_secdb_visit_entries I don't think there was ever a reason not to export efi_secdb_visit_entries, and I need it exported, so here it is exported. Signed-off-by: Peter Jones --- src/libefisec.abixml | 35 +++++++++++++++++++++++++++++++++++ src/libefisec.map.in | 5 +++++ 2 files changed, 40 insertions(+) diff --git a/src/libefisec.abixml b/src/libefisec.abixml index da2dc36a..d7a91e9e 100644 --- a/src/libefisec.abixml +++ b/src/libefisec.abixml @@ -11,6 +11,7 @@ + @@ -157,6 +158,12 @@ + + + + + + @@ -368,6 +375,8 @@ + + @@ -456,8 +465,15 @@ + + + + + + + @@ -492,6 +508,7 @@ + @@ -546,6 +563,12 @@ + + + + + + @@ -574,6 +597,18 @@ + + + + + + + + + + + + diff --git a/src/libefisec.map.in b/src/libefisec.map.in index 163e221b..7350471c 100644 --- a/src/libefisec.map.in +++ b/src/libefisec.map.in @@ -13,3 +13,8 @@ LIBEFISEC_1.38 { efi_secdb_realize; efi_secdb_set_bool; } libefisec.so.0; + +LIBEFISEC_1.39 { + global: efi_secdb_visit_entries; + +} LIBEFISEC_1.38; From d1f3760a8695726fcd072fe899c15f80780aa8e6 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Tue, 20 Jan 2026 16:37:35 -0500 Subject: [PATCH 11/17] libefisec: fix some include paths In the /private/ headers, we need to be sure to always use quote includes so that we always get headers from the development tree, not the installed efivar-devel package or similar. Signed-off-by: Peter Jones --- src/efiboot.h | 4 ++-- src/efisec.h | 2 +- src/efivar.h | 2 +- src/secdb.c | 2 +- src/secdb.h | 4 ++-- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/efiboot.h b/src/efiboot.h index bf68d300..3a386893 100644 --- a/src/efiboot.h +++ b/src/efiboot.h @@ -5,7 +5,7 @@ */ #pragma once -#include "efivar.h" -#include +#include "efivar.h" // IWYU pragma: export +#include "efivar/efiboot.h" // IWYU pragma: export // vim:fenc=utf-8:tw=75:noet diff --git a/src/efisec.h b/src/efisec.h index 4bc8bc12..ad8ed296 100644 --- a/src/efisec.h +++ b/src/efisec.h @@ -7,7 +7,7 @@ #include "fix_coverity.h" -#include +#include "efivar/efisec.h" #include #include #include diff --git a/src/efivar.h b/src/efivar.h index 0304b32a..141b573b 100644 --- a/src/efivar.h +++ b/src/efivar.h @@ -9,7 +9,7 @@ #include "fix_coverity.h" -#include +#include "efivar/efivar.h" #include "compiler.h" #include "diag.h" diff --git a/src/secdb.c b/src/secdb.c index 4cf39a07..254014b6 100644 --- a/src/secdb.c +++ b/src/secdb.c @@ -5,7 +5,7 @@ * Copyright Red Hat, Inc. */ -#include "efisec.h" +#include "efisec.h" // IWYU pragma: keep #include "efivar/efisec-secdb.h" /* diff --git a/src/secdb.h b/src/secdb.h index 43bb837e..8c92ee34 100644 --- a/src/secdb.h +++ b/src/secdb.h @@ -6,8 +6,8 @@ */ #pragma once -#include "efisec.h" -#include +#include "efisec.h" // IWYU pragma: export +#include "efivar/efisec.h" // IWYU pragma: export typedef enum { BAD, From f8e8743243703e05f79cb876ce039716c628471b Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Wed, 21 Jan 2026 10:57:25 -0500 Subject: [PATCH 12/17] libefisec: Some more header cleanup This changes the private efisec.h in a couple of ways: - tells clangd we're exporting all the headers we import, so its useless "complain about your headers" feature stops complaining. - includes the exported headers directly, so they'll never get included via some other path. Signed-off-by: Peter Jones --- src/efisec.h | 40 ++++++++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 16 deletions(-) diff --git a/src/efisec.h b/src/efisec.h index ad8ed296..7baa0eb3 100644 --- a/src/efisec.h +++ b/src/efisec.h @@ -5,23 +5,31 @@ */ #pragma once -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: export -#include "efivar/efisec.h" -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include +#include // IWYU pragma: export +#include // IWYU pragma: export +#include // IWYU pragma: export +#include // IWYU pragma: export +#include // IWYU pragma: export +#include // IWYU pragma: export +#include // IWYU pragma: export +#include // IWYU pragma: export +#include // IWYU pragma: export +#include // IWYU pragma: export +#include // IWYU pragma: export -#include "efivar.h" -#include "esl-iter.h" -#include "secdb.h" -#include "x509.h" +#include "efivar/efivar-types.h" // IWYU pragma: export +#include "efivar/efivar-guids.h" // IWYU pragma: export +#include "efivar/efivar.h" // IWYU pragma: export + +#include "efivar/efisec-types.h" // IWYU pragma: export +#include "efivar/efisec-secdb.h" // IWYU pragma: export +#include "efivar/efisec.h" // IWYU pragma: export + +#include "efivar.h" // IWYU pragma: export +#include "esl-iter.h" // IWYU pragma: export +#include "secdb.h" // IWYU pragma: export +#include "x509.h" // IWYU pragma: export // vim:fenc=utf-8:tw=75:noet From 2229200491cb0e478d05260526cc665c75a82938 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 2 Mar 2026 10:51:52 -0500 Subject: [PATCH 13/17] efisecdb: fix a typo in --help Signed-off-by: Peter Jones --- src/efisecdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/efisecdb.c b/src/efisecdb.c index 34aee322..77f904c0 100644 --- a/src/efisecdb.c +++ b/src/efisecdb.c @@ -145,7 +145,7 @@ usage(int status) " -a, --add following hashes or certs are to be added (default)\n" " -r, --remove following hashes or certs are to be removed\n" " -g, --owner-guid= following added entries use GUID as the owner\n" - " -h, --hash= hash value to add (\n" + " -h, --hash= hash value to add\n" " -t, --type= hash type to add (\"help\" lists options)\n" " -c, --certificate= certificate file to add\n" " -L, --list-guids list well known guids\n", From 18deeb5273f059fcc97f9218d0c66e95ea9a4a72 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 2 Mar 2026 10:54:41 -0500 Subject: [PATCH 14/17] efisecdb: add sha384 support This code initially supported sha256 and sha512, but not sha384. That's wrong, so this adds sha384. Signed-off-by: Peter Jones --- src/efisecdb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/efisecdb.c b/src/efisecdb.c index 77f904c0..62b855c9 100644 --- a/src/efisecdb.c +++ b/src/efisecdb.c @@ -42,6 +42,11 @@ static struct hash_param hash_params[] = { .size = 64, .def = false, }, + {.name = "sha384", + .algorithm = EFI_SECDB_TYPE_SHA384, + .size = 48, + .def = false, + }, {.name = "sha256", .algorithm = EFI_SECDB_TYPE_SHA256, .size = 32, From 0c7006d6a723e55d203735984a976d1b7f70c9ab Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Fri, 13 Mar 2026 11:19:11 -0400 Subject: [PATCH 15/17] cleanup: make clangd stop complaining about fix_coverity.h fix_coverity.h is a workaround for coverity's insane choices about how to make their fork of clang that claims to be gcc believe in gcc's datatypes. In most cases it does nothing, and as such clangd cannot prove that it does anything, and complains about it. This suppresses those complaints. Signed-off-by: Peter Jones --- src/creator.c | 2 +- src/disk.c | 2 +- src/dp-acpi.c | 2 +- src/dp-hw.c | 2 +- src/dp-media.c | 2 +- src/dp-message.c | 2 +- src/dp.c | 2 +- src/efisec.h | 2 +- src/efisecdb.c | 2 +- src/efivar.c | 2 +- src/efivar.h | 2 +- src/efivarfs.c | 2 +- src/error.c | 2 +- src/export.c | 2 +- src/gpt.c | 2 +- src/guid.c | 2 +- src/lib.c | 2 +- src/linux-acpi-root.c | 2 +- src/linux-acpi.c | 2 +- src/linux-ata.c | 2 +- src/linux-emmc.c | 2 +- src/linux-i2o.c | 2 +- src/linux-md.c | 2 +- src/linux-nvme.c | 2 +- src/linux-pci-root.c | 2 +- src/linux-pci.c | 2 +- src/linux-pmem.c | 2 +- src/linux-sas.c | 2 +- src/linux-sata.c | 2 +- src/linux-scsi.c | 2 +- src/linux-soc-root.c | 2 +- src/linux-virtblk.c | 2 +- src/linux-virtual-root.c | 2 +- src/linux.c | 2 +- src/loadopt.c | 2 +- src/makeguids.c | 2 +- src/path-helpers.c | 2 +- src/thread-test.c | 2 +- src/vars.c | 2 +- 39 files changed, 39 insertions(+), 39 deletions(-) diff --git a/src/creator.c b/src/creator.c index f780a80b..b255cca3 100644 --- a/src/creator.c +++ b/src/creator.c @@ -4,7 +4,7 @@ * Copyright 2012-2015 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/disk.c b/src/disk.c index 1b3bca9e..383bf366 100644 --- a/src/disk.c +++ b/src/disk.c @@ -5,7 +5,7 @@ * Copyright (C) 2000-2001 Dell Computer Corporation */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/dp-acpi.c b/src/dp-acpi.c index ff79fd4a..84c1813a 100644 --- a/src/dp-acpi.c +++ b/src/dp-acpi.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/dp-hw.c b/src/dp-hw.c index e94cf7bc..9e286d38 100644 --- a/src/dp-hw.c +++ b/src/dp-hw.c @@ -4,7 +4,7 @@ * Copyright 2012-2015 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/dp-media.c b/src/dp-media.c index f8b1c490..7a1bdf01 100644 --- a/src/dp-media.c +++ b/src/dp-media.c @@ -4,7 +4,7 @@ * Copyright 2012-2015 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/dp-message.c b/src/dp-message.c index 464fe0f9..6c83ea79 100644 --- a/src/dp-message.c +++ b/src/dp-message.c @@ -4,7 +4,7 @@ * Copyright 2012-2015 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/dp.c b/src/dp.c index e005fcad..5d933665 100644 --- a/src/dp.c +++ b/src/dp.c @@ -4,7 +4,7 @@ * Copyright 2012-2015 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/efisec.h b/src/efisec.h index 7baa0eb3..438c197f 100644 --- a/src/efisec.h +++ b/src/efisec.h @@ -5,7 +5,7 @@ */ #pragma once -#include "fix_coverity.h" // IWYU pragma: export +#include "fix_coverity.h" // IWYU pragma: keep #include // IWYU pragma: export #include // IWYU pragma: export diff --git a/src/efisecdb.c b/src/efisecdb.c index 62b855c9..23a48cb3 100644 --- a/src/efisecdb.c +++ b/src/efisecdb.c @@ -4,7 +4,7 @@ * Copyright Peter Jones * Copyright Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include "linux.h" #include diff --git a/src/efivar.c b/src/efivar.c index 1f9d6139..a6b28c71 100644 --- a/src/efivar.c +++ b/src/efivar.c @@ -4,7 +4,7 @@ * Copyright 2012 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/efivar.h b/src/efivar.h index 141b573b..720c8aa3 100644 --- a/src/efivar.h +++ b/src/efivar.h @@ -7,7 +7,7 @@ #pragma GCC diagnostic warning "-Wcpp" -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include "efivar/efivar.h" diff --git a/src/efivarfs.c b/src/efivarfs.c index 2dea2525..8c9cd094 100644 --- a/src/efivarfs.c +++ b/src/efivarfs.c @@ -4,7 +4,7 @@ * Copyright 2012-2013 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/error.c b/src/error.c index 9530e22c..e1d0bc4d 100644 --- a/src/error.c +++ b/src/error.c @@ -5,7 +5,7 @@ * Copyright (C) 2000-2001 Dell Computer Corporation */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/export.c b/src/export.c index bdbe7d79..ae129ead 100644 --- a/src/export.c +++ b/src/export.c @@ -4,7 +4,7 @@ * Copyright 2012-2013 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/gpt.c b/src/gpt.c index 3dd25e7f..a1ac23a8 100644 --- a/src/gpt.c +++ b/src/gpt.c @@ -8,7 +8,7 @@ * http://developer.intel.com/technology/efi/efi.htm */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/guid.c b/src/guid.c index 1f4a6605..8b72b6e6 100644 --- a/src/guid.c +++ b/src/guid.c @@ -4,7 +4,7 @@ * Copyright 2012-2014 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/lib.c b/src/lib.c index c17a54d3..3b89ea27 100644 --- a/src/lib.c +++ b/src/lib.c @@ -4,7 +4,7 @@ * Copyright 2012-2013 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-acpi-root.c b/src/linux-acpi-root.c index a45f0c9d..aaf516d7 100644 --- a/src/linux-acpi-root.c +++ b/src/linux-acpi-root.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-acpi.c b/src/linux-acpi.c index e4adb8a1..7921e9a9 100644 --- a/src/linux-acpi.c +++ b/src/linux-acpi.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-ata.c b/src/linux-ata.c index d8c98060..ffe7a06f 100644 --- a/src/linux-ata.c +++ b/src/linux-ata.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-emmc.c b/src/linux-emmc.c index 65557b48..205a4942 100644 --- a/src/linux-emmc.c +++ b/src/linux-emmc.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-i2o.c b/src/linux-i2o.c index 2cd1b48a..89a32467 100644 --- a/src/linux-i2o.c +++ b/src/linux-i2o.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-md.c b/src/linux-md.c index c2912f17..20e01fa5 100644 --- a/src/linux-md.c +++ b/src/linux-md.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-nvme.c b/src/linux-nvme.c index aaefaa9a..b64e9ec1 100644 --- a/src/linux-nvme.c +++ b/src/linux-nvme.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-pci-root.c b/src/linux-pci-root.c index 5de27a26..bdf75c1b 100644 --- a/src/linux-pci-root.c +++ b/src/linux-pci-root.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-pci.c b/src/linux-pci.c index fc18f3c4..89d664c6 100644 --- a/src/linux-pci.c +++ b/src/linux-pci.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-pmem.c b/src/linux-pmem.c index af42ca53..aed1b7f0 100644 --- a/src/linux-pmem.c +++ b/src/linux-pmem.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-sas.c b/src/linux-sas.c index 345cdd37..927bb5ac 100644 --- a/src/linux-sas.c +++ b/src/linux-sas.c @@ -4,7 +4,7 @@ * Copyright 2012-2018 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-sata.c b/src/linux-sata.c index 49e935d6..04b56e5f 100644 --- a/src/linux-sata.c +++ b/src/linux-sata.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-scsi.c b/src/linux-scsi.c index c5813a2e..f20f1bd6 100644 --- a/src/linux-scsi.c +++ b/src/linux-scsi.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-soc-root.c b/src/linux-soc-root.c index 044b628f..84ec137e 100644 --- a/src/linux-soc-root.c +++ b/src/linux-soc-root.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-virtblk.c b/src/linux-virtblk.c index 34ad45e8..7274071d 100644 --- a/src/linux-virtblk.c +++ b/src/linux-virtblk.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux-virtual-root.c b/src/linux-virtual-root.c index 142e2df5..cccf67ec 100644 --- a/src/linux-virtual-root.c +++ b/src/linux-virtual-root.c @@ -4,7 +4,7 @@ * Copyright 2012-2019 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/linux.c b/src/linux.c index d20fcf07..e48c1a1e 100644 --- a/src/linux.c +++ b/src/linux.c @@ -5,7 +5,7 @@ * Copyright (C) 2001 Dell Computer Corporation */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/loadopt.c b/src/loadopt.c index af4c4d54..4172ec4e 100644 --- a/src/loadopt.c +++ b/src/loadopt.c @@ -5,7 +5,7 @@ * Copyright (C) 2001 Dell Computer Corporation */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include diff --git a/src/makeguids.c b/src/makeguids.c index bfdee12e..703eb00a 100644 --- a/src/makeguids.c +++ b/src/makeguids.c @@ -4,7 +4,7 @@ * Copyright 2012-2013 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/path-helpers.c b/src/path-helpers.c index 5675809a..d757cf8b 100644 --- a/src/path-helpers.c +++ b/src/path-helpers.c @@ -3,7 +3,7 @@ * path-helper.c * Copyright 2018 Peter Jones */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include "efivar.h" diff --git a/src/thread-test.c b/src/thread-test.c index efe82806..de84fb25 100644 --- a/src/thread-test.c +++ b/src/thread-test.c @@ -4,7 +4,7 @@ * Copyright Jonathan Marler */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include diff --git a/src/vars.c b/src/vars.c index 1cd23d27..956f9d93 100644 --- a/src/vars.c +++ b/src/vars.c @@ -4,7 +4,7 @@ * Copyright 2012-2013 Red Hat, Inc. */ -#include "fix_coverity.h" +#include "fix_coverity.h" // IWYU pragma: keep #include #include From 3a9e6640c114e9edad7048f113000ed4098e500c Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Fri, 13 Mar 2026 11:21:04 -0400 Subject: [PATCH 16/17] efisecdb: fix stray extra include I don't know why efisecdb.c has a linux.h include, but it doesn't need it or use it for anything. I think someone's editor got a little too empowered and dropped it there, because it's not where I'd choose to put that include if it /were/ justified, either. This takes it out. Signed-off-by: Peter Jones --- src/efisecdb.c | 1 - 1 file changed, 1 deletion(-) diff --git a/src/efisecdb.c b/src/efisecdb.c index 23a48cb3..40484da7 100644 --- a/src/efisecdb.c +++ b/src/efisecdb.c @@ -6,7 +6,6 @@ */ #include "fix_coverity.h" // IWYU pragma: keep -#include "linux.h" #include #include #include From eb064a95112160007db60b3ba314fa2ff0bdf479 Mon Sep 17 00:00:00 2001 From: Peter Jones Date: Mon, 9 Mar 2026 10:14:11 -0400 Subject: [PATCH 17/17] efisecdb: annotate hashes and certs better This changes the annotated output for certs from: 0000002c 30 82 05 a4 |0...| esl[0].signature[0].data (end:0x000005d4) 00000030 30 82 03 8c a0 03 02 01 02 02 13 33 00 00 00 16 |0..........3....| 00000040 36 bf 36 89 9f 15 75 cc 00 00 00 00 00 16 30 0d |6.6...u.......0.| 00000050 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 5a 31 |..*.H........0Z1| to: 0000002c esl[0].signature[0].data (end:0x000005d4) 0000002c 30 82 05 a4 |0...| /C=US/O=Microsoft Corporation/CN=Microsoft UEFI CA 2023 00000030 30 82 03 8c a0 03 02 01 02 02 13 33 00 00 00 16 |0..........3....| 00000040 36 bf 36 89 9f 15 75 cc 00 00 00 00 00 16 30 0d |6.6...u.......0.| 00000050 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 5a 31 |..*.H........0Z1| and for simple digests from: 0000002c 80 b4 d9 69 |...i| esl[0].signature[0].data (end:0x0000004c) 00000030 31 bf 0d 02 fd 91 a6 1e 19 d1 4f 1d a4 52 e6 6d |1.........O..R.m| 00000040 b2 40 8c a8 60 4d 41 1f 92 65 9f 0a |.@..`MA..e..| to: 0000002c esl[0].signature[0].data (end:0x0000004c) 0000002c 80 b4 d9 69 |...i| SHA256:80b4d96931bf0d02fd91a61e19d14f1da452e66db2408ca8604d411f92659f0a 00000030 31 bf 0d 02 fd 91 a6 1e 19 d1 4f 1d a4 52 e6 6d |1.........O..R.m| 00000040 b2 40 8c a8 60 4d 41 1f 92 65 9f 0a |.@..`MA..e..| Signed-off-by: Peter Jones --- src/Makefile | 4 +- src/secdb-dump.c | 114 +++++++++++++++++++++++-- tests/test.esl.annotation.esl.goal.txt | 12 ++- tests/test.parse.db.var.goal.txt | 33 ++++--- 4 files changed, 141 insertions(+), 22 deletions(-) diff --git a/src/Makefile b/src/Makefile index 84c8ea84..3ec7f18e 100644 --- a/src/Makefile +++ b/src/Makefile @@ -119,12 +119,12 @@ libefisec.so : | libefisec.map libefisec.so : private MAP=libefisec.map efisecdb : $(EFISECDB_OBJECTS) | libefisec.so -efisecdb : private LIBS=efivar efisec dl +efisecdb : private LIBS=crypto efivar efisec dl efisecdb-static : $(EFISECDB_OBJECTS) efisecdb-static : $(patsubst %.o,%.static.o,$(LIBEFISEC_OBJECTS) $(LIBEFIVAR_OBJECTS)) efisecdb-static : | $(GENERATED_SOURCES) -efisecdb-static : private LIBS=dl +efisecdb-static : private LIBS=crypto dl thread-test : libefivar.so # make sure we don't propagate CFLAGS to object files used by 'libefivar.so' diff --git a/src/secdb-dump.c b/src/secdb-dump.c index 33044e6a..1a3b3da6 100644 --- a/src/secdb-dump.c +++ b/src/secdb-dump.c @@ -7,6 +7,8 @@ #include "efisec.h" #include "hexdump.h" +#include + #undef DEBUG_LEVEL #define DEBUG_LEVEL LOG_DEBUG_DUMPER @@ -175,11 +177,85 @@ secdb_dump_esl(efi_secdb_t *secdb, int esl, ssize_t offset) return offset; } +static int +fmt_digest(char *buf, size_t bufsz, efi_secdb_type_t algorithm, + uint8_t *data, size_t datasz) +{ + int pos = 0; + int rc; + + const char * const alg_names[EFI_SECDB_TYPE_MAX] = { + [EFI_SECDB_TYPE_SHA1] = "SHA1", + [EFI_SECDB_TYPE_SHA224] = "SHA224", + [EFI_SECDB_TYPE_SHA256] = "SHA256", + [EFI_SECDB_TYPE_SHA384] = "SHA384", + [EFI_SECDB_TYPE_SHA512] = "SHA512", + }; + + if (algorithm < 0 || algorithm > EFI_SECDB_TYPE_SHA512) { + errno = EINVAL; + return -1; + } + + if (datasz != efi_secdb_algs_[algorithm].size) { + errno = EINVAL; + return -1; + } + + datasz = MIN(efi_secdb_algs_[algorithm].size, datasz); + if (bufsz == 0) { + return strlen(alg_names[algorithm]) // string + + 1 // colon + + datasz * 2 // hex + + 1; // NUL + } + rc = snprintf(&buf[pos], bufsz-pos, "%s:", alg_names[algorithm]); + if (rc < 0) + return rc; + pos += rc; + for (size_t i = 0; i < datasz && (i * 2 + 1) < bufsz; i++) { + rc = snprintf(&buf[pos], bufsz-pos, "%02x", data[i]); + if (rc < 0) + return rc; + pos += rc; + } + + return pos; +} + +static int +fmt_x509_cert(char *buf, size_t bufsz, uint8_t *data, size_t datasz) +{ + X509 *cert = NULL; + X509_NAME *subject = NULL; + + cert = d2i_X509(NULL, (const unsigned char **)&data, datasz); + if (!cert) + return 0; + + subject = X509_get_subject_name(cert); + if (!subject) + goto err; + + X509_NAME_oneline(subject, buf, bufsz); + buf[bufsz-1] = '\0'; + X509_free(cert); + return strlen(buf) + 1; +err: + if (cert) { + X509_free(cert); + cert = NULL; + } + return 0; +} + static inline ssize_t -secdb_dump_esd(secdb_entry_t *entry, int esl, int esd, size_t data_size, - ssize_t offset) +secdb_dump_esd(secdb_entry_t *entry, efi_secdb_type_t algorithm, int esl, + int esd, size_t data_size, ssize_t offset) { char *id_guid = NULL; + char buf[1024] = ""; + int rc = 0; efi_guid_to_id_guid(&entry->owner, &id_guid); offset = secdb_dump_value((char *)&entry->owner, @@ -189,9 +265,36 @@ secdb_dump_esd(secdb_entry_t *entry, int esl, int esd, size_t data_size, xfree(id_guid); if (offset < 0) return offset; - offset = secdb_dump_value((char *)&entry->data, data_size, offset, - "esl[%d].signature[%d].data (end:0x%08zx)", + + debug("formatting algorithm %d", algorithm); + switch(algorithm) { + case EFI_SECDB_TYPE_SHA1: + case EFI_SECDB_TYPE_SHA224: + case EFI_SECDB_TYPE_SHA256: + case EFI_SECDB_TYPE_SHA384: + case EFI_SECDB_TYPE_SHA512: + rc = fmt_digest(buf, sizeof(buf), algorithm, + entry->data.raw, data_size); + + break; + case EFI_SECDB_TYPE_X509_CERT: + rc = fmt_x509_cert(buf, sizeof(buf), + entry->data.raw, data_size); + break; + default: + break; + }; + if (rc > 0) { + secdb_dump_value((char *)&entry->data, 0, offset, + "esl[%d].signature[%d].data (end:0x%08zx)", esl, esd, offset+data_size); + offset = secdb_dump_value((char *)&entry->data, data_size, + offset, "%s", buf); + } else { + offset = secdb_dump_value((char *)&entry->data, data_size, + offset, "esl[%d].signature[%d].data (end:0x%08zx) %s", + esl, esd, offset+data_size); + } return offset; } @@ -238,7 +341,8 @@ secdb_dump(efi_secdb_t *secdb, bool annotations) debug("esl[%d].esd[%d]:%p owner:%p data:%p-%p datasz:%zd", esln, esdn, esd, &esd->owner, &esd->data, &esd->data+datasz, datasz); - offset = secdb_dump_esd(esd, esln, esdn, datasz, offset); + offset = secdb_dump_esd(esd, esl->algorithm, esln, + esdn, datasz, offset); esdn += 1; if (offset < 0) break; diff --git a/tests/test.esl.annotation.esl.goal.txt b/tests/test.esl.annotation.esl.goal.txt index e3f61d08..c6d281dd 100644 --- a/tests/test.esl.annotation.esl.goal.txt +++ b/tests/test.esl.annotation.esl.goal.txt @@ -5,22 +5,26 @@ 0000001c esl[0].signature_header (end:0x0000001c) 0000001c db ed 23 02 |..#.| esl[0].signature[0].owner = {redhat} 00000020 79 90 88 43 af 77 2d 65 b1 c3 5d 3b |y..C.w-e..];| -0000002c 87 42 8f c5 |.B..| esl[0].signature[0].data (end:0x0000004c) +0000002c esl[0].signature[0].data (end:0x0000004c) +0000002c 87 42 8f c5 |.B..| SHA256:87428fc522803d31065e7bce3cf03fe475096631e5e07bbd7a0fde60c4cf25c7 00000030 22 80 3d 31 06 5e 7b ce 3c f0 3f e4 75 09 66 31 |".=1.^{.<.?.u.f1| 00000040 e5 e0 7b bd 7a 0f de 60 c4 cf 25 c7 |..{.z..`..%.| 0000004c db ed 23 02 |..#.| esl[0].signature[1].owner = {redhat} 00000050 79 90 88 43 af 77 2d 65 b1 c3 5d 3b |y..C.w-e..];| -0000005c 02 63 82 99 |.c..| esl[0].signature[1].data (end:0x0000007c) +0000005c esl[0].signature[1].data (end:0x0000007c) +0000005c 02 63 82 99 |.c..| SHA256:0263829989b6fd954f72baaf2fc64bc2e2f01d692d4de72986ea808f6e99813f 00000060 89 b6 fd 95 4f 72 ba af 2f c6 4b c2 e2 f0 1d 69 |....Or../.K....i| 00000070 2d 4d e7 29 86 ea 80 8f 6e 99 81 3f |-M.)....n..?| 0000007c db ed 23 02 |..#.| esl[0].signature[2].owner = {redhat} 00000080 79 90 88 43 af 77 2d 65 b1 c3 5d 3b |y..C.w-e..];| -0000008c 8d 74 be ec |.t..| esl[0].signature[2].data (end:0x000000ac) +0000008c esl[0].signature[2].data (end:0x000000ac) +0000008c 8d 74 be ec |.t..| SHA256:8d74beec1be996322ad76813bafb92d40839895d6dd7ee808b17ca201eac98be 00000090 1b e9 96 32 2a d7 68 13 ba fb 92 d4 08 39 89 5d |...2*.h......9.]| 000000a0 6d d7 ee 80 8b 17 ca 20 1e ac 98 be |m...... ....| 000000ac db ed 23 02 |..#.| esl[0].signature[3].owner = {redhat} 000000b0 79 90 88 43 af 77 2d 65 b1 c3 5d 3b |y..C.w-e..];| -000000bc a3 a5 e7 15 |....| esl[0].signature[3].data (end:0x000000dc) +000000bc esl[0].signature[3].data (end:0x000000dc) +000000bc a3 a5 e7 15 |....| SHA256:a3a5e715f0cc574a73c3f9bebb6bc24f32ffd5b67b387244c2c909da779a1478 000000c0 f0 cc 57 4a 73 c3 f9 be bb 6b c2 4f 32 ff d5 b6 |..WJs....k.O2...| 000000d0 7b 38 72 44 c2 c9 09 da 77 9a 14 78 |{8rD....w..x| 000000dc diff --git a/tests/test.parse.db.var.goal.txt b/tests/test.parse.db.var.goal.txt index 8c1d611f..285b2c83 100644 --- a/tests/test.parse.db.var.goal.txt +++ b/tests/test.parse.db.var.goal.txt @@ -5,7 +5,8 @@ 0000001c esl[0].signature_header (end:0x0000001c) 0000001c bd 9a fa 77 |...w| esl[0].signature[0].owner = {microsoft} 00000020 59 03 32 4d bd 60 28 f4 e7 8f 78 4b |Y.2M.`(...xK| -0000002c 30 82 06 10 |0...| esl[0].signature[0].data (end:0x00000640) +0000002c esl[0].signature[0].data (end:0x00000640) +0000002c 30 82 06 10 |0...| /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Corporation UEFI CA 2011 00000030 30 82 03 f8 a0 03 02 01 02 02 0a 61 08 d3 c4 00 |0..........a....| 00000040 00 00 00 00 04 30 0d 06 09 2a 86 48 86 f7 0d 01 |.....0...*.H....| 00000050 01 0b 05 00 30 81 91 31 0b 30 09 06 03 55 04 06 |....0..1.0...U..| @@ -110,7 +111,8 @@ 0000065c esl[1].signature_header (end:0x0000065c) 0000065c bd 9a fa 77 |...w| esl[1].signature[0].owner = {microsoft} 00000660 59 03 32 4d bd 60 28 f4 e7 8f 78 4b |Y.2M.`(...xK| -0000066c 30 82 05 d7 |0...| esl[1].signature[0].data (end:0x00000c47) +0000066c esl[1].signature[0].data (end:0x00000c47) +0000066c 30 82 05 d7 |0...| /C=US/ST=Washington/L=Redmond/O=Microsoft Corporation/CN=Microsoft Windows Production PCA 2011 00000670 30 82 03 bf a0 03 02 01 02 02 0a 61 07 76 56 00 |0..........a.vV.| 00000680 00 00 00 00 08 30 0d 06 09 2a 86 48 86 f7 0d 01 |.....0...*.H....| 00000690 01 0b 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 |....0..1.0...U..| @@ -214,7 +216,8 @@ 00000c63 esl[2].signature_header (end:0x00000c63) 00000c63 51 48 dc 26 5f 19 e1 4a 9a 19 fb f8 83 |QH.&_..J.....| esl[2].signature[0].owner = {supermicro} 00000c70 bb b3 5e |..^| -00000c73 30 82 04 17 30 82 02 ff a0 03 02 01 02 |0...0........| esl[2].signature[0].data (end:0x0000108e) +00000c73 esl[2].signature[0].data (end:0x0000108e) +00000c73 30 82 04 17 30 82 02 ff a0 03 02 01 02 |0...0........| /CN=Unco\xC3\xB6perative Secure Boot Signer/OU=The Unco\xC3\xB6perative CA/O=The Unco\xC3\xB6perative Organization 00000c80 02 11 00 b9 36 b3 dd 63 21 4c 30 ae 31 b4 2f 0a |....6..c!L0.1./.| 00000c90 48 36 0d 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b |H6.0...*.H......| 00000ca0 05 00 30 72 31 26 30 24 06 03 55 04 03 0c 1d 55 |..0r1&0$..U....U| @@ -289,7 +292,8 @@ 000010aa esl[3].signature_header (end:0x000010aa) 000010aa 91 30 05 3b 9f 6c |.0.;.l| esl[3].signature[0].owner = {asus} 000010b0 cc 04 b1 ac e2 a5 1e 3b e5 f5 |.......;..| -000010ba 30 82 03 52 30 82 |0..R0.| esl[3].signature[0].data (end:0x00001410) +000010ba esl[3].signature[0].data (end:0x00001410) +000010ba 30 82 03 52 30 82 |0..R0.| /CN=ASUSTeK MotherBoard SW Key Certificate 000010c0 02 3a a0 03 02 01 02 02 10 da 83 b9 90 42 2e bc |.:...........B..| 000010d0 8c 44 1f 8d 8b 03 9a 65 a2 30 0d 06 09 2a 86 48 |.D.....e.0...*.H| 000010e0 86 f7 0d 01 01 0b 05 00 30 31 31 2f 30 2d 06 03 |........011/0-..| @@ -350,7 +354,8 @@ 0000142c esl[4].signature_header (end:0x0000142c) 0000142c 91 30 05 3b |.0.;| esl[4].signature[0].owner = {asus} 00001430 9f 6c cc 04 b1 ac e2 a5 1e 3b e5 f5 |.l.......;..| -0000143c 30 82 03 49 |0..I| esl[4].signature[0].data (end:0x00001789) +0000143c esl[4].signature[0].data (end:0x00001789) +0000143c 30 82 03 49 |0..I| /CN=ASUSTeK Notebook SW Key Certificate 00001440 30 82 02 31 a0 03 02 01 02 02 10 b8 e5 81 e4 df |0..1............| 00001450 77 a5 bb 42 82 d5 cc fc 00 c0 71 30 0d 06 09 2a |w..B......q0...*| 00001460 86 48 86 f7 0d 01 01 0b 05 00 30 2e 31 2c 30 2a |.H........0.1,0*| @@ -413,7 +418,8 @@ 000017a5 esl[5].signature_header (end:0x000017a5) 000017a5 e4 0a c4 6d e8 2e 4c 9c a3 14 0f |...m..L....| esl[5].signature[0].owner = {canonical} 000017b0 c7 b2 00 87 10 |.....| -000017b5 30 82 04 34 30 82 03 1c a0 03 02 |0..40......| esl[5].signature[0].data (end:0x00001bed) +000017b5 esl[5].signature[0].data (end:0x00001bed) +000017b5 30 82 04 34 30 82 03 1c a0 03 02 |0..40......| /C=GB/ST=Isle of Man/L=Douglas/O=Canonical Ltd./CN=Canonical Ltd. Master Certificate Authority 000017c0 01 02 02 09 00 b9 41 24 a0 18 2c 92 67 30 0d 06 |......A$..,.g0..| 000017d0 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 81 84 31 |.*.H........0..1| 000017e0 0b 30 09 06 03 55 04 06 13 02 47 42 31 14 30 12 |.0...U....GB1.0.| @@ -490,27 +496,32 @@ 00001c09 esl[6].signature_header (end:0x00001c09) 00001c09 00 00 00 00 00 00 00 |.......| esl[6].signature[0].owner = {zero} 00001c10 00 00 00 00 00 00 00 00 00 |.........| -00001c19 f5 8f bd f7 1b e8 c3 |.......| esl[6].signature[0].data (end:0x00001c39) +00001c19 esl[6].signature[0].data (end:0x00001c39) +00001c19 f5 8f bd f7 1b e8 c3 |.......| SHA256:f58fbdf71be8c37cbbd6944e472c450b1043817b972914487c221033f3079e43 00001c20 7c bb d6 94 4e 47 2c 45 0b 10 43 81 7b 97 29 14 ||...NG,E..C.{.).| 00001c30 48 7c 22 10 33 f3 07 9e 43 |H|".3...C| 00001c39 00 00 00 00 00 00 00 |.......| esl[6].signature[1].owner = {zero} 00001c40 00 00 00 00 00 00 00 00 00 |.........| -00001c49 04 97 01 57 de 52 cd |...W.R.| esl[6].signature[1].data (end:0x00001c69) +00001c49 esl[6].signature[1].data (end:0x00001c69) +00001c49 04 97 01 57 de 52 cd |...W.R.| SHA256:04970157de52cdae14cf17ee369881d6245b3a6ab6352eabaee588a0584b0303 00001c50 ae 14 cf 17 ee 36 98 81 d6 24 5b 3a 6a b6 35 2e |.....6...$[:j.5.| 00001c60 ab ae e5 88 a0 58 4b 03 03 |.....XK..| 00001c69 00 00 00 00 00 00 00 |.......| esl[6].signature[2].owner = {zero} 00001c70 00 00 00 00 00 00 00 00 00 |.........| -00001c79 f1 6b 5f c3 61 18 3f |.k_.a.?| esl[6].signature[2].data (end:0x00001c99) +00001c79 esl[6].signature[2].data (end:0x00001c99) +00001c79 f1 6b 5f c3 61 18 3f |.k_.a.?| SHA256:f16b5fc361183f587120e602c0d65773afdfe786124184fa70805258d76d594c 00001c80 58 71 20 e6 02 c0 d6 57 73 af df e7 86 12 41 84 |Xq ....Ws.....A.| 00001c90 fa 70 80 52 58 d7 6d 59 4c |.p.RX.mYL| 00001c99 00 00 00 00 00 00 00 |.......| esl[6].signature[3].owner = {zero} 00001ca0 00 00 00 00 00 00 00 00 00 |.........| -00001ca9 7e 02 1f 15 e3 a6 7b |~.....{| esl[6].signature[3].data (end:0x00001cc9) +00001ca9 esl[6].signature[3].data (end:0x00001cc9) +00001ca9 7e 02 1f 15 e3 a6 7b |~.....{| SHA256:7e021f15e3a67b75ace884999bedffe34213792a611e40e562e87e6b9a0cb282 00001cb0 75 ac e8 84 99 9b ed ff e3 42 13 79 2a 61 1e 40 |u........B.y*a.@| 00001cc0 e5 62 e8 7e 6b 9a 0c b2 82 |.b.~k....| 00001cc9 00 00 00 00 00 00 00 |.......| esl[6].signature[4].owner = {zero} 00001cd0 00 00 00 00 00 00 00 00 00 |.........| -00001cd9 a5 d1 09 b2 af a3 fa |.......| esl[6].signature[4].data (end:0x00001cf9) +00001cd9 esl[6].signature[4].data (end:0x00001cf9) +00001cd9 a5 d1 09 b2 af a3 fa |.......| SHA256:a5d109b2afa3fa90878f70382b2388fcd2feaeae8a51b80add048e9f876b2a4e 00001ce0 90 87 8f 70 38 2b 23 88 fc d2 fe ae ae 8a 51 b8 |...p8+#.......Q.| 00001cf0 0a dd 04 8e 9f 87 6b 2a 4e |......k*N| 00001cf9