This makes capsule PKCS#7 signatures reproducible.
openssl smime -sign embeds a signingTime signed attribute (current
UTCTime) by default. Because the attribute is inside the signed
digest, the resulting RSA signature differs on every invocation even
when the key and payload are identical, breaking reproducible builds
of signed FMP capsules.
Pass -noattr to drop all signed attributes from the SignerInfo. The
signature is then computed directly over the content, producing
byte-identical output across runs.
The FMP update path is unaffected: FmpAuthenticationLibPkcs7 calls
Pkcs7Verify() without extracting signed attributes, and rollback
protection uses FwVersion / LowestSupportedVersion in
FMP_PAYLOAD_HEADER plus the auth header MonotonicCount, not
signingTime. signingTime is only consumed by DxeImageVerificationLib
for Secure Boot dbt checks on PE/COFF images, which is a separate
code path.
Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
Collect paths to drivers as they being saved and pass to
GenerateOutputJson() for inclusion into the output JSON file.
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
When a capsule is signed, --decode printed a warning if neither openssl
nor signtool was configured via command-line options. And yet, it then
proceeded to attempt the verification anyway.
Current implementation only ever uses --trusted-public-cert during
verification, so there could be some logic to this behaviour. However,
it's still confusing, so don't attempt to verify anything if it's not
expected to work.
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
The "Dependencies" key of Payloads was set to "None" string for capsules
with no DepEx. The produced JSON file wasn't suitable for passing back
to --encode without modifications.
Fix the issue by removing such invalid "Dependencies" keys similarly how
it's done for keys related to signing.
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
Allows substituting the GUID with the human-readable `TtyTerm` tag, akin
to other terminal types
Signed-off-by: Filip Lewinski <filip.lewinski@3mdeb.com>
This reverts commit 3fe1d56cc9.
PR https://github.com/tianocore/edk2/pull/11757 introduced a
"Breaking Change" feature for out of tree builds of tools.
This breaking change is blocking testing of edk2-stable202602
due to side effects on building FitGen tool in edk2-platforms.
Revert this feature for the edk2-stable202602 release and
work on this feature after the release.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
This reverts commit f0542ae07d.
PR https://github.com/tianocore/edk2/pull/11757 introduced a
"Breaking Change" feature for out of tree builds of tools.
This breaking change is blocking testing of edk2-stable202602
due to side effects on building FitGen tool in edk2-platforms.
Revert this feature for the edk2-stable202602 release and
work on this feature after the release.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Use $(SEP) with addprefix of $(OBJDIR) to support Windows MINGW
CLANG builds that use Windows path separators with GNU makefiles.
This fixes Windows MINGW CLANG builds of the PcdValueInit
application that is required for structured PCDs.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Main EDK2 build supports out-of-tree builds but BaseTools make process
still creates tools and object files in-tree. In order to make
out-of-tree build support complete move the generated tools and
interim obj files to $WORKSPACE location as well.
This patch also changes the location of BaseTools for in-tree builds
(default behavior when WORKSPACE is not provided before calling
edksetup) to $WORKSPACE/BaseTools/Build/... It may potentially break
external workflows that invoke tools from the default location outside
of the build tool.
Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
- Move common wrapper logic for multiple tools to GenericShellWrapper
file
- Drop search for BaseToolsCBinaries from the list of checked
directories. This case has been broken for quite a while since the
exec clause never passed command arguments to the supposed binary.
- Remove a suggestion to run make in $EDK_TOOLS_PATH/Source/C and let
the wrapper fail if the directory exists but no binary is present.
Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
VfrLexer.h is built as a part of VfrCompile build and
shouldn't be present at the BaseTools/Source/C level.
Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
As a preparation for out-of-tree build support make sure all interim
files for tests are created in tmp directory.
Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
SEP variable is only set if PYTHON_COMMAND is undefined but referred
regardless. It breaks the clean target for the following scenario:
. edksetup.sh # Sets PYTHON_COMMAND
make -C BaseTools
make -C BaseTools clean
This change fixes the use case mentioned above by settings SEP
for all build configurations.
[ardb: Drop redundant assignment for Windows]
Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
New warning after updating gcc:
EfiRom.c: In function ‘main’:
EfiRom.c:78:17: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
The assigned value is not used, so fix the warning by just removing it.
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
StringFuncs.c: In function ‘SplitStringByWhitespace’:
StringFuncs.c:113:15: error: variable ‘Item’ set but not used [-Werror=unused-but-set-variable=]
113 | UINTN Item;
| ^~~~
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
The PCD value defined in module subsections can be added to global PCD
database. Therefore the unsolved expressions, even belongs to the global
scope, can incorrectly refer to the value from module subsection.
This only happens when the referred PCD has no value assignment in the
platform dsc file. Which also should raise an error.
Signed-off-by: Paddy Deng <paddydeng@ami.com>
Fix VS20xx build failures in GitHub Actions windows-2025
environments due to missing libraries.
Add WindowsSDKLibVersion to the set of environment variables
that are set in a Windows Visual Studio build environment.
WindowsSDKLibVersion is required to set LIBPATH for VS20xx
builds of the EmulatorPkg and Host-based unit tests.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Add %VCToolsInstallDir%\bin\Hostx64\x86 to PATH to add DLLs
required for IA32 host-based unit tests to execute.
Some Visual Studio environments add the IA32 DLL path to PATH
and some do not. The failure was observed in GitHub Action
windows-2025 agents where the X64 DLL path was added, but the
IA32 DLL path was missing.
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
When compiling rc files in environments where file paths begin with "/",
llvm-rc may incorrectly interpret absolute paths such as "/User/..."
as command-line options (e.g., "/U", "ser", "..."). This results in the
error "Exactly one input file must be specified". The issue was
initially observed on macOS, where user data is commonly located under
"/User" rather than "/home", but was later found to affect all platforms
where file paths start with "/". Using double hyphens ensures that all
arguments to the right are treated as positional arguments rather than
options. The use of double hyphens is supported by the LLVM command-line
argument parser and is safe in all such environments.
See: https://llvm.org/docs/CommandLine.html
Section: Specifying positional options with hyphens
Signed-off-by: Alexander Gryanko <xpahos@gmail.com>
This change adds the support for building AARCH64 target platforms using
CLANGPDB.
This applies a 4KB section alignment for all AArch64 modules built
with CLANGPDB for multiple reasons:
- DXE and Standalone MM modules should have memory protections applied
- There is a bug in llvm that allows for code generation that ends up
requiring 4KB section alignment, see
https://github.com/llvm/llvm-project/issues/172660.
This also adds a build rule to use DLINK_XIPFLAGS to ensure a file
alignment of 4KB for SEC/PEI modules to ensure file alignment and
section alignment match.
Signed-off-by: Oliver Smith-Denny <osde@microsoft.com>
* Drop AArch64 definitions
* Drop /ALIGN:32 from X64 linker flags
* Drop ancient EBC compiler information
Signed-off-by: Daniel Grobert <danalexgro@gmail.com>
Michał Kopeć
Sergii Dmytruk
Filip Lewiński
Michael D Kinney
Michael Kubacki
Oleksandr Tymoshenko
Gerd Hoffmann
PaddyDeng
Alexander Gryanko
Oliver Smith-Denny
Mike Beaton
Daniel