mirror of
https://github.com/Dasharo/edk2.git
synced 2026-06-13 10:16:24 -07:00
Michał Kopeć
0fb9d21dda
This makes capsule PKCS#7 signatures reproducible. openssl smime -sign embeds a signingTime signed attribute (current UTCTime) by default. Because the attribute is inside the signed digest, the resulting RSA signature differs on every invocation even when the key and payload are identical, breaking reproducible builds of signed FMP capsules. Pass -noattr to drop all signed attributes from the SignerInfo. The signature is then computed directly over the content, producing byte-identical output across runs. The FMP update path is unaffected: FmpAuthenticationLibPkcs7 calls Pkcs7Verify() without extracting signed attributes, and rollback protection uses FwVersion / LowestSupportedVersion in FMP_PAYLOAD_HEADER plus the auth header MonotonicCount, not signingTime. signingTime is only consumed by DxeImageVerificationLib for Secure Boot dbt checks on PE/COFF images, which is a separate code path. Signed-off-by: Michał Kopeć <michal.kopec@3mdeb.com>
:: Note: New build instructions are available. It is recommended to start with the new instructions if learning how to build edk2 and/or BaseTools for the first time. This page is retained for reference. New instructions: `Build Instructions`_ .. _`Build Instructions`: https://github.com/tianocore/tianocore.github.io/wiki/Build-Instructions This directory contains the EDK II build tools and template files. Templates are located in the Conf directory, while the tools executables for Microsoft Windows Operating Systems are located in the Bin\\Win32 directory, other directory contains tools source. Build step to generate the binary tools --------------------------------------- Windows/Visual Studio Notes =========================== To build the BaseTools, you should run the standard vsvars32.bat script from your preferred Visual Studio installation or you can run get_vsvars.bat to use latest automatically detected version. In addition to this, you should set the following environment variables:: * EDK_TOOLS_PATH - Path to the BaseTools sub directory under the edk2 tree * BASE_TOOLS_PATH - The directory where the BaseTools source is located. (It is the same directory where this README.rst is located.) After this, you can run the toolsetup.bat file, which is in the same directory as this file. It should setup the remainder of the environment, and build the tools if necessary. Unix-like operating systems =========================== To build on Unix-like operating systems, you only need to type ``make`` in the base directory of the project. Ubuntu Notes ============ On Ubuntu, the following command should install all the necessary build packages to build all the C BaseTools:: sudo apt install build-essential uuid-dev