Convert the line endings stored for all text files in the repository to
LF. The majority previously used DOS-style CRLF line endings. Add a
.gitattributes file to enforce this and treat certain extensions as
never being text files.
Update PatchCheck.py to insist on LF line endings rather than CRLF.
However, its other checks fail on this commit due to lots of
pre-existing complaints that it only notices because the line endings
have changed.
Silicon/QemuSocPkg/FspBin/Patches/0001-Build-QEMU-FSP-2.0-binaries.patch
needs to be treated as binary since it contains a mixture of line
endings.
This change has implications depending on the client platform you are
using the repository from:
* Windows
The usual configuration for Git on Windows means that text files will
be checked out to the work tree with DOS-style CRLF line endings. If
that's not the case then you can configure Git to do so for the entire
machine with:
git config --global core.autocrlf true
or for just the repository with:
git config core.autocrlf true
Line endings will be normalised to LF when they are committed to the
repository. If you commit a text file with only LF line endings then it
will be converted to CRLF line endings in your work tree.
* Linux, MacOS and other Unices
The usual configuration for Git on such platforms is to check files out
of the repository with LF line endings. This is probably the right thing
for you. In the unlikely even that you are using Git on Unix but editing
or compiling on Windows for some reason then you may need to tweak your
configuration to force the use of CRLF line endings as described above.
* General
For more information see
https://docs.github.com/en/get-started/getting-started-with-git/configuring-git-to-handle-line-endings .
Fixes: https://github.com/slimbootloader/slimbootloader/issues/1400
Signed-off-by: Mike Crowe <mac@mcrowe.com>
Tools as MEU used for signing and generating key manifests
expects to pass abosulte openssl paths. Updating
get_openssl_path to return paths for linux cases.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
After GenContainer script was created, there ware more changes
introduced for signing and compression. However, GenContainer
was not updated to match those new changes. This patch addressed
this issue.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
run_process is used several places. Sometime
the extension name is not given for windows build.
In this case, if same file without file extension
exist (e.g. fit and fit.exe), then fit will be used
for windows build. It is not expected, so this patch
will add the missing .exe extension for this case.
Signed-off-by: Guo Dong <guo.dong@intel.com>
Python 3.4 and above have deprecated imp module in favor of
importlib. This patch removed imp module usage from SBL, and
used importlib instead.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
To avoid any dependency on non-standard python modules
it is preferred to make the binary Lz4 compression the
default flow and try the python module as a backup. Also
recommend to use a known working version of the lz4
python module, 3.1.1.
Signed-off-by: James Gutbub <james.gutbub@intel.com>
To make SBL scripts/tools more OS-agnostic the
lz4 (de)compression module can be used instead of
relying on the BaseTools LZ4 package/executable.
Need to update the azure pipeline to install
the python lz4 module before running the builds.
TEST=Confirmed that the python lz4.block.compress
routine is compatible with Lz4DecompressLib
during SBL runtime to decompress LZ4 binaries.
Signed-off-by: James Gutbub <james.gutbub@intel.com>
Openssl 1.1.1 is an installable and it creates
openssl.exe in a bin folder.
default slimboot path: c:\Openssl\bin\openssl.exe
Added support to populate OPENSSL_PATH
from bin dir incase its available.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
The new YAML format represented some data structure a little bit
differently from original DSC format. This patch did minor adjustment
to make the build pass on APL platform.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
This patch modified required tools ConfigEditor, GenCfgData, etc to
support YAML CFGDATA format.
To convert existing DSC to YAML, Dsc2Yaml tool can be used.
For example, to convert QEMU DSC to YAML, the following can be used:
python Dsc2Yaml.py -i Platform\QemuBoardPkg\CfgData\CfgDataDef.dsc
It will generate all required YAML files at current directory.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
Add svn field to container generation. SVN need
to be verified while doing container capsule
update. svn is added as end parameter to layout.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
KEY IDs are extended to include key type and sizes.
Platforms can configure corresponding RSA2048 and
RSA3072 KEY IDs. Updated tools to adjust hash type
based on key size.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
This patch adds support to key ids in single sign script.
Following pre-requistes to enable usage of key ids,
- Generate required RSA keys as per GenerateKeys.py
- SLIMBOOT_KEY_DIR env variable set to key folder
- Set private key paths to respective ids in
buildloader.py and boardconfigs files
- Update key hash store generation to use respective key ids
Enabling keyids in slimboot would be done subsequently.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
CommonUtility.py – It contains common functionality
for signing and extraction Of public key info.
It adds the necessary structures for signed data.
SingleSign.py – It contains core functionality related
to openssl for sign operations. This script will
be enhanced for accessing key store.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
PublicKey hashes stored in HashStore use hash alg type of
PcdCompSignHash defined with Build config. In container we
support cases where hash type could differ from Sbl default
signing hash.
Adjust the hash algorithm in external KeyHashStore manifest
based on key size. Use SHA256 for size 2K and SHA384 for 3K.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
Added an build config _SIGNING_SCHEME for
selection of signing schmemes. Updated tools
with param for selecting the signing scheme when
they are run in stand alone mode. Authtypes in
container are updated.
Supported Signing schemes - RSA_PCKS_1_5, RSA_PSS
Intel Crypto recommends PSS and same defaulted in
SlimBoot.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
This patch added following enhancement to GenContainer script:
- Fixed python3 errors in some specific condition
- Added more error handling to notifce the user on failure
- Removed -od option and use directory of -o option instead
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
In Python 3 built-in function next() is used to get the next
result from an iterator. next method causes post build failure.
Fixed an issue in GenContainer for byte array comparison.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
This patch introduces support for RSA3K and SHA384 signing
And verifications support to Slimbootloader. Component hash
verification is done using PcdCompSignHashAlg.
To enable RSA3072 and SHA384,
- Signing hash algorithm SIGN_HASH_TYPE should be set to SHA2_384
- RSA3K private keys should be configured in platform board configs.
- Set IPP_CRYPTO_ALG_MASK to include SHA2_384
- Enable required IPP_CRYPTO_OPTIMIZATION_MASK
- Default siging hash type is set to SHA2_256. Use hash type option
while using the tools as Gencontainer, CfgDataTool in standalone
mode.
Signed-off-by: Subash Lakkimsetti <subash.lakkimsetti@intel.com>
This patch reimplemented function to get the key type by reusing the
existing gen_pub_key() function. It also cleaned some code format to
make it easier to read.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
This patch removed duplicated RSA signing implemention in
CfgDataTool script and used the common one in CommonUtility.
It also removed PrintByteArray(), and use common print_bytes()
instead.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
Current SBL hash store has many limitations:
- Only support fixed hash size
- Only support 1:1 public key and usage mapping
- Only support build time key enrollment
This patch addressed this issue by introducing:
- Add a updatable KEYH component to hold extra key hash
- Allow append new hash entries from KEYH
- Use variable length entry for hash
- Introduce "Usage" bit mask for a key usage
This will allow using a single key to sign multiple components, or
using multiple keys to sign a single component. The built-in hash
store will only contain hash for STAGE1B, STAGE2, PAYLOAD,
PAYLOAD_FWU and MASTER public key hash. Master key hash will be used
to verify the KEYH component loaded at runtime in Stage1B. Once KEYH
is loaded, it will be appended into global hash store. The combined
hash store will be used to verify other components on the boot flow.
Signed-off-by: Maurice Ma <maurice.ma@intel.com>
This patch add pubkey and signature header updates to storage.
Data reversal for hash computation is not being performed.
Only RSA2048 and SHA256 changes were updated with this patch.
Signed-off-by: Subash Lakkimsetti <subashx.lakkimsetti@intel.com>
