Open ownia opened 6 months ago
SecureBoot - Verify signed KEK append update & Verify signed DB append update:
When SIE SCT testing variable append write, uboot returns EFI_SECURITY_VIOLATION error due to “In RSAVerify(): Hash check failed.”
The bbr-acs build test key using efitools, in https://github.com/ARM-software/bbr-acs/blob/ff7d65c34a6ec16d9a2fa157f69f269ad9eb07ee/bbsr/sct-tests/SecureBoot/BlackBoxTest/Dependency/Images/GNUmakefile#L175, sign-efi-sig-list create authentication header using a determined APPEND_WRITE attribute and a timestamp, but efitools rightnow is not allowed to using them both, refer to https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git/tree/sign-efi-sig-list.c#n172. So we should not add APPEND_WRITE attribute using efitools and the test case has already added it. After removing this parameter, these two tests passed.
SecureBoot - Verify signed KEK append update & Verify signed DB append update:
When SIE SCT testing variable append write, uboot returns EFI_SECURITY_VIOLATION error due to “In RSAVerify(): Hash check failed.”
The bbr-acs build test key using efitools, in https://github.com/ARM-software/bbr-acs/blob/ff7d65c34a6ec16d9a2fa157f69f269ad9eb07ee/bbsr/sct-tests/SecureBoot/BlackBoxTest/Dependency/Images/GNUmakefile#L175, sign-efi-sig-list create authentication header using a determined APPEND_WRITE attribute and a timestamp, but efitools rightnow is not allowed to using them both, refer to https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git/tree/sign-efi-sig-list.c#n172. So we should not add APPEND_WRITE attribute using efitools and the test case has already added it. After removing this parameter, these two tests passed.