stand: Fix secureboot buildMake libesecureboot build, enabled when WITH_BEARSSL=yWITH_LOADER_EFI_SECUREBOOT=y.Copy EDK2 files related to secure boot to sys/contrib/edk2 and deleteduplicates und
stand: Fix secureboot buildMake libesecureboot build, enabled when WITH_BEARSSL=yWITH_LOADER_EFI_SECUREBOOT=y.Copy EDK2 files related to secure boot to sys/contrib/edk2 and deleteduplicates under libsecreboot/efi/include.Adjust efi_variables.c to build in the new environment.Undefine MIN and MAX before include sys/param.h in libsecureboot.h. I'mnot sure that sys/param.h is needed here, but either the param.h or theBase.h definitions are fine.Fix include paths to reflect the new way.Fixes: 43b8edb32051Sponsored by: Netflix
show more ...
Remove $FreeBSD$: one-line .c patternRemove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
Remove $FreeBSD$: two-line .h patternRemove /^\s*\*\n \*\s+\$FreeBSD\$$\n/
Extend libsecureboot(old libve) to obtain trusted certificates from UEFI and implement revocationUEFI related headers were copied from edk2.A new build option "MK_LOADER_EFI_SECUREBOOT" was added
Extend libsecureboot(old libve) to obtain trusted certificates from UEFI and implement revocationUEFI related headers were copied from edk2.A new build option "MK_LOADER_EFI_SECUREBOOT" was added to allowloading of trusted anchors from UEFI.Certificate revocation support is also introduced.The forbidden certificates are loaded from dbx variable.Verification fails in two cases:There is a direct match between cert in dbx and the one in the chain.The CA used to sign the chain is found in dbx.One can also insert a hash of TBS section of a certificate into dbx.In this case verifications fails only if a direct match with acertificate in chain is found.Submitted by: Kornel Duleba <mindal@semihalf.com>Reviewed by: sjgObtained from: SemihalfSponsored by: StormshieldDifferential Revision: https://reviews.freebsd.org/D19093