Re: internal structure of EFI_TLS_CA_CERTIFICATE_VARIABLE

["Zeng, Star" <star.zeng@intel.com>]

Laszlo,

There should be some places need to care about. I also need to check the detail.

I am ok to make the patch if it is not so urgent.


Thanks,
Star
-----Original Message-----
From: Laszlo Ersek [mailto:lersek@redhat.com] 
Sent: Wednesday, March 28, 2018 6:07 PM
To: Zeng, Star <star.zeng@intel.com>; Fu, Siyuan <siyuan.fu@intel.com>; Wu, Jiaxin <jiaxin.wu@intel.com>
Cc: edk2-devel-01 <edk2-devel@lists.01.org>; Daniel P. Berrange <berrange@redhat.com>
Subject: Re: [edk2] internal structure of EFI_TLS_CA_CERTIFICATE_VARIABLE

Hi Star,

thanks for following up; comments below:

On 03/28/18 05:28, Zeng, Star wrote:
> Is there a PCD pointers to the siglist?

We discussed that earlier, but because HttpDxe -- which consumes the certificate list -- is a UEFI driver, we decided that it should not consume dynamic PCDs. The alternative (specified in the UEFI spec) was variables.

The earlier discussion wasn't exactly about the trusted CA cert list.
Instead, it was about the trusted cipher algo list. However, both of these knobs pose the same "info channel" questions. So here's the link into the cipher algo list discussion:

http://mid.mail-archive.com/895558F6EA4E3B41AC93A00D163B72741637DE9E@SHSMSX103.ccr.corp.intel.com

> For adding PcdMaxVolatileVariableSize: non-authenticated, volatile, I think it is acceptable if there are use cases.

Thank you for accepting the idea in theory :)

Do you think it is a simple change? Or is it intrusive?

If it is intrusive, then I'd prefer if one of the variable driver maintainers wrote the patch. It's a complex driver and there can be hidden assumptions and relationships that I might miss.

If it's a reasonably simple change then I'm happy to work on it.

Thanks!
Laszlo