Re: internal structure of EFI_TLS_CA_CERTIFICATE_VARIABLE

[Laszlo Ersek <lersek@redhat.com>]

Hi Star,

thanks for following up; comments below:

On 03/28/18 05:28, Zeng, Star wrote:
> Is there a PCD pointers to the siglist?

We discussed that earlier, but because HttpDxe -- which consumes the
certificate list -- is a UEFI driver, we decided that it should not
consume dynamic PCDs. The alternative (specified in the UEFI spec) was
variables.

The earlier discussion wasn't exactly about the trusted CA cert list.
Instead, it was about the trusted cipher algo list. However, both of
these knobs pose the same "info channel" questions. So here's the link
into the cipher algo list discussion:

http://mid.mail-archive.com/895558F6EA4E3B41AC93A00D163B72741637DE9E@SHSMSX103.ccr.corp.intel.com

> For adding PcdMaxVolatileVariableSize: non-authenticated, volatile, I think it is acceptable if there are use cases.

Thank you for accepting the idea in theory :)

Do you think it is a simple change? Or is it intrusive?

If it is intrusive, then I'd prefer if one of the variable driver
maintainers wrote the patch. It's a complex driver and there can be
hidden assumptions and relationships that I might miss.

If it's a reasonably simple change then I'm happy to work on it.

Thanks!
Laszlo