Re: [edk2-devel] Interpretation of specification

["Laszlo Ersek" <lersek@redhat.com>]

On 10/23/19 19:12, phlamorim@riseup.net wrote:
> The following commit on edk2 added a new a check on format of Authenticated variables: https://github.com/tianocore/edk2/commit/c035e37335ae43229d7e68de74a65f2c01ebc0af ( https://github.com/tianocore/edk2/commit/c035e37335ae43229d7e68de74a65f2c01ebc0af )
> 
> After this point some implementations started to have differences in the validation of the format of Authenticator Descriptor as we can se here: https://blog.hansenpartnership.com/uefi-secure-boot/#comment-48351
> 
> This case make me reach the following discussions: https://bugzilla.tianocore.org/show_bug.cgi?id=586 where i have seen lots of tools(more on linux) dont generate the correct format to use on the payload for TimeBased authenticated variables, at this time i was just trying to create a private authenticated variable, first thig which worked is to use this patch: https://patchew.org/EDK2/1525903747.5882.11.camel@HansenPartnership.com/ ( https://patchew.org/EDK2/1525903747.5882.11.camel@HansenPartnership.com/ )
> 
> But this patch never got merged, so i realized the tools on linux received upgrades to work properly with Authentication Variables of the edk2, but the same code just dont worked at a real machine using a ASROCK board. So my question is, where the developers should trust to consume the UEFI APIs in a trusted way. Another example i had is the path separator "\" or "/", edk2 uses "/" but the spec allow both, ASROCK mix both sometimes it can lead to some errors. I want to know if i can trust if my code work on EDK2 it should work on all other implementations too, and how we will try to remove these ambiguities of interpretation.

I suggest writing code against the published UEFI spec, and testing at
least with edk2. If edk2 does not behave in accordance with the UEFI
spec, then it could be a bug in edk2, or in the spec. Report the issue
on edk2-devel, and the community will try to figure out which half is wrong.

If your code seems correct, according to both the UEFI spec and to an
open source edk2 platform, but it breaks on a particular vendor
platform, I suggest talking to that vendor.

So, I would suggest the following order of "targets":
- spec
- reference implementation (edk2)
- open source platforms (edk2-platforms)
- vendor platform

Thanks
Laszlo