From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail05.groups.io (mail05.groups.io [45.79.224.7]) by spool.mail.gandi.net (Postfix) with ESMTPS id 46121940F0B for ; Wed, 27 Nov 2024 01:33:09 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=X1MuR9ljcfbEguUCg6X/TdPEOKBqlAwq6IPuk9lMd/c=; c=relaxed/simple; d=groups.io; h=Feedback-ID:Message-ID:Date:MIME-Version:User-Agent:To:Cc:From:Subject:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Language:Content-Type:Content-Transfer-Encoding; s=20240830; t=1732671189; v=1; x=1732930387; b=VsZ8T0jZQKSi8vGhmP4PvhBwdMbJm5up8/gTMjOn+y8RjDVV2geU38LdGMRjXj58VidLJBn8 2XbzleL0h/Cb9CbXShw29rKqZ5UkjN6xdHZS0ySbS9DFIBmttnNX1l0gM+okpsqPv+pihDAbtb8 5hyyswrPB44D8xG44ytK4RYeG3dn5hVKPla6h6DQFvwqcpg4SpmQ2LjGOpmdeeQGLd3tISKVk9C EYSryzJ8TY0G3KpzignmjAfRPf1LTkMpuIF+WckC+5oxT6p0lQYZ4tmFeuMH0yvctOhoLneHvaP BnsH6RRAL6hGWv3Ch7rGNgixu7EPfCv2RQ6miHwNS+9YA== X-Received: by 127.0.0.2 with SMTP id BEk0YY7687511xW0dk8dq1Fb; Tue, 26 Nov 2024 17:33:07 -0800 X-Received: from fhigh-a2-smtp.messagingengine.com (fhigh-a2-smtp.messagingengine.com [103.168.172.153]) by mx.groups.io with SMTP id smtpd.web10.62324.1732671186864419252 for ; Tue, 26 Nov 2024 17:33:07 -0800 X-Received: from phl-compute-04.internal (phl-compute-04.phl.internal [10.202.2.44]) by mailfhigh.phl.internal (Postfix) with ESMTP id 00F44114013A; Tue, 26 Nov 2024 20:33:06 -0500 (EST) X-Received: from phl-mailfrontend-02 ([10.202.2.163]) by phl-compute-04.internal (MEProxy); Tue, 26 Nov 2024 20:33:05 -0500 X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefuddrgeekgdefgecutefuodetggdotefrodftvf curfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdpuffr tefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecusecvtfgvtghiphhivghnth hsucdlqddutddtmdenucfjughrpefkffggfgfvvefhufgtgfesthekredttddvjeenucfh rhhomheptfgvsggvtggtrgcuvehrrghnuceorhgvsggvtggtrgessghsughiohdrtghomh eqnecuggftrfgrthhtvghrnhephfejleekkedtgefgkeetlefguddtvdegtdehiedvffff leeggeehteeihfeghefhnecuffhomhgrihhnpehuvghfihdrohhrghdpghhithhhuhgsrd gtohhmnecuvehluhhsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomhep rhgvsggvtggtrgessghsughiohdrtghomhdpnhgspghrtghpthhtohepfedpmhhouggvpe hsmhhtphhouhhtpdhrtghpthhtohepuggvvhgvlhesvggukhdvrdhgrhhouhhpshdrihho pdhrtghpthhtohepughouhhgfhhlihgtkhesmhhitghrohhsohhfthdrtghomhdprhgtph htthhopehkuhhqihhnsehmihgtrhhoshhofhhtrdgtohhm X-ME-Proxy: Feedback-ID: i5b994698:Fastmail X-Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 26 Nov 2024 20:33:05 -0500 (EST) Message-ID: Date: Tue, 26 Nov 2024 18:32:56 -0700 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: "devel@edk2.groups.io" Cc: Doug Flick , Kun Qin From: "Rebecca Cran" Subject: [edk2-devel] Secure Boot: error enrolling dbx from uefi.org into dbxDefault (file is in wrong format?) Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Tue, 26 Nov 2024 17:33:07 -0800 Resent-From: rebecca@bsdio.com Reply-To: devel@edk2.groups.io,rebecca@bsdio.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: f2fWVsWP2Si3mvkbhWyef5Zfx7686176AA= Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240830 header.b=VsZ8T0jZ; dmarc=none; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 45.79.224.7 as permitted sender) smtp.mailfrom=bounce@groups.io I'm working on Secure Boot support and noticed the dbxDefault variable isn't being created: during boot I get the messages: SecureBootFetchData: Invalid key format: 0 Content for dbxDefault not found I'm using ArmPlatformPkg/SecureBootDefaultKeys.fdf.inc to add the data to my firmware. The problem appears to be this: at https://uefi.org/revocationlistfile it says: "These files are used to update the Secure Boot Forbidden Signature Database, dbx. It contains the raw bytes passed in *Data to SetVariable()... an EFI_VARIABLE_AUTHENTICATION_2 concatenated with the new variable value.  Example usage: SetVariable( "dbx", EFI_IMAGE_SECURITY_DATABASE_GUID, NV+BS+RT+AT+AppendWrite, dbxUpdateDotBin_sizeInBytes, *dbxUpdateDotBin_bytes). dbxupdate.bin already contains a Microsoft KEK signature (encoded as specified by the UEFI spec)." But SecureBootFetchData calls RsaGetPublicKeyFromX509, which won't work because the data is in the wrong format? Looking at the files in the release from https://github.com/microsoft/secureboot_objects it looks like they're also in the format suitable for calling SetVariable, not for parsing as X509. Has anyone else come across this and knows of a solution? -- Rebecca Cran -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#120848): https://edk2.groups.io/g/devel/message/120848 Mute This Topic: https://groups.io/mt/109800343/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-