[edk2-devel] Capsule validation tool?

[edk2-devel] Capsule validation tool?

[james.last via groups.io]

[-- Attachment #1: Type: text/plain, Size: 643 bytes --]

Hi folks,

We're working on a tool similar to GenerateCapsule but uses HSM-based keys to perform the signing instead of a local key file. Is there a standalone tool or recommended method to validate the capsules are generated correctly using the cert chain?

Thanks,
Jim


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#120786): https://edk2.groups.io/g/devel/message/120786
Mute This Topic: https://groups.io/mt/109651149/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-



[-- Attachment #2: Type: text/html, Size: 1133 bytes --]

Re: [edk2-devel] Capsule validation tool?

[Michael D Kinney via groups.io]

[-- Attachment #1: Type: text/plain, Size: 997 bytes --]

There is a shell app that can be used to apply a capsule.

https://github.com/tianocore/edk2/tree/master/MdeModulePkg/Application/CapsuleApp

Mike

From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of james.last via groups.io
Sent: Monday, November 18, 2024 11:15 AM
To: devel@edk2.groups.io
Subject: [edk2-devel] Capsule validation tool?

Hi folks,

We're working on a tool similar to GenerateCapsule but uses HSM-based keys to perform the signing instead of a local key file. Is there a standalone tool or recommended method to validate the capsules are generated correctly using the cert chain?

Thanks,
Jim



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#120794): https://edk2.groups.io/g/devel/message/120794
Mute This Topic: https://groups.io/mt/109651149/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-



[-- Attachment #2: Type: text/html, Size: 4498 bytes --]

Re: [edk2-devel] Capsule validation tool?

[Rebecca Cran]

Not sure if you want to use the same tool again, but GenerateCapsule can 
be used to validate them too - it runs 'openssl smime -verify'. e.g.:


bcran@delano:/tiano> GenerateCapsule --signer-private-cert 
certs/cert.pem --other-public-cert certs/intermediate.pub.pem 
--trusted-public-cert certs/root.pub.pem -d 
./Build/ComHpcAlt/comhpcalt_host_debug_24.11.21-10.cap -o out.bin
bcran@delano:/tiano>


When there's no output verification passed. Otherwise a message will be 
displayed (though the exit code is still 0, which I guess is a bug). If 
I edit the capsule file or pass in the wrong certificate file, then I get:

Verification failure
E06A93BAFFFF0000:error:10800075:PKCS7 routines:PKCS7_verify:certificate 
verify error:crypto/pkcs7/pk7_smime.c:296:Verify error: unable to get 
local issuer certificate

GenerateCapsule: warning: payload verification failed Index = 1
GenerateCapsule: error: openssl failed.


Otherwise, similar to Mike's suggestion of using CapsuleApp you can also 
build a cabinet file and run e.g. "fwupdtool install 
comhpcalt_host_debug_24.11.21-10.cab" from the test machine to check if 
the verification succeeds and the capsule gets installed.


Rebecca


On 11/18/24 12:15 PM, james.last via groups.io wrote:
> We're working on a tool similar to GenerateCapsule but uses HSM-based 
> keys to perform the signing instead of a local key file. Is there a 
> standalone tool or recommended method to validate the capsules are 
> generated correctly using the cert chain?


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#120812): https://edk2.groups.io/g/devel/message/120812
Mute This Topic: https://groups.io/mt/109651149/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-