From nobody Sat May 18 21:26:54 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+90121+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90121+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1654065997; cv=none; d=zohomail.com; s=zohoarc; b=oBit7vvkwVTboi+KhcRzgnsuGp9nZ9xWqNbmu0LvTvB9d8XmG8FjlOEuKC97wTmVGmQZ+mbjjKArWcsYLZY3ZQXlxrY/YYTpsgdlVhUy+yyRuD55tkwUvjUr0EispZNiKnQbnGhx2fk16Ik+Xc1zWQvA87R/9cyqfzrFXblTwgQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1654065997; h=Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Sender:Subject:To; bh=D2AB+SAQMVFA6F3fQBBddq9oKR6hlAXeH+z9+pucm0I=; b=VkD8i+BCtocFkMsWBU6+EE7f6qm8gK39B3TsnuMo1yEe+2SMliF4BsEO6tKos/nYDji2idkKcre05A9X2hLfhCa5/EUUk3cG3UkJ5FltyN7aPIrWJmZ0wPp6rn0IytTJzP27H+oeMXW7pnXeGl9QIh2jf/qIYmvb9mvljsiVmRE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90121+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1654065996974731.7480860564374; Tue, 31 May 2022 23:46:36 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id cNbsYY1788612xy29khOUlPc; Tue, 31 May 2022 23:46:36 -0700 X-Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.4406.1654065994224771224 for ; Tue, 31 May 2022 23:46:35 -0700 X-IronPort-AV: E=McAfee;i="6400,9594,10364"; a="275571935" X-IronPort-AV: E=Sophos;i="5.91,266,1647327600"; d="scan'208";a="275571935" X-Received: from orsmga002.jf.intel.com ([10.7.209.21]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 31 May 2022 23:46:32 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.91,266,1647327600"; d="scan'208";a="562670890" X-Received: from linjaso1-desk1.gar.corp.intel.com ([10.5.215.41]) by orsmga002.jf.intel.com with ESMTP; 31 May 2022 23:46:30 -0700 From: jason1.lin@intel.com To: devel@edk2.groups.io Cc: Jason1 Lin , Bob Feng , Liming Gao , Yuwei Chen , Dakota Chiang Subject: [edk2-devel] [PATCH v1] BaseTools/Capsule: Add support to input subject name to sign capsule file Date: Wed, 1 Jun 2022 14:46:27 +0800 Message-Id: <20220601064627.2677-1-jason1.lin@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,jason1.lin@intel.com X-Gm-Message-State: HO2ObIT8kjBqpsqyLoXksvjdx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1654065996; bh=+VrJfoW9DEIqLIUdZs/piha3AYJYDgPUEJfBWWMFV9M=; h=Cc:Date:From:Reply-To:Subject:To; b=sSfqTWT263j59ggeV8n03z9HvCdLb4dsGoeDxsxbmeNKuRVCv11KMnWhrQOaJ8B91c6 tBDBLLj9KdnOc2sCSNasRanu+4zpGBY+f3xS+wndt6yCKuaOo0RwLwv8WQhERQQeWrFST CP9fZo5CAVVJZblEpJT9i1vKU1Z7pt8i2dY= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1654065998170100001 Content-Type: text/plain; charset="utf-8" From: Jason1 Lin REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3928 Windows-based system using signtool.exe to sign the capsule. Add the support to using "--subject-name" argument to assign the subject name used to sign the capsule file. This argument would pass to signtool.exe as a part of input argument with "/n" flag. NOTE: If using signtool to sign capsule at least need to choose one of "--pfx-file" and "--subject-name" argument to input the value. Signed-off-by: Jason1 Lin Cc: Bob Feng Cc: Liming Gao Cc: Yuwei Chen Cc: Dakota Chiang --- BaseTools/Source/Python/Capsule/GenerateCapsule.py | 43 ++++++++++++++++--= -- 1 file changed, 34 insertions(+), 9 deletions(-) diff --git a/BaseTools/Source/Python/Capsule/GenerateCapsule.py b/BaseTools= /Source/Python/Capsule/GenerateCapsule.py index b8039db878..35435946c6 100644 --- a/BaseTools/Source/Python/Capsule/GenerateCapsule.py +++ b/BaseTools/Source/Python/Capsule/GenerateCapsule.py @@ -10,7 +10,7 @@ # keep the tool as simple as possible, it has the following limitations: # * Do not support vendor code bytes in a capsule. # -# Copyright (c) 2018 - 2019, Intel Corporation. All rights reserved.
+# Copyright (c) 2018 - 2022, Intel Corporation. All rights reserved.
# SPDX-License-Identifier: BSD-2-Clause-Patent # =20 @@ -38,11 +38,11 @@ from Common.Edk2.Capsule.FmpPayloadHeader import FmpPa= yloadHeaderClass # Globals for help information # __prog__ =3D 'GenerateCapsule' -__version__ =3D '0.9' -__copyright__ =3D 'Copyright (c) 2018, Intel Corporation. All rights res= erved.' +__version__ =3D '0.10' +__copyright__ =3D 'Copyright (c) 2022, Intel Corporation. All rights res= erved.' __description__ =3D 'Generate a capsule.\n' =20 -def SignPayloadSignTool (Payload, ToolPath, PfxFile, Verbose =3D False): +def SignPayloadSignTool (Payload, ToolPath, PfxFile, SubjectName, Verbose = =3D False): # # Create a temporary directory # @@ -72,7 +72,10 @@ def SignPayloadSignTool (Payload, ToolPath, PfxFile, Ver= bose =3D False): Command =3D Command + '"{Path}" '.format (Path =3D os.path.join (ToolP= ath, 'signtool.exe')) Command =3D Command + 'sign /fd sha256 /p7ce DetachedSignedData /p7co = 1.2.840.113549.1.7.2 ' Command =3D Command + '/p7 {TempDir} '.format (TempDir =3D TempDirecto= ryName) - Command =3D Command + '/f {PfxFile} '.format (PfxFile =3D PfxFile) + if PfxFile is not None: + Command =3D Command + '/f {PfxFile} '.format (PfxFile =3D PfxFile) + if SubjectName is not None: + Command =3D Command + '/n {SubjectName} '.format (SubjectName =3D = SubjectName) Command =3D Command + TempFileName if Verbose: print (Command) @@ -105,7 +108,7 @@ def SignPayloadSignTool (Payload, ToolPath, PfxFile, Ve= rbose =3D False): shutil.rmtree (TempDirectoryName) return Signature =20 -def VerifyPayloadSignTool (Payload, CertData, ToolPath, PfxFile, Verbose = =3D False): +def VerifyPayloadSignTool (Payload, CertData, ToolPath, PfxFile, SubjectNa= me, Verbose =3D False): print ('signtool verify is not supported.') raise ValueError ('GenerateCapsule: error: signtool verify is not supp= orted.') =20 @@ -249,6 +252,7 @@ if __name__ =3D=3D '__main__': HardwareInstance =3D ConvertJsonValue (Config, 'Ha= rdwareInstance', ValidateUnsignedInteger, Required =3D False, Default =3D 0) MonotonicCount =3D ConvertJsonValue (Config, 'Mo= notonicCount', ValidateUnsignedInteger, Required =3D False, Default =3D 0) SignToolPfxFile =3D ConvertJsonValue (Config, 'Si= gnToolPfxFile', os.path.expandvars, Required =3D False, Default =3D None, O= pen =3D True) + SignToolSubjectName =3D ConvertJsonValue (Config, 'Si= gnToolSubjectName', os.path.expandvars, Required =3D False, Default =3D Non= e, Open =3D True) OpenSslSignerPrivateCertFile =3D ConvertJsonValue (Config, 'Op= enSslSignerPrivateCertFile', os.path.expandvars, Required =3D False, Defaul= t =3D None, Open =3D True) OpenSslOtherPublicCertFile =3D ConvertJsonValue (Config, 'Op= enSslOtherPublicCertFile', os.path.expandvars, Required =3D False, Default = =3D None, Open =3D True) OpenSslTrustedPublicCertFile =3D ConvertJsonValue (Config, 'Op= enSslTrustedPublicCertFile', os.path.expandvars, Required =3D False, Defaul= t =3D None, Open =3D True) @@ -264,6 +268,7 @@ if __name__ =3D=3D '__main__': HardwareInstance, UpdateImageIndex, SignToolPfxFile, + SignToolSubjectName, OpenSslSignerPrivateCertFile, OpenSslOtherPublicCertFile, OpenSslTrustedPublicCertFile, @@ -303,6 +308,7 @@ if __name__ =3D=3D '__main__': UpdateImageIndex =3D ConvertJsonValue (Config, 'Up= dateImageIndex', ValidateUnsignedInteger, Required =3D False, Default =3D 1) MonotonicCount =3D ConvertJsonValue (Config, 'Mo= notonicCount', ValidateUnsignedInteger, Required =3D False, Default =3D 0) SignToolPfxFile =3D ConvertJsonValue (Config, 'Si= gnToolPfxFile', os.path.expandvars, Required =3D False, Default =3D None, O= pen =3D True) + SignToolSubjectName =3D ConvertJsonValue (Config, 'Si= gnToolSubjectName', os.path.expandvars, Required =3D False, Default =3D Non= e, Open =3D True) OpenSslSignerPrivateCertFile =3D ConvertJsonValue (Config, 'Op= enSslSignerPrivateCertFile', os.path.expandvars, Required =3D False, Defaul= t =3D None, Open =3D True) OpenSslOtherPublicCertFile =3D ConvertJsonValue (Config, 'Op= enSslOtherPublicCertFile', os.path.expandvars, Required =3D False, Default = =3D None, Open =3D True) OpenSslTrustedPublicCertFile =3D ConvertJsonValue (Config, 'Op= enSslTrustedPublicCertFile', os.path.expandvars, Required =3D False, Defaul= t =3D None, Open =3D True) @@ -329,6 +335,7 @@ if __name__ =3D=3D '__main__': HardwareInstance, UpdateImageIndex, SignToolPfxFile, + SignToolSubjectName, OpenSslSignerPrivateCertFile, OpenSslOtherPublicCertFile, OpenSslTrustedPublicCertFile, @@ -348,6 +355,7 @@ if __name__ =3D=3D '__main__': "HardwareInstance": str(PayloadDescripto= r.HardwareInstance), "UpdateImageIndex": str(PayloadDescripto= r.UpdateImageIndex), "SignToolPfxFile": str(PayloadDescriptor= .SignToolPfxFile), + "SignToolSubjectName": str(PayloadDescri= ptor.SignToolSubjectName), "OpenSslSignerPrivateCertFile": str(Payl= oadDescriptor.OpenSslSignerPrivateCertFile), "OpenSslOtherPublicCertFile": str(Payloa= dDescriptor.OpenSslOtherPublicCertFile), "OpenSslTrustedPublicCertFile": str(Payl= oadDescriptor.OpenSslTrustedPublicCertFile), @@ -363,6 +371,8 @@ if __name__ =3D=3D '__main__': for PayloadField in PayloadSection: if PayloadJsonDescriptorList[Index].SignToolPfxFile is None: del PayloadField ['SignToolPfxFile'] + if PayloadJsonDescriptorList[Index].SignToolSubjectName is Non= e: + del PayloadField ['SignToolSubjectName'] if PayloadJsonDescriptorList[Index].OpenSslSignerPrivateCertFi= le is None: del PayloadField ['OpenSslSignerPrivateCertFile'] if PayloadJsonDescriptorList[Index].OpenSslOtherPublicCertFile= is None: @@ -402,6 +412,9 @@ if __name__ =3D=3D '__main__': if args.SignToolPfxFile: print ('GenerateCapsule: error: Argument --pfx-file conflicts = with Argument -j') sys.exit (1) + if args.SignToolSubjectName: + print ('GenerateCapsule: error: Argument --SubjectName conflic= ts with Argument -j') + sys.exit (1) if args.OpenSslSignerPrivateCertFile: print ('GenerateCapsule: error: Argument --signer-private-cert= conflicts with Argument -j') sys.exit (1) @@ -425,6 +438,7 @@ if __name__ =3D=3D '__main__': HardwareInstance =3D 0, UpdateImageIndex =3D 1, SignToolPfxFile =3D None, + SignToolSubjectName =3D None, OpenSslSignerPrivateCertFile =3D None, OpenSslOtherPublicCertFile =3D None, OpenSslTrustedPublicCertFile =3D None, @@ -439,13 +453,15 @@ if __name__ =3D=3D '__main__': self.HardwareInstance =3D HardwareInstance self.UpdateImageIndex =3D UpdateImageIndex self.SignToolPfxFile =3D SignToolPfxFile + self.SignToolSubjectName =3D SignToolSubjectName self.OpenSslSignerPrivateCertFile =3D OpenSslSignerPrivateCert= File self.OpenSslOtherPublicCertFile =3D OpenSslOtherPublicCertFi= le self.OpenSslTrustedPublicCertFile =3D OpenSslTrustedPublicCert= File self.SigningToolPath =3D SigningToolPath self.DepexExp =3D DepexExp =20 - self.UseSignTool =3D self.SignToolPfxFile is not None + self.UseSignTool =3D (self.SignToolPfxFile is not None or + self.SignToolSubjectName is not None) self.UseOpenSsl =3D (self.OpenSslSignerPrivateCertFile is not= None and self.OpenSslOtherPublicCertFile is not Non= e and self.OpenSslTrustedPublicCertFile is not N= one) @@ -504,8 +520,9 @@ if __name__ =3D=3D '__main__': raise argparse.ArgumentTypeError ('--update-image-= index must be an integer in range 0x0..0xff') =20 if self.UseSignTool: - self.SignToolPfxFile.close() - self.SignToolPfxFile =3D self.SignToolPfxFile.name + if self.SignToolPfxFile is not None: + self.SignToolPfxFile.close() + self.SignToolPfxFile =3D self.SignToolPfxFile.name if self.UseOpenSsl: self.OpenSslSignerPrivateCertFile.close() self.OpenSslOtherPublicCertFile.close() @@ -548,6 +565,7 @@ if __name__ =3D=3D '__main__': args.HardwareInstance, args.UpdateImageIndex, args.SignToolPfxFile, + args.SignToolSubjectName, args.OpenSslSignerPrivateCertF= ile, args.OpenSslOtherPublicCertFil= e, args.OpenSslTrustedPublicCertF= ile, @@ -590,6 +608,7 @@ if __name__ =3D=3D '__main__': Result + struct.pack ('