Mkeficapsule can dump signature for signed capsules. It can be used in test to validate signature i.e. with openssl. Add an entry for device tree node.
Signed-off-by: Wojciech Dubowik <[email protected]> --- tools/binman/entries.rst | 2 ++ tools/binman/etype/efi_capsule.py | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/tools/binman/entries.rst b/tools/binman/entries.rst index a81fcbd3891f..1dace2087a2a 100644 --- a/tools/binman/entries.rst +++ b/tools/binman/entries.rst @@ -552,6 +552,8 @@ Properties / Entry arguments: - public-key-cert: Path to PEM formatted .crt public key certificate file. Mandatory property for generating signed capsules. - oem-flags - OEM flags to be passed through capsule header. + - dump-signature: Instruct mkeficapsule to write signature data to + a separete file. It might be used to verify capsule authentication. Since this is a subclass of Entry_section, all properties of the parent class also apply here. Except for the properties stated as mandatory, the diff --git a/tools/binman/etype/efi_capsule.py b/tools/binman/etype/efi_capsule.py index 3b30c12ea514..01d56723b98c 100644 --- a/tools/binman/etype/efi_capsule.py +++ b/tools/binman/etype/efi_capsule.py @@ -101,6 +101,7 @@ class Entry_efi_capsule(Entry_section): self.private_key = '' self.public_key_cert = '' self.auth = 0 + self.dump_signature = False def ReadNode(self): super().ReadNode() @@ -111,6 +112,7 @@ class Entry_efi_capsule(Entry_section): self.hardware_instance = fdt_util.GetInt(self._node, 'hardware-instance') self.monotonic_count = fdt_util.GetInt(self._node, 'monotonic-count') self.oem_flags = fdt_util.GetInt(self._node, 'oem-flags') + self.dump_signature = fdt_util.GetBool(self._node, 'dump-signature') self.private_key = fdt_util.GetString(self._node, 'private-key') self.public_key_cert = fdt_util.GetString(self._node, 'public-key-cert') @@ -150,7 +152,8 @@ class Entry_efi_capsule(Entry_section): public_key_cert, self.monotonic_count, self.fw_version, - self.oem_flags) + self.oem_flags, + self.dump_signature) if ret is not None: return tools.read_file(capsule_fname) else: -- 2.47.3
