proxmox-mirrors/fwupd
1
0
Fork 0
mirror of https://git.proxmox.com/git/fwupd synced 2025-08-06 09:00:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Only count the Microsoft hashes when getting the dbx version

Browse Source 
HP include extra keys that means the version is higher than expected.
This commit is contained in:
Richard Hughes 2022-10-17 15:45:18 +01:00
parent 3a0f187a16
commit 5fcfe7f0fc
2 changed files with 12 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/env.md
View File

@ -43,6 +43,7 @@ with a non-standard filesystem layout.
* `FWUPD_DEVICE_LIST_VERBOSE` display devices being added and removed from the list
* `FWUPD_PROBE_VERBOSE` dump the detected devices to the console, even if not supported by fwupd
* `FWUPD_BIOS_SETTING_VERBOSE` be verbose while parsing BIOS settings
* `FWUPD_EFI_SIGNATURE_VERBOSE` be verbose while parsing EFI signatures
## Plugins

16
libfwupdplugin/fu-efi-signature-list.c
View File

@ -187,9 +187,7 @@ static gchar *
fu_efi_signature_list_get_version(FuEfiSignatureList *self)
{
guint csum_cnt = 0;
const gchar *ignored_guids[] = {FU_EFI_SIGNATURE_GUID_OVMF,
FU_EFI_SIGNATURE_GUID_OVMF_LEGACY,
NULL};
const gchar *valid_owners[] = {FU_EFI_SIGNATURE_GUID_MICROSOFT, NULL};
g_autofree gchar *checksum_last = NULL;
g_autoptr(GPtrArray) sigs = NULL;
struct {
@ -223,10 +221,18 @@ fu_efi_signature_list_get_version(FuEfiSignatureList *self)
sigs = fu_firmware_get_images(FU_FIRMWARE(self));
for (guint i = 0; i < sigs->len; i++) {
FuEfiSignature *sig = g_ptr_array_index(sigs, i);
if (fu_efi_signature_get_kind(sig) != FU_EFI_SIGNATURE_KIND_SHA256)
if (fu_efi_signature_get_kind(sig) != FU_EFI_SIGNATURE_KIND_SHA256) {
if (g_getenv("FWUPD_EFI_SIGNATURE_VERBOSE") != NULL)
g_debug("ignoring dbx certificate");
continue;
if (g_strv_contains(ignored_guids, fu_efi_signature_get_owner(sig)))
}
if (!g_strv_contains(valid_owners, fu_efi_signature_get_owner(sig))) {
if (g_getenv("FWUPD_EFI_SIGNATURE_VERBOSE") != NULL) {
g_debug("ignoring non-Microsoft dbx hash: %s",
fu_efi_signature_get_owner(sig));
}
continue;
}
/* save the last hash in the list */
if (i == sigs->len - 1) {