Richard Hughes 1abb32c623 uefi-dbx: Validate the dbx update is safe to apply ... To do this mount all ESP partitions and check all the binaries there to see if they match any entries in the new dbx. If we applied the update when a hash matched, we would unintentially 'brick' the users machine, as the grub and shim binaries *have* to be updated first. This functionality does reimplement the PE hashing functionality found in sbsigntools and pesign. This was done for 4 main reasons: * There were some memory safety issues found when fuzzing random binaries * Executing the tools hundreds of times was a lot of overhead * Operating from a blob of immutable mmap'd memory is much faster * We only need a very small amount of functionality from both tools		2020-08-17 15:59:02 +01:00
..
fwupdx64.efi	uefi-dbx: Validate the dbx update is safe to apply	2020-08-17 15:59:02 +01:00