src/lib/libsecureboot/tests, branch main FreeBSD source tree Pass severity to vectx_open() rather than vectx_close() 2026-04-10T17:46:54+00:00 Simon J. Gerraty sjg@FreeBSD.org 2026-04-10T17:43:15+00:00 35bbdfad28626255c63360d98c45e41f2c692ef0 file_loadraw() can have a need to load unverified files like "dtrace_dof". Allow severity_guess() to look at the filename but if it returns less than VE_MUST check that the type is not one we insist on verifying. In vectx_open if severity < VE_MUST we can allow it to be unverified. If passed VE_GUESS we call severity_guess(). Regardless, we record severity in ctx so it is available to vectx_close(). Sponsored by: Hewlett Packard Enterprise Development LP Reviewed by: khng Differential Revision: https://reviews.freebsd.org/D56297 
file_loadraw() can have a need to load unverified files
like "dtrace_dof".  Allow severity_guess() to look at the filename
but if it returns less than VE_MUST check that the type is not
one we insist on verifying.

In vectx_open if severity < VE_MUST we can allow it to be unverified.
If passed VE_GUESS we call severity_guess().
Regardless, we record severity in ctx so it is available to vectx_close().

Sponsored by: Hewlett Packard Enterprise Development LP

Reviewed by:	khng
Differential Revision:	https://reviews.freebsd.org/D56297
Remove residual blank line at start of Makefile 2024-07-15T22:43:39+00:00 Warner Losh imp@FreeBSD.org 2024-07-15T04:46:32+00:00 e9ac41698b2f322d55ccf9da50a3596edb2c1800 This is a residual of the $FreeBSD$ removal. MFC After: 3 days (though I'll just run the command on the branches) Sponsored by: Netflix 
This is a residual of the $FreeBSD$ removal.

MFC After: 3 days (though I'll just run the command on the branches)
Sponsored by: Netflix
Remove $FreeBSD$: one-line sh pattern 2023-08-16T17:55:03+00:00 Warner Losh imp@FreeBSD.org 2023-08-16T17:55:03+00:00 d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ 
Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
Remove $FreeBSD$: one-line .c pattern 2023-08-16T17:54:42+00:00 Warner Losh imp@FreeBSD.org 2023-08-16T17:54:42+00:00 1d386b48a555f61cb7325543adbbb5c3f3407a66 Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/ 
Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
Update libsecureboot 2022-04-18T19:54:15+00:00 Simon J. Gerraty sjg@FreeBSD.org 2022-04-18T19:53:53+00:00 666554111a7e6b4c1a9a6ff2e73f12cd582573bb Preparation for updating bearssl, pull in updates to libsecureboot. o fix handling of some out-of-memory cases o allow more control over reporting of Verified/Unverified files. this helps boot time when console output is slow o recheck verbose/debug level after reading any unverified file o more debug support for vectx o hash_string to support fake stat for tftp o tests/tvo add -v to simply verify signatures o vets.c allow for HAVE_BR_X509_TIME_CHECK which will greatly simplify verification in loader o report date when certificate fails validity period checks Reviewed by: stevek Sponsored by: Juniper Networks, Inc. 
Preparation for updating bearssl, pull in updates to libsecureboot.

o fix handling of some out-of-memory cases

o allow more control over reporting of Verified/Unverified files.
  this helps boot time when console output is slow

  o recheck verbose/debug level after reading any unverified file

o more debug support for vectx

o hash_string to support fake stat for tftp

o tests/tvo add -v to simply verify signatures

o vets.c allow for HAVE_BR_X509_TIME_CHECK which will greatly simplify
  verification in loader

o report date when certificate fails validity period checks

Reviewed by: stevek
Sponsored by: Juniper Networks, Inc.
veloader use vectx API for kernel and modules 2020-03-08T17:42:42+00:00 Simon J. Gerraty sjg@FreeBSD.org 2020-03-08T17:42:42+00:00 afc571b1a6fb341b0e3f603d4f3a2538093e91f5 The vectx API, computes the hash for verifying a file as it is read. This avoids the overhead of reading files twice - once to verify, then again to load. For doing an install via loader, avoiding the need to rewind large files is critical. This API is only used for modules, kernel and mdimage as these are the biggest files read by the loader. The reduction in boot time depends on how expensive the I/O is on any given platform. On a fast VM we see 6% improvement. For install via loader the first file to be verified is likely to be the kernel, so some of the prep work (finding manifest etc) done by verify_file() needs to be factored so it can be reused for vectx_open(). For missing or unrecognized fingerprint entries, we fail in vectx_open() unless verifying is disabled. Otherwise fingerprint check happens in vectx_close() and since this API is only used for files which must be verified (VE_MUST) we panic if we get an incorrect hash. Reviewed by: imp,tsoome MFC after: 1 week Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org//D23827 
The vectx API, computes the hash for verifying a file as it is read.
This avoids the overhead of reading files twice - once to verify, then
again to load.

For doing an install via loader, avoiding the need to rewind
large files is critical.

This API is only used for modules, kernel and mdimage as these are the
biggest files read by the loader.
The reduction in boot time depends on how expensive the I/O is
on any given platform.  On a fast VM we see 6% improvement.

For install via loader the first file to be verified is likely to be the
kernel, so some of the prep work (finding manifest etc) done by
verify_file() needs to be factored so it can be reused for
vectx_open().

For missing or unrecognized fingerprint entries, we fail
in vectx_open() unless verifying is disabled.

Otherwise fingerprint check happens in vectx_close() and
since this API is only used for files which must be verified
(VE_MUST) we panic if we get an incorrect hash.

Reviewed by:	imp,tsoome
MFC after:	1 week
Sponsored by:	Juniper Networks
Differential Revision:	https://reviews.freebsd.org//D23827
libsecureboot: allow control of when pseudo pcr is updated 2019-05-19T20:28:49+00:00 Simon J. Gerraty sjg@FreeBSD.org 2019-05-19T20:28:49+00:00 980bde58344a6b226ed1618e3dcc22271e10cfa3 During boot we only want to measure things which *must* be verified - this should provide more deterministic ordering. Reviewed by: stevek MFC after: 1 week Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D20297 
During boot we only want to measure things which *must*
be verified - this should provide more deterministic ordering.

Reviewed by:	stevek
MFC after:	1 week
Sponsored by:	Juniper Networks
Differential Revision:	https://reviews.freebsd.org/D20297
libsecureboot: make it easier to customize trust anchors 2019-05-09T22:25:12+00:00 Simon J. Gerraty sjg@FreeBSD.org 2019-05-09T22:25:12+00:00 9bee6a6083228d0e6abfb991fdbb4edf020fd438 Avoid making hash self-tests depend on X.509 certs. Include OpenPGP keys in trust store count. Reviewed by: stevek MFC after: 1 week Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D20208 
Avoid making hash self-tests depend on X.509 certs.
Include OpenPGP keys in trust store count.

Reviewed by:	stevek
MFC after:	1 week
Sponsored by:	Juniper Networks
Differential Revision:	https://reviews.freebsd.org/D20208
Allow for reproducible build 2019-03-04T22:04:21+00:00 Simon J. Gerraty sjg@FreeBSD.org 2019-03-04T22:04:21+00:00 02a4bc589cb28479993057372d74f26a7c3fce84 Use SOURCE_DATE_EPOCH for BUILD_UTC if MK_REPRODUCIBLE_BUILD is yes. Default SOURCE_DATE_EPOCH to 2019-01-01 Reviewed by: emaste Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D19464 
Use SOURCE_DATE_EPOCH for BUILD_UTC if MK_REPRODUCIBLE_BUILD is yes.
Default SOURCE_DATE_EPOCH to 2019-01-01

Reviewed by:	emaste
Sponsored by:	Juniper Networks
Differential Revision:	https://reviews.freebsd.org/D19464
Add libsecureboot 2019-02-26T06:09:10+00:00 Simon J. Gerraty sjg@FreeBSD.org 2019-02-26T06:09:10+00:00 5fff9558a43aaac53da41dc23c250c4e84f6fb02 Used by loader and veriexec Depends on libbearssl Reviewed by: emaste Sponsored by: Juniper Networks Differential Revision: D16335 
Used by loader and veriexec
Depends on libbearssl

Reviewed by:	emaste
Sponsored by:	Juniper Networks
Differential Revision:	D16335