Remove $FreeBSD$: one-line sh patternRemove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/
Remove $FreeBSD$: one-line .c patternRemove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
Update libsecurebootPreparation for updating bearssl, pull in updates to libsecureboot.o fix handling of some out-of-memory caseso allow more control over reporting of Verified/Unverified files
Update libsecurebootPreparation for updating bearssl, pull in updates to libsecureboot.o fix handling of some out-of-memory caseso allow more control over reporting of Verified/Unverified files. this helps boot time when console output is slow o recheck verbose/debug level after reading any unverified fileo more debug support for vectxo hash_string to support fake stat for tftpo tests/tvo add -v to simply verify signatureso vets.c allow for HAVE_BR_X509_TIME_CHECK which will greatly simplify verification in loadero report date when certificate fails validity period checksReviewed by: stevekSponsored by: Juniper Networks, Inc.
show more ...
veloader use vectx API for kernel and modulesThe vectx API, computes the hash for verifying a file as it is read.This avoids the overhead of reading files twice - once to verify, thenagain to loa
veloader use vectx API for kernel and modulesThe vectx API, computes the hash for verifying a file as it is read.This avoids the overhead of reading files twice - once to verify, thenagain to load.For doing an install via loader, avoiding the need to rewindlarge files is critical.This API is only used for modules, kernel and mdimage as these are thebiggest files read by the loader.The reduction in boot time depends on how expensive the I/O ison any given platform. On a fast VM we see 6% improvement.For install via loader the first file to be verified is likely to be thekernel, so some of the prep work (finding manifest etc) done byverify_file() needs to be factored so it can be reused forvectx_open().For missing or unrecognized fingerprint entries, we failin vectx_open() unless verifying is disabled.Otherwise fingerprint check happens in vectx_close() andsince this API is only used for files which must be verified(VE_MUST) we panic if we get an incorrect hash.Reviewed by: imp,tsoomeMFC after: 1 weekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org//D23827
libsecureboot: allow control of when pseudo pcr is updatedDuring boot we only want to measure things which *must*be verified - this should provide more deterministic ordering.Reviewed by: stevek
libsecureboot: allow control of when pseudo pcr is updatedDuring boot we only want to measure things which *must*be verified - this should provide more deterministic ordering.Reviewed by: stevekMFC after: 1 weekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D20297
libsecureboot: make it easier to customize trust anchorsAvoid making hash self-tests depend on X.509 certs.Include OpenPGP keys in trust store count.Reviewed by: stevekMFC after: 1 weekSponsor
libsecureboot: make it easier to customize trust anchorsAvoid making hash self-tests depend on X.509 certs.Include OpenPGP keys in trust store count.Reviewed by: stevekMFC after: 1 weekSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D20208
Allow for reproducible buildUse SOURCE_DATE_EPOCH for BUILD_UTC if MK_REPRODUCIBLE_BUILD is yes.Default SOURCE_DATE_EPOCH to 2019-01-01Reviewed by: emasteSponsored by: Juniper NetworksDifferen
Allow for reproducible buildUse SOURCE_DATE_EPOCH for BUILD_UTC if MK_REPRODUCIBLE_BUILD is yes.Default SOURCE_DATE_EPOCH to 2019-01-01Reviewed by: emasteSponsored by: Juniper NetworksDifferential Revision: https://reviews.freebsd.org/D19464
Add libsecurebootUsed by loader and veriexecDepends on libbearsslReviewed by: emasteSponsored by: Juniper NetworksDifferential Revision: D16335