Skip to content

Commit 127ef5f

Browse files
FlickdmFlickdm
committed
Keep LegacyFirmwareDefaults.toml around for legacy firmware builds
Until downstream manufacturing processes are updated, keeping a legacy configuration file around for firmware builds. Will update notes indicating that this file is deprecated and will be removed in the future with instructions for how to update the build process.
1 parent eb36a97 commit 127ef5f

2 files changed

Lines changed: 170 additions & 0 deletions

File tree

‎.github/workflows/prepare-binaries.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,9 @@ jobs:
6161
- name: Build Compatible Defaults Template (2023 MSFT + 2023 3P + 2023 OROM)
6262
run: python scripts/secure_boot_default_keys.py --keystore Templates/MicrosoftAndThirdParty.toml -o FirmwareArtifacts
6363

64+
- name: Build X86 / X64 / ARM Binaries
65+
run: python scripts/secure_boot_default_keys.py --keystore Templates/LegacyFirmwareDefaults.toml -o FirmwareArtifacts
66+
6467
- name: Upload Firmware Binaries as Artifacts
6568
uses: actions/upload-artifact@v4
6669
with:

‎Templates/LegacyFirmwareDefaults.toml‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
# @file
2+
##
3+
#
4+
# [IMPORTANT!] This file will be deprecated in the future. This provides a legacy
5+
# configuration for existing downstream firmware that still needs to support Default*
6+
# and a DefaultDbx with a list of revoked certificates. Before Moving to the new
7+
# configurations ensure that your manufacturing process is prepared for the contents
8+
# you move to.
9+
#
10+
# Configuration for building EFI Signature Lists for UEFI Secure Boot
11+
#
12+
# This file will generate the EFI Signature Lists for the UEFI Secure Boot
13+
# following https://uefi.org/specs/UEFI/2.9_A/32_Secure_Boot_and_Driver_Signing.html#signature-database
14+
#
15+
# The Signature Lists are used to store the signature database in the UEFI Secure Boot Database
16+
# Each entry must have a "SignatureOwner" GUID. While the GUID is not required to be unique,
17+
# the Microsoft HLK test will fail if the GUID overlaps with the Microsoft GUID.
18+
# It is recommended to use your own GUID for the SignatureOwner.
19+
#
20+
# #pragma pack(1)
21+
# typedef struct _EFI_SIGNATURE_DATA {
22+
# EFI_GUID SignatureOwner;
23+
# UINT8 SignatureData [_];
24+
# } EFI_SIGNATURE_DATA;
25+
#
26+
# typedef struct _EFI_SIGNATURE_LIST {
27+
# EFI_GUID SignatureType;
28+
# UINT32 SignatureListSize;
29+
# UINT32 SignatureHeaderSize;
30+
# UINT32 SignatureSize;
31+
# // UINT8 SignatureHeader [SignatureHeaderSize];
32+
# // EFI_SIGNATURE_DATA Signatures [__][SignatureSize];
33+
# } EFI_SIGNATURE_LIST;
34+
# #pragma pack()
35+
#
36+
# Each Variable may contain multiple EFI_SIGNATURE_LISTs, each with a different SignatureType.
37+
# Following is the structure of a EFI Signature List:
38+
#
39+
# ---┌─────────────────────────┐
40+
# / │ SIGNATURE LIST HEADER │
41+
# / │ │
42+
# ┌───────────────┐ / │ │
43+
# │ SIGNATURE │ / ├─────────────────────────┤
44+
# │ LIST #0 │ / │ SIGNATURE HEADER │
45+
# │ │ / │ │
46+
# │ │ / ├─────────────────────────┤
47+
# ├───────────────┤ / │ SIGNATURE #0 │
48+
# │ SIGNATURE │ / │ │
49+
# │ LIST #1 │ / ├─────────────────────────┤
50+
# ├───────────────┤/ │ SIGNATURE #1 │
51+
# │ SIGNATURE │ │ │
52+
# │ LIST #2 │ ├─────────────────────────┤
53+
# │ │ │ │
54+
# │ │ │ │
55+
# │ │ │ │
56+
# │ │ │ │
57+
# │ │ │ │
58+
# │ │ ├─────────────────────────┤
59+
# │ │ │ SIGNATURE #N │
60+
# └───────────────┘\ │ │
61+
# \____________└─────────────────────────┘
62+
#
63+
# Note:
64+
# Powershell:
65+
# Use the following command to compute the SHA1 hash of a file:
66+
# > Get-FileHash -Algorithm SHA1 <file>
67+
#
68+
# Bash:
69+
# Use the following command to compute the SHA1 hash of a file:
70+
# > sha1sum <file>
71+
#
72+
# Copyright (C) Microsoft Corporation
73+
# SPDX-License-Identifier: BSD-2-Clause-Patent
74+
##
75+
############################
76+
# Default PK File Entry #
77+
############################
78+
[DefaultPk]
79+
help = "Contains the Microsoft PK to enable signature database updates and binary execution."
80+
81+
[[DefaultPk.files]]
82+
path = "PreSignedObjects/PK/Certificate/WindowsOEMDevicesPK.der"
83+
sha1 = 0x3D8660C0CB2D57B189C3D7995572A552F75E48B5
84+
signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
85+
86+
############################
87+
# Default Kek File Entries #
88+
############################
89+
[DefaultKek]
90+
help = "Contains the Microsoft KEKs to enable signature database updates and binary execution."
91+
92+
[[DefaultKek.files]]
93+
path = "PreSignedObjects/KEK/Certificates/MicCorKEKCA2011_2011-06-24.der"
94+
url = "https://go.microsoft.com/fwlink/?LinkId=321185"
95+
sha1 = 0x31590bfd89c9d74ed087dfac66334b3931254b30
96+
signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
97+
98+
[[DefaultKek.files]]
99+
path = "PreSignedObjects/KEK/Certificates/microsoft corporation kek 2k ca 2023.der"
100+
url = "https://go.microsoft.com/fwlink/?linkid=2239775"
101+
sha1 = 0x459ab6fb5e284d272d5e3e6abc8ed663829d632b
102+
signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
103+
104+
###########################
105+
# Default Db File Entries #
106+
###########################
107+
[DefaultDb]
108+
help = "Contains only Microsoft certificates to verify binaries before execution. More secure than Default3PDb."
109+
110+
[[DefaultDb.files]]
111+
path = "PreSignedObjects/DB/Certificates/MicWinProPCA2011_2011-10-19.der"
112+
url = "https://go.microsoft.com/fwlink/p/?linkid=321192"
113+
sha1 = 0x580a6f4cc4e4b669b9ebdc1b2b3e087b80d0678d
114+
signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
115+
116+
[[DefaultDb.files]]
117+
path = "PreSignedObjects/DB/Certificates/windows uefi ca 2023.der"
118+
url = "https://go.microsoft.com/fwlink/?linkid=2239776"
119+
sha1 = 0x45a0fa32604773c82433c3b7d59e7466b3ac0c67
120+
signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
121+
122+
#####################################
123+
# Default 3rd Party Db File Entries #
124+
#####################################
125+
[Default3PDb]
126+
help = "Contains Microsoft and UEFI third party certificates to verify binaries before execution. More compatible than DefaultDb."
127+
128+
[[Default3PDb.files]]
129+
path = "PreSignedObjects/DB/Certificates/MicWinProPCA2011_2011-10-19.der"
130+
url = "https://go.microsoft.com/fwlink/p/?linkid=321192"
131+
sha1 = 0x580a6f4cc4e4b669b9ebdc1b2b3e087b80d0678d
132+
signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
133+
134+
[[Default3PDb.files]]
135+
path = "PreSignedObjects/DB/Certificates/windows uefi ca 2023.der"
136+
url = "https://go.microsoft.com/fwlink/?linkid=2239776"
137+
sha1 = 0x45a0fa32604773c82433c3b7d59e7466b3ac0c67
138+
signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
139+
140+
[[Default3PDb.files]]
141+
path = "PreSignedObjects/DB/Certificates/MicCorUEFCA2011_2011-06-27.der"
142+
url = "https://go.microsoft.com/fwlink/p/?linkid=321194"
143+
sha1 = 0x46def63b5ce61cf8ba0de2e6639c1019d0ed14f3
144+
signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
145+
146+
[[Default3PDb.files]]
147+
path = "PreSignedObjects/DB/Certificates/microsoft uefi ca 2023.der"
148+
url = "https://go.microsoft.com/fwlink/?linkid=2239872"
149+
sha1 = 0xb5eeb4a6706048073f0ed296e7f580a790b59eaa
150+
signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
151+
152+
[[Default3PDb.files]]
153+
path = "PreSignedObjects/DB/Certificates/microsoft option rom uefi ca 2023.der"
154+
url = "http://www.microsoft.com/pkiops/certs/microsoft%20option%20rom%20uefi%20ca%202023.crt"
155+
sha1 = 0x3FB39E2B8BD183BF9E4594E72183CA60AFCD4277
156+
signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
157+
158+
############################
159+
# Default Dbx File Entries #
160+
############################
161+
[DefaultDbx]
162+
help = "Contains a list of revoked certificates that will not execute on this system. Filtered per Architecture (ARM, Intel)."
163+
164+
[[DefaultDbx.files]]
165+
path = "PreSignedObjects/DBX/dbx_info_msft_1_14_25.json"
166+
sha1 = 0xE0241D2F36A26F3668E7AEF287F726D0CE19CA80
167+
signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"

0 commit comments

Comments
 (0)