4 commits

Author	SHA1	Message	Date
Simon J. Gerraty	f9510887ee	libsecureboot: allow OpenPGP support to be dormant ... Since we can now add OpenPGP trust anchors at runtime, ensure the latent support is available. Ensure we do not add duplicate keys to trust store. Also allow reporting names of trust anchors added/revoked We only do this for loader and only after initializing trust store. Thus only changes to initial trust store will be logged. Reviewed by: stevek MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D20700	2019-06-26 23:33:32 +00:00
Simon J. Gerraty	980bde5834	libsecureboot: allow control of when pseudo pcr is updated ... During boot we only want to measure things which *must* be verified - this should provide more deterministic ordering. Reviewed by: stevek MFC after: 1 week Sponsored by: Juniper Networks Differential Revision: https://reviews.freebsd.org/D20297	2019-05-19 20:28:49 +00:00
Simon J. Gerraty	64ca9a7ff6	Allow no_hash to appear in manifest. ... sbin/veriexec will ignore entries that have no hash anyway, but loader needs to be explicitly told that such files are ok to ignore (not verify). We will report as Unverified depending on verbose level, but with no reason - because we are not rejecting the file. Reviewed by: imp, mindal_semihalf Sponsored by: Juniper Networks MFC After: 1 week Differential Revision: https://reviews.freebsd.org//D20018	2019-04-23 20:25:25 +00:00
Simon J. Gerraty	5fff9558a4	Add libsecureboot ... Used by loader and veriexec Depends on libbearssl Reviewed by: emaste Sponsored by: Juniper Networks Differential Revision: D16335	2019-02-26 06:09:10 +00:00