pip: bump lcov-cobertura from 2.0.2 to 2.1.1

.conform.yaml

@@ -0,0 +1,16 @@
+---
+policies:
+  - type: commit
+    spec:
+      header:
+        length: 80
+        imperative: false
+        invalidLastCharacters: .
+      body:
+        required: false
+      dco: true
+      gpg:
+        required: true
+      spellcheck:
+        locale: US
+      maximumOfOneCommit: false

.github/scripts/build-ipxe.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+export CROSS_COMPILE="x86_64-elf-"
+make -C src bin-x86_64-efi-sb/ipxe.efi EMBED=$PWD/dasharo.ipxe BUILD_ID_CMD="echo 0x1234567890" \
+  EXTRA_CFLAGS="-Wno-address-of-packed-member  -m64  -fuse-ld=bfd \
+  -Wl,--build-id=none -fno-delete-null-pointer-checks -Wlogical-op -march=nocona \
+  -malign-data=abi -mcmodel=large -mno-red-zone -fno-pic"
+

.github/scripts/build-qemu.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+
+make -C BaseTools
+source ./edksetup.sh
+
+export EDK2_PLATFORMS_PATH="$WORKSPACE/edk2-platforms"
+export PACKAGES_PATH="$WORKSPACE:\
+$WORKSPACE/ipxe/src/bin-x86_64-efi-sb:\
+$EDK2_PLATFORMS_PATH/Platform/Intel:\
+$EDK2_PLATFORMS_PATH/Silicon/Intel:\
+$EDK2_PLATFORMS_PATH/Features/Intel:\
+$EDK2_PLATFORMS_PATH/Features/Intel/Debugging:\
+$EDK2_PLATFORMS_PATH/Features/Intel/Network:\
+$EDK2_PLATFORMS_PATH/Features/Intel/OutOfBandManagement:\
+$EDK2_PLATFORMS_PATH/Features/Intel/PowerManagement:\
+$EDK2_PLATFORMS_PATH/Features/Intel/SystemInformation:\
+$EDK2_PLATFORMS_PATH/Features/Intel/UserInterface"
+
+build -a IA32 -a X64 -t GCC5 -b RELEASE -p OvmfPkg/OvmfPkgX64.dsc
+build -a IA32 -a X64 -t GCC5 -b DEBUG -p OvmfPkg/OvmfPkgX64.dsc

.github/scripts/run-qemu.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+cp ./Build/OvmfX64/RELEASE_GCC5/FV/OVMF_VARS.fd /tmp/OVMF_VARS.fd 
+
+q35_params="-machine q35,smm=on \
+    -global driver=cfi.pflash01,property=secure,value=on \
+    -drive if=pflash,format=raw,unit=0,file=Build/OvmfX64/RELEASE_GCC5/FV/OVMF_CODE.fd,readonly=on \
+    -drive if=pflash,format=raw,unit=1,file=/tmp/OVMF_VARS.fd \
+    -debugcon file:debug.log -global isa-debugcon.iobase=0x402 \
+    -global ICH9-LPC.disable_s3=1 \
+    -qmp unix:/tmp/qmp-socket,server,nowait \
+    -net none \
+    -serial telnet:localhost:1234,server,nowait"
+
+if [ "$1" == "nographic" ]; then
+    qemu-system-x86_64 $q35_params -nographic
+else
+    qemu-system-x86_64 $q35_params
+fi

.github/workflows/build.yml

@@ -0,0 +1,95 @@
+name: Check EDK2 QEMU Build
+
+on:
+  push:
+    branches:
+      - dasharo
+    tags:
+      - 'qemu_q35_v*'
+  pull_request:
+    branches:
+      - dasharo
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout Code
+      uses: actions/checkout@v2
+      with:
+        submodules: 'recursive'  # Checkout submodules recursively.
+
+    - name: Clone edk2-platforms Repository
+      run: |
+        git clone https://github.com/Dasharo/edk2-platforms.git && \
+        cd edk2-platforms && \
+        git checkout 3323ed481d35096fb6a7eae7b49f35eff00f86cf && \
+        cd -
+
+    - name: Clone iPXE Repository
+      run: |
+        git clone https://git.ipxe.org/ipxe.git && \
+        cd ipxe && \
+        git checkout e9a23a5b394f40c1525c40416105eaaa1787f749 && \
+        sed -i 's|//#define\s*IMAGE_SCRIPT.*|#define IMAGE_SCRIPT|' "src/config/general.h" && \
+        sed -i 's|.*DOWNLOAD_PROTO_HTTPS|#define DOWNLOAD_PROTO_HTTPS|g'  "src/config/general.h" && \
+        wget https://raw.githubusercontent.com/Dasharo/dasharo-blobs/main/dasharo/dasharo.ipxe && \
+        cd -
+
+    - name: Build iPXE
+      run: |
+        docker run --rm -i -v $PWD/ipxe:/home/coreboot/ipxe:rw \
+          -v $PWD/.github:/home/coreboot/ipxe/.github \
+          -u $(id -u):$(id -g) -w /home/coreboot/ipxe \
+          coreboot/coreboot-sdk:2024-02-18_732134932b \
+         ./.github/scripts/build-ipxe.sh
+
+    - name: Build OVMF Firmware Image
+      run: |
+        docker run --rm -i -v $PWD:/home/coreboot/coreboot:rw \
+          -u $(id -u):$(id -g) -w /home/coreboot/coreboot \
+          coreboot/coreboot-sdk:2024-02-18_732134932b \
+         ./.github/scripts/build-qemu.sh
+
+    - name: Check RELEASE build Artifacts
+      run: |
+        if [ -f "Build/OvmfX64/RELEASE_GCC5/FV/OVMF_CODE.fd" ] && [ -f "Build/OvmfX64/RELEASE_GCC5/FV/OVMF_VARS.fd" ]; then
+          echo "RELEASE build successful. OVMF firmware image files found."
+          cp Build/OvmfX64/RELEASE_GCC5/FV/OVMF_CODE.fd OVMF_CODE_RELEASE.fd
+          cp Build/OvmfX64/RELEASE_GCC5/FV/OVMF_VARS.fd OVMF_VARS_RELEASE.fd
+        else
+          echo "RELEASE build failed. OVMF firmware image files not found."
+          exit 1
+        fi
+
+    - name: Check DEBUG build Artifacts
+      run: |
+        if [ -f "Build/OvmfX64/DEBUG_GCC5/FV/OVMF_CODE.fd" ] && [ -f "Build/OvmfX64/DEBUG_GCC5/FV/OVMF_VARS.fd" ]; then
+          echo "DEBUG build successful. OVMF firmware image files found."
+          cp Build/OvmfX64/DEBUG_GCC5/FV/OVMF_CODE.fd OVMF_CODE_DEBUG.fd
+          cp Build/OvmfX64/DEBUG_GCC5/FV/OVMF_VARS.fd OVMF_VARS_DEBUG.fd
+        else
+          echo "DEBUG build failed. OVMF firmware image files not found."
+          exit 1
+        fi
+
+    - name: Upload Artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: ovmf-artifacts  # Name for the artifact
+        path: |
+          OVMF_CODE_RELEASE.fd
+          OVMF_VARS_RELEASE.fd
+          OVMF_CODE_DEBUG.fd
+          OVMF_VARS_DEBUG.fd
+
+    - name: Create GitHub Release
+      uses: softprops/action-gh-release@v1
+      if: startsWith(github.event.ref, 'refs/tags/qemu')
+      with:
+        files: |
+          OVMF_CODE_RELEASE.fd
+          OVMF_VARS_RELEASE.fd
+          OVMF_CODE_DEBUG.fd
+          OVMF_VARS_DEBUG.fd

.github/workflows/dbx.yml

@@ -0,0 +1,33 @@
+name: Check if UEFI revocation list is up-to-date
+
+on:
+  push:
+    branches:
+      - dasharo
+  pull_request:
+    branches:
+      - dasharo
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout Code
+      uses: actions/checkout@v2
+
+    - name: Check if DBX is up-to-date
+      run: |
+        echo 'Fetching DBX from Microsoft Secure Boot GitHub repository'
+        wget https://github.com/microsoft/secureboot_objects/raw/refs/heads/main/PostSignedObjects/DBX/amd64/DBXUpdate.bin -o /dev/null
+        if [ $? -ne 0 ]; then
+          echo 'Failed to fetch latest DBX.'
+          exit 1
+        fi
+        diff <(sha256sum DBXUpdate.bin | awk '{ print $1 }') <(sha256sum DasharoPayloadPkg/SecureBootDefaultKeys/DBXUpdate.bin | awk '{ print $1 }')
+        if [ $? -ne 0 ]; then
+          echo 'UEFI DBX is out of date.'
+          exit 1
+        else
+          echo 'UEFI DBX is up-to-date.'
+        fi

.gitmodules

@@ -16,7 +16,7 @@
 [submodule "BaseTools/Source/C/BrotliCompress/brotli"]
 	path = BaseTools/Source/C/BrotliCompress/brotli
 	url = https://github.com/google/brotli
-	ignore = untracked
+	ignore = untracked
 [submodule "RedfishPkg/Library/JsonLib/jansson"]
 	path = RedfishPkg/Library/JsonLib/jansson
 	url = https://github.com/akheron/jansson
@@ -25,13 +25,16 @@
 	url = https://github.com/google/googletest.git
 [submodule "UnitTestFrameworkPkg/Library/SubhookLib/subhook"]
 	path = UnitTestFrameworkPkg/Library/SubhookLib/subhook
-	url = https://github.com/Zeex/subhook.git
-[submodule "MdePkg/Library/BaseFdtLib/libfdt"]
-	path = MdePkg/Library/BaseFdtLib/libfdt
-	url = https://github.com/devicetree-org/pylibfdt.git
+	url = https://github.com/Dasharo/subhook.git
+[submodule "MdePkg/Library/BaseFdtLib/libfdt"]
+	path = MdePkg/Library/BaseFdtLib/libfdt
+	url = https://github.com/devicetree-org/pylibfdt.git
 [submodule "MdePkg/Library/MipiSysTLib/mipisyst"]
 	path = MdePkg/Library/MipiSysTLib/mipisyst
 	url = https://github.com/MIPI-Alliance/public-mipi-sys-t.git
 [submodule "CryptoPkg/Library/MbedTlsLib/mbedtls"]
 	path = CryptoPkg/Library/MbedTlsLib/mbedtls
 	url = https://github.com/ARMmbed/mbedtls
+[submodule "CrScreenshotDxe"]
+	path = CrScreenshotDxe
+	url = https://github.com/LongSoft/CrScreenshotDxe.git

.pre-commit-config.yaml

@@ -0,0 +1,40 @@
+---
+default_stages: [pre-commit]
+
+default_install_hook_types: [pre-commit, commit-msg]
+
+ci:
+  autoupdate_commit_msg: 'pre-commit: autoupdate hooks'
+  autofix_prs: false
+
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.4.0
+    hooks:
+      - id: check-added-large-files
+        files: ^DasharoModulePkg/
+      - id: check-merge-conflict
+        files: ^DasharoModulePkg/
+      - id: check-symlinks
+        files: ^DasharoModulePkg/
+      - id: detect-private-key
+        files: ^DasharoModulePkg/
+      - id: end-of-file-fixer
+        files: ^DasharoModulePkg/
+      - id: trailing-whitespace
+        files: ^DasharoModulePkg/
+      - id: mixed-line-ending
+        files: ^DasharoModulePkg/
+
+  - repo: https://github.com/talos-systems/conform
+    rev: v0.1.0-alpha.27
+    hooks:
+      - id: conform
+        stages:
+          - commit-msg
+
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.2.5
+    hooks:
+      - id: codespell
+        files: ^DasharoModulePkg/

BaseTools/Source/C/Makefiles/header.makefile

@@ -104,7 +104,7 @@ else
 CFLAGS = -MD -fshort-wchar -fno-strict-aliasing -fwrapv \
 -fno-delete-null-pointer-checks -Wall -Werror \
 -Wno-deprecated-declarations -Wno-stringop-truncation -Wno-restrict \
--Wno-unused-result -nostdlib -g
+-Wno-unused-result -nostdlib -g -Wno-vla-parameter -Wno-stringop-overflow -Wno-use-after-free -Wno-dangling-pointer
 endif
 endif
 ifneq ($(CLANG),)

BaseTools/Source/Python/Capsule/GenerateCapsule.py

@@ -513,11 +513,15 @@ def Validate(self, args):
                         raise argparse.ArgumentTypeError ('JSON field MonotonicCount must be an integer in range 0x0..0xffffffffffffffff')
                     else:
                         raise argparse.ArgumentTypeError ('--monotonic-count must be an integer in range 0x0..0xffffffffffffffff')
-                if self.UpdateImageIndex >0xFF:
+                if self.UpdateImageIndex < 0x1 or self.UpdateImageIndex > 0xFF:
                     if args.JsonFile:
-                        raise argparse.ArgumentTypeError ('JSON field UpdateImageIndex must be an integer in range 0x0..0xff')
+                        raise argparse.ArgumentTypeError ('JSON field UpdateImageIndex must be an integer in range 0x1..0xff')
                     else:
-                        raise argparse.ArgumentTypeError ('--update-image-index must be an integer in range 0x0..0xff')
+                        raise argparse.ArgumentTypeError ('--update-image-index must be an integer in range 0x1..0xff')
+
+            if args.Decode:
+                if args.OutputFile is None:
+                    raise argparse.ArgumentTypeError ('--decode requires --output')
 
             if self.UseSignTool:
                 if self.SignToolPfxFile is not None:
@@ -576,7 +580,7 @@ def Encode (PayloadDescriptorList, EmbeddedDriverDescriptorList, Buffer):
             try:
                 SinglePayloadDescriptor.Validate (args)
             except Exception as Msg:
-                print ('GenerateCapsule: error:' + str(Msg))
+                print ('GenerateCapsule: error: ' + str(Msg))
                 sys.exit (1)
         for SinglePayloadDescriptor in PayloadDescriptorList:
             ImageCapsuleSupport = 0x0000000000000000
@@ -690,7 +694,7 @@ def Decode (PayloadDescriptorList, PayloadJsonDescriptorList, Buffer):
                                             args.HardwareInstance,
                                             args.UpdateImageIndex,
                                             args.SignToolPfxFile,
-                                            args.SignSubjectName,
+                                            args.SignToolSubjectName,
                                             args.OpenSslSignerPrivateCertFile,
                                             args.OpenSslOtherPublicCertFile,
                                             args.OpenSslTrustedPublicCertFile,
@@ -704,7 +708,7 @@ def Decode (PayloadDescriptorList, PayloadJsonDescriptorList, Buffer):
             try:
                 SinglePayloadDescriptor.Validate (args)
             except Exception as Msg:
-                print ('GenerateCapsule: error:' + str(Msg))
+                print ('GenerateCapsule: error: ' + str(Msg))
                 sys.exit (1)
         try:
             Result = UefiCapsuleHeader.Decode (Buffer)
@@ -827,7 +831,7 @@ def Decode (PayloadDescriptorList, PayloadJsonDescriptorList, Buffer):
                             print ('--------')
                             print ('No EFI_FIRMWARE_IMAGE_AUTHENTICATION')
 
-                    PayloadSignature = struct.unpack ('<I', SinglePayloadDescriptor.Payload[0:4])
+                    (PayloadSignature,) = struct.unpack ('<I', SinglePayloadDescriptor.Payload[0:4])
                     if PayloadSignature != FmpPayloadHeader.Signature:
                         SinglePayloadDescriptor.UseDependency = True
                         try:
@@ -873,8 +877,8 @@ def Decode (PayloadDescriptorList, PayloadJsonDescriptorList, Buffer):
                         print ('GenerateCapsule: error: can not write embedded driver file {File}'.format (File = EmbeddedDriverPath))
                         sys.exit (1)
 
-        except:
-            print ('GenerateCapsule: error: can not decode capsule')
+        except Exception as Msg:
+            print ('GenerateCapsule: error: can not decode capsule: ' + str(Msg))
             sys.exit (1)
         GenerateOutputJson(PayloadJsonDescriptorList)
         PayloadIndex = 0
@@ -914,7 +918,7 @@ def DumpInfo (Buffer, args):
                         print ('--------')
                         print ('No EFI_FIRMWARE_IMAGE_AUTHENTICATION')
 
-                    PayloadSignature = struct.unpack ('<I', Result[0:4])
+                    (PayloadSignature,) = struct.unpack ('<I', Result[0:4])
                     if PayloadSignature != FmpPayloadHeader.Signature:
                         try:
                             Result = CapsuleDependency.Decode (Result)