| Message ID | 20240313150748.791236-8-ross.lagerwall@citrix.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | GRUB: Supporting Secure Boot of xen.gz | expand |
On Wed, Mar 13, 2024 at 03:07:48PM +0000, Ross Lagerwall via Grub-devel wrote: > It is convenient and common to have binaries stored in gzip archives > (e.g. xen.gz). Verification should be run after decompression rather > than before so reorder the file filter list as appropriate. The proposed change would result in the disruption of the tpm and pgp clients within the verifier framework. Specifically, the tpm pcr prediction software relies on the integrity of raw files rather than decompressed ones. Additionally, pgp detached signatures are designed to target original files, thus necessitating the current structure to maintain functionality. Thanks, Michael > > Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> > --- > include/grub/file.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/include/grub/file.h b/include/grub/file.h > index a5bf3a792d6f..a1ef3582bc7b 100644 > --- a/include/grub/file.h > +++ b/include/grub/file.h > @@ -182,10 +182,10 @@ extern grub_disk_read_hook_t EXPORT_VAR(grub_file_progress_hook); > /* Filters with lower ID are executed first. */ > typedef enum grub_file_filter_id > { > - GRUB_FILE_FILTER_VERIFY, > GRUB_FILE_FILTER_GZIO, > GRUB_FILE_FILTER_XZIO, > GRUB_FILE_FILTER_LZOPIO, > + GRUB_FILE_FILTER_VERIFY, > GRUB_FILE_FILTER_MAX, > GRUB_FILE_FILTER_COMPRESSION_FIRST = GRUB_FILE_FILTER_GZIO, > GRUB_FILE_FILTER_COMPRESSION_LAST = GRUB_FILE_FILTER_LZOPIO, > -- > 2.43.0 > > > _______________________________________________ > Grub-devel mailing list > Grub-devel@gnu.org > https://lists.gnu.org/mailman/listinfo/grub-devel
diff --git a/include/grub/file.h b/include/grub/file.h index a5bf3a792d6f..a1ef3582bc7b 100644 --- a/include/grub/file.h +++ b/include/grub/file.h @@ -182,10 +182,10 @@ extern grub_disk_read_hook_t EXPORT_VAR(grub_file_progress_hook); /* Filters with lower ID are executed first. */ typedef enum grub_file_filter_id { - GRUB_FILE_FILTER_VERIFY, GRUB_FILE_FILTER_GZIO, GRUB_FILE_FILTER_XZIO, GRUB_FILE_FILTER_LZOPIO, + GRUB_FILE_FILTER_VERIFY, GRUB_FILE_FILTER_MAX, GRUB_FILE_FILTER_COMPRESSION_FIRST = GRUB_FILE_FILTER_GZIO, GRUB_FILE_FILTER_COMPRESSION_LAST = GRUB_FILE_FILTER_LZOPIO,
It is convenient and common to have binaries stored in gzip archives (e.g. xen.gz). Verification should be run after decompression rather than before so reorder the file filter list as appropriate. Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> --- include/grub/file.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)