Python eventlog parsing for measured boot attestation #97
Conversation
Signed-off-by: George Almasi <gheorghe@us.ibm.com>
Signed-off-by: George Almasi <gheorghe@us.ibm.com>
| types of events), the event log parser is already doing so. NB we are | ||
| not aware of the `tpm2-tools` based event log parser doing any | ||
| self-checking. And of course the python based event log parser is | ||
| capable of generating PCR reference values in the same way | ||
| as `tpm2-tools`. |
There was a problem hiding this comment.
The tpm2-tools eventlog parser does validate the entries were possible against the digest and emits an error if it does not match.
There was a problem hiding this comment.
I have not looked [too much] at the tpm2_eventlog.c code -- consciously avoided looking there too much except to figure out why generated JSON outputs disagree.
A lot of EFIVAR type entries don't self-validate at the moment, but only when generated by certain BIOSes. No, I don't know why, and I haven't identified the failure parameters yet. Working on making that part of the CI unit tests, while improving the self-checking code that handles {accidentally|deliberately} malformed event logs.
|
After discussing in the monthly meeting, I believe we reached a consensus that the enhancement proposal should move ahead, and thus LGTM. A new repository, https://github.com/keylime/python3-uefi-eventlog , was created, and we can all start to collectively review the code there. |
No description provided.