Build: Detect and strip PKCS#7 ContentInfo wrappers in KEK updates

[Flickdm]

Description

Some KEK update files are generated with an outer ContentInfo SEQUENCE wrapping the SignedData blob. Older EDK2-based firmware expects raw SignedData directly in WIN_CERTIFICATE_UEFI_GUID.CertData; ContentInfo support was only added recently in:
tianocore/edk2@37d3eb0

This is normally because the tool that used wanted to sign it in a "normal" way where the code in UEFI is anything but normal.

If we strip off the ContentInfo(..) we have a greater chance of supporting platforms stuck on older UEFI firmware.

So while not invalid - and for newer machines is fine - older firmware may pose an issue.

For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

• Impacts functionality?
• Impacts security?
• Breaking change?
• Includes tests?
• Includes documentation?

How This Was Tested

Tested with a known binary with this issue

KEK Validation Results

⚠️ WARNING: PostSignedObjects/KEK/Test/KEKUpdate_PK_WITH_CONTENT_INFO.bin

• Cryptographic Signature: ✅ VALID
• Expected Payload: ✅ True
• ContentInfo Wrapper: ⚠️ Detected

Why this matters: The PKCS#7 signature contains an outer ContentInfo SEQUENCE
wrapping the SignedData. Older EDK2-based firmware expects raw SignedData in
WIN_CERTIFICATE_UEFI_GUID.CertData and will reject the update. Use
scripts/strip_content_info.py to remove the wrapper before submitting.

File Hashes (SHA-256)

PostSignedObjects/KEK/Test/KEKUpdate_PK_WITH_CONTENT_INFO.bin: 7e3f66f80384f26b1a4ff6a45c7aecc28891bf1250adbbc3e76bb73868dd70fc

Command Output

$ python scripts/validate_kek.py "PostSignedObjects/KEK/Test/KEKUpdate_PK_WITH_CONTENT_INFO.bin" -o "kek_validation_results/KEKUpdate_PK_WITH_CONTENT_INFO_validation.json" -q
INFO:root:Validating: KEKUpdate_PK_WITH_CONTENT_INFO.bin
WARNING:root:  [!] ContentInfo wrapper detected in cert_data!
INFO:root:  Cryptographic Signature: VALID
INFO:root:  Expected Payload: True

INFO:root:Results saved to: kek_validation_results/KEKUpdate_PK_WITH_CONTENT_INFO_validation.json

PostSignedObjects/KEK/Test/KEKUpdate_PK_WITH_CONTENT_INFO.bin

{
  "validation_date": "2026-04-23T00:50:24.707627+00:00",
  "file": "PostSignedObjects/KEK/Test/KEKUpdate_PK_WITH_CONTENT_INFO.bin",
  "parameters": {
    "var_name": "KEK",
    "var_guid": "8be4df61-93ca-11d2-aa0d-00e098032b8c",
    "attributes": "NV,BS,RT,AT,AP"
  },
  "result": {
    "filename": "KEKUpdate_PK_WITH_CONTENT_INFO.bin",
    "path": "PostSignedObjects/KEK/Test/KEKUpdate_PK_WITH_CONTENT_INFO.bin",
    "valid": true,
    "payload_hash_valid": true,
    "content_info_wrapped": true,
    "error": null,
    "warnings": [
      "cert_data contains a PKCS#7 ContentInfo wrapper. "
    ],
    "details": {
      "verified": true
    },
    "payload_hash": "5b85333c009d7ea55cbb6f11a5c2ff45ee1091a968504c929aed25c84674962f",
    "payload_size": 1506
  }
}

Reproduce Locally

pip install -r pip-requirements.txt
python scripts/validate_kek.py <path-to-kek-bin-file> -v

Integration Instructions

N/A