Convert a string to an EFIGUID

Appends a signaure to the database. It will scan the database for the appropriate list to append itself to.

MkCert creates a basic self-signed certificate compatible with the legacy InitCert function Returns cert first, then key (for compatibility with exist

Partially implements RFC2315

Parse a PECOFF Binary. This will read the binary and collect all the bytes we are hashing.

Reads several signature lists from a io.Reader. It assumes io.EOF means there are no more signatures to read as opposed to an actual issue

Reads a known EFI variable from efivarfs.

Verify signature

Compare two EFIGUID structs

ParseTimestampInfo parses and extracts TSTInfo (timestamp token information) from PKCS#7 contentInfo. contentInfo may be the raw ASN.1 encoded conten

Sign the PE/COFF binary and return the signature. .Bytes() will return the binary with the signature appended.

VerifyTimestampBytes verifies a RFC 3161 timestamp token and validates it against the provided message imprint. It performs the following verification

MkCertChain creates a certificate chain for testing with root, intermediate, and leaf certificates

ParseAuthenticode parses an Authenticode signature.

Parse an efivar as a UTF-16 string.

For a full path instead of the inferred efivars path

Writes a signed variable update

Check if file is immutable before writing to the file. Returns ErrImmutable if the file is immutable.

GetTimestamp requests a timestamp for the given message imprint

NewFS creates a new instance of *EFIFS

Parse cryptobyte string to pkix.AlgorithmIdentifier

Removes a signaure to the database. It will scan available lists for something to remove

SignAuthenticode signs a digest with the SPC Indirect Data Content as specified by the authenticode standard.

UnsetImmutable implicitly when writing towards a file.

WithAdditionalCerts embeds additional certificates (e.g., intermediate CAs) into the signature

Check if signature exists in the signature list Return true if it does along with the index

Read an EFI_SIGNATURE_LIST from io.Reader. It will read until io.EOF. io.EOF should be somewhat expected if we are trying to read multiple lists as th

func (f *Testfs) ToFS() EFIFs { return &FS{ unsetimmutable: false, immutable: false, fs: f.ToAfero(), } } With allows you to

Convert a byte slice to an EFIGUID

GetSecureBoot returns if secure boot has been enabled on the machine.

GetSetupMode returns if setup mode has been enabled on the machine.

Read a null terminated string

Signatures returns a slice of *signature.WINCertificate which contains the WINCert wrapped Authenticode signatures.

Writes a signature list

CreateTimestampRequest creates a RFC 3161 timestamp request

Checks if all signatures in a list is present in the signature database

Convert an EFIGUID to a byte slice

GetAttr retrieves the attributes of a file on a linux filesystem

Hash makes a hash of the hashContent bytes.

checks if the file is immutable

Marshal encodes the TSTInfo using cryptobytes

Control whether or not the certificate gets embedded into the signature

Checks if all signatures in a list is present in the signature database

VerifyTimestamp enables checking the signing certificate for expiry when verifying a signature. If the signing certificate is expired, the Authenticod

WithAuthenticodeTimestamp enables authenticode timestamping using the specified TSA URL

Write a signature database which contains a slice of SignautureLists

parseTSTInfo parses TSTInfo structure using cryptobytes