Cryptographic Validation For Authenticated Variables #327

Flickdm · 2025-12-01T06:53:18Z

Description

This pull request adds a new "verify" command to the auth_var_tool.py script, enhancing its ability to cryptographically verify UEFI authenticated variables. It also improves the output of the "describe" command by converting hex-encoded certificate fields into human-readable text. The most important changes are summarized below:

New Verification Functionality:

Added a verify command that verifies the cryptographic signature of authenticated variables, checking PKCS7 structure validity, signature correctness, and presence of the signing certificate. This includes new helper functions for extracting certificates and verifying signatures from PKCS7 data. [1] [2] [3] [4] [5] [6]

Improvements to Describe Output:

Enhanced the describe command to convert ASN.1 hex-encoded certificate fields (such as subject and issuer names) into human-readable strings, making the output more user-friendly. [1] [2]

Documentation and Usage Examples:

Updated script documentation and usage examples to include the new verify command and its arguments, ensuring users are aware of the new functionality. [1] [2]

These changes make the tool more robust for workflows that require verification of signed UEFI variables and improve the clarity of output for certificate inspection.
For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

How This Was Tested

Against every supplied KEK update

Appears to have caught a couple mistakes, reviewing them internally

Integration Instructions

N/A

…ariables

…validation - Renamed script to validate_kek.py to reflect broader functionality - Added validate_single_kek() function to validate individual KEK files - Updated main() to detect and handle both file and folder inputs - Improved output messages: 'Cryptographic Signature: VALID/INVALID' and 'Expected Payload: True/False' - JSON output always generated for CI integration - Preserves git history through git mv

- Created validate-kek-updates.yml workflow that runs on PRs - Triggers when .bin files in KEK directories are added or modified - Validates cryptographic signatures and payloads for all changed KEK files - Fails CI if any KEK has an invalid signature - Warns (but doesn't fail) if payload doesn't match expected hash - Uploads validation results as artifacts - Adds detailed summary to PR with pass/fail status for each file

Copilot

Pull request overview

This pull request adds cryptographic verification capabilities to the UEFI authenticated variable tools by introducing a new verify command, a batch validation script, and automated CI workflow validation.

Adds verify command to auth_var_tool.py with PKCS7 signature verification
Creates validate_kek.py script for batch validation of KEK update files
Implements GitHub Actions workflow for automated KEK validation on pull requests

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 13 comments.

File	Description
scripts/auth_var_tool.py	Adds cryptographic verification functionality with new `verify` command, PKCS7 certificate extraction, signature verification helpers, and enhanced describe output with human-readable hex strings
scripts/validate_kek.py	New script for validating KEK update files (single or batch) with JSON reporting, payload hash checking, and cryptographic signature verification
.github/workflows/validate-kek-updates.yml	New GitHub Actions workflow to automatically validate KEK files in pull requests, checking cryptographic signatures and expected payloads

Comments suppressed due to low confidence (1)

scripts/auth_var_tool.py:669

This import of module re is redundant, as it was previously imported on line 49.

    import re

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-12-03T18:54:00Z

scripts/auth_var_tool.py

+    str
+        The content with hex strings converted to readable format where possible
+    """
+    import re


The re module is imported at the module level (line 49), so this local import on line 669 is redundant. The module-level import should be used instead.

Suggested change

import re

Copilot · 2025-12-03T18:54:00Z

scripts/auth_var_tool.py

        return datetime.datetime.now(datetime.timezone.utc)


+def _get_hash_algorithm_from_oid(oid: str) -> hashes.HashAlgorithm | None:


The type hint uses Python 3.10+ union syntax (hashes.HashAlgorithm | None). While this is modern Python syntax, it could cause compatibility issues if the project supports Python 3.9 or earlier. Consider using Optional[hashes.HashAlgorithm] from the typing module or verify the minimum Python version requirement.

Copilot · 2025-12-03T18:54:00Z

scripts/validate_kek.py

+
+    Args:
+        kek_file: Path to KEK update file
+        quiet: If True, suppress validation output from the prototype


The documentation refers to "prototype" which seems like leftover wording from development. Consider updating to "verification process" or "verification output" for clarity.

Suggested change

quiet: If True, suppress validation output from the prototype

quiet: If True, suppress validation output from the verification process

Copilot · 2025-12-03T18:54:01Z

.github/workflows/validate-kek-updates.yml

+        fi
+
+        # Exit with error if any validation failed
+        if [ $VALIDATION_FAILED -eq 1 ]; then


[nitpick] The condition checks if VALIDATION_FAILED equals 1, but the variable is only ever set to 0 or 1. Consider using a more standard exit immediately after setting VALIDATION_FAILED=1 rather than waiting until the end, or accumulate errors differently. However, the current logic works correctly as written.

Copilot · 2025-12-03T18:54:01Z

scripts/auth_var_tool.py

+        except Exception:
+            signed_data, _ = decoder.decode(pkcs7_data, asn1Spec=rfc2315.SignedData())


[nitpick] The bare except Exception catches all exceptions without discriminating between expected decoding failures and unexpected errors. Consider catching specific exceptions (like ASN1 decoding exceptions) for better error handling and debugging.

Copilot · 2025-12-03T18:54:02Z

scripts/auth_var_tool.py

+        except Exception:
+            # If that fails, try decoding directly as SignedData
+            signed_data, _ = decoder.decode(pkcs7_data, asn1Spec=rfc2315.SignedData())


[nitpick] The bare except Exception catches all exceptions without discriminating between expected decoding failures and unexpected errors. Consider catching specific exceptions (like ASN1 decoding exceptions) or at least logging at a higher level for unexpected failures to aid debugging.

Copilot · 2025-12-03T18:54:02Z

scripts/auth_var_tool.py

    subparsers = setup_format_parser(subparsers)
    subparsers = setup_sign_parser(subparsers)
    subparsers = setup_describe_parser(subparsers)
+    subparsers = setup_verify_parser(subparsers)


Variable subparsers is not used.

Suggested change

subparsers = setup_format_parser(subparsers)

subparsers = setup_sign_parser(subparsers)

subparsers = setup_describe_parser(subparsers)

subparsers = setup_verify_parser(subparsers)

setup_format_parser(subparsers)

setup_sign_parser(subparsers)

setup_describe_parser(subparsers)

setup_verify_parser(subparsers)

Copilot · 2025-12-03T18:54:02Z

scripts/auth_var_tool.py

+                        # Only replace if it looks like printable text
+                        if decoded.isprintable() or all(c in '\t\n\r' or c.isprintable() for c in decoded):
+                            return f'{indent}{hex_string} ("{decoded}")'
+                    except (UnicodeDecodeError, AttributeError):


'except' clause does nothing but pass and there is no explanatory comment.

Suggested change

except (UnicodeDecodeError, AttributeError):

except (UnicodeDecodeError, AttributeError):

# Decoding failed; ignore and try the next decoding strategy.

Copilot · 2025-12-03T18:54:03Z

scripts/auth_var_tool.py

+                decoded = hex_bytes.decode('utf-8')
+                if decoded.isprintable() or all(c in '\t\n\r' or c.isprintable() for c in decoded):
+                    return f'{indent}{hex_string} ("{decoded}")'
+            except UnicodeDecodeError:


'except' clause does nothing but pass and there is no explanatory comment.

Suggested change

except UnicodeDecodeError:

except UnicodeDecodeError:

# Ignore decode errors: not all byte sequences are valid UTF-8, so skip these cases.

scripts/auth_var_tool.py

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Flickdm added 6 commits November 29, 2025 23:46

auth_var_tool: add cryptographic verification for efi authenticated v…

f8b019f

…ariables

auth_var_tool: updating describe to print the ascii strings

6cf0316

auth_var_tool: ruff updates

7488cf8

auth_var_tool: minor updates

2b63d08

Flickdm requested a review from Copilot December 3, 2025 18:49

Copilot started reviewing on behalf of Flickdm December 3, 2025 18:49 View session

Copilot finished reviewing on behalf of Flickdm December 3, 2025 18:52

Copilot AI reviewed Dec 3, 2025

View reviewed changes

Update scripts/auth_var_tool.py

cc0ae88

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Flickdm changed the title ~~Feature/auth var/cryptographic validation~~ Cryptographic Validation For Authenticated Variables Dec 4, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Cryptographic Validation For Authenticated Variables #327

Cryptographic Validation For Authenticated Variables #327

Flickdm commented Dec 1, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Dec 3, 2025

Uh oh!

Copilot AI Dec 3, 2025

Uh oh!

Copilot AI Dec 3, 2025

Uh oh!

Copilot AI Dec 3, 2025

Uh oh!

Copilot AI Dec 3, 2025

Uh oh!

Copilot AI Dec 3, 2025

Uh oh!

Copilot AI Dec 3, 2025

Uh oh!

Copilot AI Dec 3, 2025

Uh oh!

Copilot AI Dec 3, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		return datetime.datetime.now(datetime.timezone.utc)


		def _get_hash_algorithm_from_oid(oid: str) -> hashes.HashAlgorithm \| None:

	quiet: If True, suppress validation output from the prototype
	quiet: If True, suppress validation output from the verification process

		except Exception:
		signed_data, _ = decoder.decode(pkcs7_data, asn1Spec=rfc2315.SignedData())

	except (UnicodeDecodeError, AttributeError):
	except (UnicodeDecodeError, AttributeError):
	# Decoding failed; ignore and try the next decoding strategy.

	except UnicodeDecodeError:
	except UnicodeDecodeError:
	# Ignore decode errors: not all byte sequences are valid UTF-8, so skip these cases.

Cryptographic Validation For Authenticated Variables #327

Are you sure you want to change the base?

Cryptographic Validation For Authenticated Variables #327

Conversation

Flickdm commented Dec 1, 2025

Description

How This Was Tested

Integration Instructions

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant