<div dir="ltr"><div>After going down a bit of a rabbit hole looking for the significance of `EFI_CERT_RSA2048_GUID` in secvarctl (a package which depends on skiboot) , I have come to the conclusion that the uuid is not directly imperative to any secvarctl or skiboot processes. This GUID is only contained in an ESL if it contains an RSA key, which is invalid since, for secvar purposes, we only accept ESLS which contain X509's (or hashes if the ESL is for the dbx secvar). That being said, it is useful for things like error messages (or logs in skiboots case) because we tell the user "your ESL is invalid because it contains an RSA key, go put this thing in an x509" or something like that. Its origins are from tianocore and I likely added it to secvarctl since it appeared relevant when I was just starting my project. Sorry for rambling but what I am getting at is: As of now, `EFI_CERT_RSA2048_GUID` is useful solely for telling the user what data we do not accept. This GUID may have been useful in the past and it may become useful in the future but for now it is not directly useful to any secvar update process. That being said, I see no harm in adding it to skiboot. Of course the decision is the maintainers to make, I just hope this gives some useful context.</div><div><br></div><div>-Nick Child<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, May 4, 2021 at 11:56 PM Daniel Axtens <<a href="mailto:dja@axtens.net">dja@axtens.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">This isn't currently used in skiboot but may be used by external<br>
users of skiboot's secvar code.<br>
<br>
Signed-off-by: Daniel Axtens <<a href="mailto:dja@axtens.net" target="_blank">dja@axtens.net</a>><br>
---<br>
libstb/secvar/backend/edk2.h | 2 ++<br>
1 file changed, 2 insertions(+)<br>
<br>
diff --git a/libstb/secvar/backend/edk2.h b/libstb/secvar/backend/edk2.h<br>
index 85e117861dff..ef6d7c79e7ff 100644<br>
--- a/libstb/secvar/backend/edk2.h<br>
+++ b/libstb/secvar/backend/edk2.h<br>
@@ -83,6 +83,8 @@ static const uuid_t EFI_CERT_SHA384_GUID = {{ 0x07, 0x53, 0x3e, 0xff, 0xd0, 0x9f<br>
<br>
static const uuid_t EFI_CERT_SHA512_GUID = {{ 0xae, 0x0f, 0x3e, 0x09, 0xc4, 0xa6, 0x50, 0x4f, 0x9f, 0x1b, 0xd4, 0x1e, 0x2b, 0x89, 0xc1, 0x9a }};<br>
<br>
+static const uuid_t EFI_CERT_RSA2048_GUID = {{ 0xe8, 0x66, 0x57, 0x3c, 0x9c, 0x26, 0x34, 0x4e, 0xaa, 0x14, 0xed, 0x77, 0x6e, 0x85, 0xb3, 0xb6 }};<br>
+<br>
#define EFI_VARIABLE_NON_VOLATILE 0x00000001<br>
#define EFI_VARIABLE_BOOTSERVICE_ACCESS 0x00000002<br>
#define EFI_VARIABLE_RUNTIME_ACCESS 0x00000004<br>
-- <br>
2.27.0<br>
<br>
_______________________________________________<br>
Skiboot mailing list<br>
<a href="mailto:Skiboot@lists.ozlabs.org" target="_blank">Skiboot@lists.ozlabs.org</a><br>
<a href="https://lists.ozlabs.org/listinfo/skiboot" rel="noreferrer" target="_blank">https://lists.ozlabs.org/listinfo/skiboot</a><br>
</blockquote></div>