Tianocore/edk2.git/CryptoPkg/Library/TlsLib, branch dependabot/github_actions/actions/setup-python-7

CryptoPkg: TlsLib: Fix uninitialized variable warnings

2026-06-24T14:49:50+00:00

In TlsSetCipherList(), the OpensslCipher variable is initialized inside an inner loop but accessed outside of that loop, which can lead to uninitialized variable warnings. Fix this issue by moving all accesses to OpensslCipher into the inner loop where it is initialized. Signed-off-by: Tuan Phan

CryptoPkg: Log TLS handshake certificate verification error reason

2026-06-15T04:47:25+00:00

When the TLS error is `SSL_R_CERTIFICATE_VERIFY_FAILED`, the verification failure reason is reported by `SSL_get_verify_result`. Adding this reason to the debug logs is valuable to pin-point certificate rejection that are specific to EDK II. Signed-off-by: Jean-Tiare Le Bigot

CryptoPkg: Replace include guards with #pragma once

2026-02-23T21:01:28+00:00

Replace traditional `#ifndef`/`#define`/`#endif` include guards with `#pragma` once. `#pragma once` is a widely supported preprocessor directive that prevents header files from being included multiple times. It is supported by all toolchains used to build edk2: GCC, Clang/LLVM, and MSVC. Does not include updates to OpenSSL generated header files checked into the repo. Those in `CryptoPkg\Library\OpensslLib\OpensslGen\`. Compared to macro-based include guards, `#pragma once`: - Eliminates the risk of macro name collisions or copy/paste errors where two headers inadvertently use the same guard macro. - Eliminate inconsistency in the way include guard macros are named (e.g., some files use `__FILE_H__`, others use `FILE_H_`, etc.). - Reduces boilerplate (three lines replaced by one). - Avoids polluting the macro namespace with guard symbols. - Can improve build times as the preprocessor can skip re-opening the file entirely, rather than re-reading it to find the matching `#endif` ("multiple-include optimization"). - Note that some compilers may already optimize traditional include guards, by recognzining the idiomatic pattern. This change is made acknowledging that overall portability of the code will technically be reduced, as `#pragma once` is not part of the C/C++ standards. However, this is considered acceptable given: 1. edk2 already defines a subset of supported compilers in BaseTools/Conf/tools_def.template, all of which have supported `#pragma once` for over two decades. 2. There have been concerns raised to the project about inconsistent include guard naming and potential macro collisions. Approximate compiler support dates: - MSVC: Supported since Visual C++ 4.2 (1996) - GCC: Supported since 3.4 (2004) (http://gnu.ist.utl.pt/software/gcc/gcc-3.4/changes.html) - Clang (LLVM based): Since initial release in 2007 Signed-off-by: Michael Kubacki

CryptoPkg: Fix coverity warnings in CryptoPkg.

2025-10-27T03:14:56+00:00

Fix the coverity warnings reported in the CryptoPkg. Signed-off-by: Kanagavel S

CryptoPkg: Drop ARM32 Support

2025-09-25T22:04:10+00:00

edk2 is dropping support for the ARM32 architecture. This commit removes ARM32 code from CryptoPkg. This also drops irrelevant VALID_ARCHITECTURES comments from infs that are not arch specific. Signed-off-by: Oliver Smith-Denny

CryptoPkg: Add support to set TLS security level.

2025-09-23T03:08:14+00:00

Add Edkiicrypto protocol API to set TLS set security level. Signed-off-by: Kanagavel S

CryptoPkg: Add SNI support

2025-09-04T08:32:34+00:00

Add Server Name Indication support. Signed-off-by: Kanagavel S

CryptoPkg: Enable the time check flag.

2025-07-05T14:23:01+00:00

REF:https://github.com/tianocore/edk2/issues/11245 Enable the time check flag to verify the current time during the TLS certificate validation. Signed-off-by: Kanagavel S

CryptoPkg: Extend TLS handshake debug output

2024-06-25T23:18:36+00:00

The error codes during TLS handshake errors are sometimes not enough to understand the root cause of the problem. Extending the debug output by the function and optional data helps in some cases. Signed-off-by: Sebastian Witt

CryptoPkg: Add SNI extension to TLS ClientHello

2024-06-25T21:46:50+00:00

Webservers hosting multiple websites require the TLS SNI (Server Name Indication) in the ClientHello to know which certificate to return. The current TLS code does not include the server name in the ClientHello handshake, which leads to failed HTTPS boots when the server does not return the correct certificate. This sets the host name for SNI in TlsSetVerifyHost which receives the host name also for verification against the certificates. Signed-off-by: Sebastian Witt