Tianocore/edk2.git/CryptoPkg/Test, branch dependabot/github_actions/actions/github-script-9

CryptoPkg: Add digest-based RSA-PSS sign and verify APIs

2026-04-07T12:26:54+00:00

Add RsaPssSignDigest() and RsaPssVerifyDigest() to BaseCryptLib for signing/verifying precomputed digests. Provide OpenSSL/MbedTLS/Null implementations, expose via EDKII_CRYPTO_PROTOCOL (v24), and add PCD controls for independent service enabling. Include unit tests. Signed-off-by: Anbazhagan Baraneedharan

CryptoPkg: Added MockBaseCryptLib for google test

2026-04-02T03:27:19+00:00

Added BaseCryptLib's mock library for google test so one can make google test drives consuming it Signed-off-by: Paddy Deng

CryptoPkg: Replace include guards with #pragma once

2026-02-23T21:01:28+00:00

Replace traditional `#ifndef`/`#define`/`#endif` include guards with `#pragma` once. `#pragma once` is a widely supported preprocessor directive that prevents header files from being included multiple times. It is supported by all toolchains used to build edk2: GCC, Clang/LLVM, and MSVC. Does not include updates to OpenSSL generated header files checked into the repo. Those in `CryptoPkg\Library\OpensslLib\OpensslGen\`. Compared to macro-based include guards, `#pragma once`: - Eliminates the risk of macro name collisions or copy/paste errors where two headers inadvertently use the same guard macro. - Eliminate inconsistency in the way include guard macros are named (e.g., some files use `__FILE_H__`, others use `FILE_H_`, etc.). - Reduces boilerplate (three lines replaced by one). - Avoids polluting the macro namespace with guard symbols. - Can improve build times as the preprocessor can skip re-opening the file entirely, rather than re-reading it to find the matching `#endif` ("multiple-include optimization"). - Note that some compilers may already optimize traditional include guards, by recognzining the idiomatic pattern. This change is made acknowledging that overall portability of the code will technically be reduced, as `#pragma once` is not part of the C/C++ standards. However, this is considered acceptable given: 1. edk2 already defines a subset of supported compilers in BaseTools/Conf/tools_def.template, all of which have supported `#pragma once` for over two decades. 2. There have been concerns raised to the project about inconsistent include guard naming and potential macro collisions. Approximate compiler support dates: - MSVC: Supported since Visual C++ 4.2 (1996) - GCC: Supported since 3.4 (2004) (http://gnu.ist.utl.pt/software/gcc/gcc-3.4/changes.html) - Clang (LLVM based): Since initial release in 2007 Signed-off-by: Michael Kubacki

CryptoPkg/BaseCryptLibUnitTest: Separate MbedTls UnitTest Library.

2025-11-24T13:10:50+00:00

Separate Unit test functions for MbedTls. BaseCryptLibMbedTls does not support all Crypto services So deprecate below function for MbedTls Unit test: TestVerifyEKUsWith3CertsInSignature() TestVerifyEKUsWith2CertsInSignature() TestNoEKUsInSignature() TestVerifyRsaCertPkcs1SignVerify TestVerifyPkcs7SignVerifyNonSelfIssued() TestVerifyDhGenerateKey() Pkcs1v2Decrypt Pkcs1v2EncryptDecrypt RsaOaepEncrypt (Interface) RsaOaepEncrypt (NoSeed) RsaOaepEncrypt (Seeded) RsaOaepDecrypt RsaOaepEncryptDecrypt RsaOaepEncryptPkcs1v2Decrypt Pkcs1v2EncryptRsaOaepDecrypt RsaOaepEncrypt (MdDefaultMgf1Default) RsaOaepDecrypt (MdDefaultMgf1Default) RsaOaepEncryptDecrypt (MdDefaultMgf1Default) RsaOaepEncrypt (MdSha1Bgf1Sha1 RsaOaepDecrypt (MdSha1Bgf1Sha1) RsaOaepEncryptDecrypt (MdSha1Bgf1Sha1) RsaOaepEncrypt (MdSha256Bgf1Sha256) RsaOaepDecrypt (MdSha256Bgf1Sha256) RsaOaepEncryptDecrypt (MdSha256Bgf1Sha256) TestVerifyBn() TestVerifyEcKey() TestPkcs7Attached() TestPkcs7Detached() TestVerifyPkcs7ContentData() REF: https://github.com/tianocore/edk2/issues/11605 Signed-off-by: Longhaox Lee

CryptoPkg: Unit test for Pkcs7GetAttachedContent()

2025-11-24T13:10:50+00:00

MbebTls no support signature with content data. test would be fail in below test case: TestPkcs7Attached TestPkcs7Detached TestVerifyPkcs7ContentData REF: https://github.com/tianocore/edk2/issues/11605 Signed-off-by: Longhaox Lee

CryptoPkg: fix various typos

2025-11-21T21:49:59+00:00

Signed-off-by: Philipp Schuster

CryptoPkg: Add Unit Test Host of Mbedtls CryptoLib

2025-08-26T10:01:25+00:00

Currently BaseCryptLibMbedTls does not support all Crypto services, so the following case will fail: TestVerifyEKUsWith3CertsInSignature() TestVerifyEKUsWith2CertsInSignature() TestNoEKUsInSignature() TestVerifyRsaCertPkcs1SignVerify TestVerifyPkcs7SignVerifyNonSelfIssued() TestVerifyDhGenerateKey() Pkcs1v2Decrypt Pkcs1v2EncryptDecrypt RsaOaepEncrypt (Interface) RsaOaepEncrypt (NoSeed) RsaOaepEncrypt (Seeded) RsaOaepDecrypt RsaOaepEncryptDecrypt RsaOaepEncryptPkcs1v2Decrypt Pkcs1v2EncryptRsaOaepDecrypt RsaOaepEncrypt (MdDefaultMgf1Default) RsaOaepDecrypt (MdDefaultMgf1Default) RsaOaepEncryptDecrypt (MdDefaultMgf1Default) RsaOaepEncrypt (MdSha1Bgf1Sha1 RsaOaepDecrypt (MdSha1Bgf1Sha1) RsaOaepEncryptDecrypt (MdSha1Bgf1Sha1) RsaOaepEncrypt (MdSha256Bgf1Sha256) RsaOaepDecrypt (MdSha256Bgf1Sha256) RsaOaepEncryptDecrypt (MdSha256Bgf1Sha256) TestVerifyBn() TestVerifyEcKey() Signed-off-by: Yi Li

CryptoPkg: Add PKCS7 test case for partial certificate chains

2025-08-26T10:01:25+00:00

This case uses a non-self-issued certificate as the signing certificate and CA. BaseCryptLib can pass this case (X509_V_FLAG_PARTIAL_CHAIN enabled). BaseCryptLibMbedTls cannot, because Mbedtls certificate chain validation lacks support for partial certificate chains currently. Signed-off-by: Yi Li

CryptoPkg: Resolve CodeQL Errors

2025-04-21T02:14:50+00:00

This patch updates several CodeQL errors for potential null pointer access and unguarded header conclusion across production and test code that have been flagged in the build/security tab in GitHub. Signed-off-by: Oliver Smith-Denny

CryptoPkg/Library/OpensslLib: Fix CLANG compatibility issues

2025-03-07T05:44:30+00:00

Update the CryptoPkg to support CLANGPDB and CLANGDWARF from both Windows and Linux host environments. * Add PcdOpensslLibAssemblySourceStyleNasm to select the correct optimized assembly source style for OpensslLib for IA32/X64. NASM style is for MSFT and CLANGPDB. GAS style is for GCC. Use this PCD in OpensslLibAccel.inf and OpensslLibFullAccel.inf to select between .nasm and .S files. * Add intrinsic functions required by CLANG IA32/X64 builds. * __ashlti3 * __lshrdi3 * Disable warning -Wno-error=unused-function for CLANG build compatibility * Set -D OPENSSL_NO_INLINE_ASM for CLANG build compatibility * Update TestBaseCryptLib to split out the implementation of main() into its own C file that is only use for host-based unit tests. This is due to CLANGPDB for host environments injecting a __main() call that can only be resolved in host based builds that link against host libraries. * Update Configure.py to update IA32/X64 [Sources] sections with feature flag expressions using the new PCD PcdOpensslLibAssemblySourceStyleNasm. Signed-off-by: Michael D Kinney