Tianocore/edk2.git/SecurityPkg, branch dependabot/github_actions/actions/setup-python-7

MdePkg,SecurityPkg: Fix TPM2 ACPI Table

2026-07-25T01:32:22+00:00

Updated the ACPI code to fix an issue where the template was outdated and the revision was reporting V5 but the template was still using the V4 version of the Start Method specific parameters. Continuous-integration-options: PatchCheck.ignore-multi-package Signed-off-by: Raymond Diaz

SecurityPkg/DxeTpmMeasureBootLib: Use GptLib parser

2026-07-20T21:50:57+00:00

TcgMeasureGptTable() reads the primary GPT header directly from LBA 1 and validates it with field checks only: no header CRC32, no partition-entry-array CRC32 and no backup fallback. This is the same divergence between the measured and the parsed partition table that CVE-2024-13745 reports against DxeTpm2MeasureBootLib, and the tracking issue lists both libraries as affected. Mirror the DxeTpm2MeasureBootLib fix: select the GPT header to measure via the shared GptLib parser. Validate the current primary GPT or, when it is invalid, validate the backup and the header at its AlternateLBA. Do not extend PCR[5] if no valid header can be selected. Signed-off-by: Richard Lyu

SecurityPkg/DxeTpm2MeasureBootLib: Use GptLib parser

2026-07-20T21:50:57+00:00

The previous commit introduced GptLib by extracting PartitionDxe's GPT parsing and validation code. It provides a shared implementation for edk2 components that need to parse and validate GPT data consistently. Update DxeTpm2MeasureBootLib to use GptLib when selecting on-disk GPT data for measurement. Validate the current primary GPT or, when it is invalid, validate the backup and the header at its AlternateLBA. Do not extend PCR[5] if no valid header can be selected. The measurement therefore uses GPT data read from disk at measurement time and applies the shared parser and validation logic. Ref: https://seclists.org/oss-sec/2026/q2/727 Signed-off-by: Richard Lyu

SecurityPkg: Tpm over FFA: FFA_RUN command should use the returned ID

2026-07-20T19:13:15+00:00

As the FFA function now returns the target ID properly, instead of hardcoding the FFA_RUN target ID being the TPM SP, we use the parsed ID to issue the FFA_RUN. Signed-off-by: Kun Qin

SecurityPkg/RngDxe: Support RISCV64

2026-07-17T05:23:45+00:00

Add RISCV64 to the list of valid architectures. Signed-off-by: Tuan Phan

SecurityPkg/RngDxe: Replace Intel-specific with arch-neutral comments

2026-07-17T05:23:45+00:00

The RngDxe driver and its non-AArch64 support files still contained comments and descriptions referring to Intel Secure Key technology, RDRAND/RDSEED instructions, and the Intel DRNG implementation guide. These references are no longer accurate because the driver obtains random data through the platform-provided RngLib abstraction rather than relying on Intel-specific CPU features. Update the comments and descriptions to use architecture-neutral language that better reflects the current implementation. Signed-off-by: Tuan Phan

SecurityPkg: Add Google Test MockSecureBootVariableLib

2026-07-16T17:50:01+00:00

Add Google Test Mock library header and implementation for SecureBootVariableLib to allow simple mocking for host based unit tests that utilize the Google Test framework. Signed-off-by: Joey Vagedes

SecurityPkg: added image verification tests for signed images

2026-07-16T02:33:17+00:00

Previous changes introduced tests for unsigned images verified by hash entries in DB/DBX. This commit adds tests covering verification of signed images, including certificate chain validation as well as cases where image hashes are checked against entries in DB/DBX. Signed-off-by: Alexander Gryanko

SecurityPkg: added image verification test using DB hash

2026-07-16T02:33:17+00:00

The part of DxeImageVerificationHandler responsible for verifying the image location source has already been implemented. This commit implements tests for verifying images in cases where the image has no signature, but there is a hash record for this file in DB/DBX. Signed-off-by: Alexander Gryanko

SecurityPkg/Tpm2ServiceFfa.h: fix typo

2026-07-07T19:57:18+00:00

Replace `TPM_CRB_FFA_FEAT_NOTIFICATION_TYPE_SHIFT` with `TPM2_FFA_FEAT_NOTIFICATION_TYPE_SHIFT` Fixes #12768 Signed-off-by: Dāvis Mosāns