efiencrypt 1.0.1 → 1.1.0

package/efiencrypt

@@ -5,7 +5,7 @@ import require$$2, { join, resolve } from "node:path";
 import require$$3 from "node:fs";
 import require$$4 from "node:process";
 import { createRequire } from "node:module";
-import { b as build } from "./build-CUHiK1Y8.js";
+import { b as build } from "./build-BfNzd1Cv.js";
 function getDefaultExportFromCjs(x) {
   return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x["default"] : x;
 }
@@ -3458,8 +3458,8 @@ const {
   Help
 } = commander;
 const name = "efiencrypt";
-const version = "1.0.1";
-const description = "Encrypts an EFI binary using a hash derived from user-defined data (random data, disk sectors, SMBIOS fields, ...)";
+const version = "1.1.0";
+const description = "Encrypts an EFI binary using a hash derived from user-defined data (random data, disk sectors, SMBIOS fields, EFI variables, ...). The resulting EFI can also optionally embed secure boot keys to enroll if the system is in setup mode.";
 program.name(name).description(description).showHelpAfterError(true).option("-c, --config-file <configFile>", "configuration file").option("-i, --input-file <inputFile>", "path to the input efi file to embed").option("-o, --output-file <outputFile>", "path to the output efi file to write").option("-s, --smbios <smbios>", "path to the input smbios dump file").option("-b, --build-folder <buildFolder>", "folder where to build the code").option("--skip-gen-code", "skip generating code").option("--skip-extract", "skip extracting source code").option("--skip-make", "skip calling make").version(version).action(async (options) => {
   try {
     let config = {};

package/handlers.d.ts

@@ -15,3 +15,7 @@ export declare const handlers: {
         type: T;
     }>;
 };
+export declare const enrollSecureBoot: ({ codeBuilder, config: { enrollSecureBoot } }: {
+    codeBuilder: CodeBuilder;
+    config: Config;
+}) => Promise<void>;

package/index.js

@@ -1,4 +1,4 @@
-import { b } from "./build-CUHiK1Y8.js";
+import { b } from "./build-BfNzd1Cv.js";
 export {
   b as build
 };

package/package.json

@@ -1 +1 @@
-{"name":"efiencrypt","version":"1.0.1","description":"Encrypts an EFI binary using a hash derived from user-defined data (random data, disk sectors, SMBIOS fields, ...)","type":"module","license":"MIT","bin":{"efiencrypt":"efiencrypt"},"repository":{"url":"https://github.com/davdiv/efiencrypt"},"exports":{".":{"types":"./index.d.ts","default":"./index.js"},"./smbios":{"types":"./smbios.d.ts","default":"./smbios.js"},"./schema.json":"./schema.json"}}
+{"name":"efiencrypt","version":"1.1.0","description":"Encrypts an EFI binary using a hash derived from user-defined data (random data, disk sectors, SMBIOS fields, EFI variables, ...). The resulting EFI can also optionally embed secure boot keys to enroll if the system is in setup mode.","type":"module","license":"MIT","bin":{"efiencrypt":"efiencrypt"},"repository":{"url":"https://github.com/davdiv/efiencrypt"},"keywords":{"0":"uefi","1":"encrypt","2":"efi","3":"secure-boot","4":"smbios"},"exports":{".":{"types":"./index.d.ts","default":"./index.js"},"./smbios":{"types":"./smbios.d.ts","default":"./smbios.js"},"./schema.json":"./schema.json"}}

package/schema.json

@@ -1 +1 @@
-{"type":"object","properties":{"$schema":{"type":"string"},"inputFile":{"description":"Path to the input efi file to embed.","type":"string"},"outputFile":{"description":"Path to the output efi file to write.","type":"string"},"skipGenCode":{"description":"Whether to skip generating code","type":"boolean"},"skipExtract":{"description":"Whether to skip extracting source code\n(can be useful if the extraction was already done)","type":"boolean"},"skipMake":{"description":"Whether to skip calling make\n(can be useful to change the code before calling make)","type":"boolean"},"buildFolder":{"description":"Folder where to build the code.\nDefaults to a temporary folder that is removed when the build is finished.","type":"string"},"hashComponents":{"description":"Data to include in the hash for encryption.","type":"array","items":{"$ref":"#/definitions/HashComponent"}},"smbios":{"description":"Path to the input smbios dump file.\nCan be produced by: dmidecode --dump-bin <filePath>","type":"string"}},"additionalProperties":false,"required":["inputFile"],"definitions":{"HashComponent":{"anyOf":[{"$ref":"#/definitions/HashComponentRandom"},{"$ref":"#/definitions/HashComponentSmbios"},{"$ref":"#/definitions/HashComponentHardDiskData"},{"$ref":"#/definitions/HashComponentHardDiskSize"},{"$ref":"#/definitions/HashComponentFileData"},{"$ref":"#/definitions/HashComponentFileSize"},{"$ref":"#/definitions/HashComponentMiscStringData"}]},"HashComponentRandom":{"type":"object","properties":{"type":{"type":"string","const":"random"},"length":{"type":"number"}},"additionalProperties":false,"required":["length","type"]},"HashComponentSmbios":{"type":"object","properties":{"type":{"type":"string","const":"smbios"},"ref":{"$ref":"#/definitions/SmbiosFieldRef"},"value":{"type":"string"}},"additionalProperties":false,"required":["ref","type"]},"SmbiosFieldRef":{"anyOf":[{"type":"object","properties":{"table":{"$ref":"#/definitions/SmbiosTableRef"},"offset":{"type":"number"},"type":{"enum":["byte","dword","qword","string","uuid","word"],"type":"string"}},"additionalProperties":false,"required":["offset","table","type"]},{"enum":["baseboard-asset-tag","baseboard-manufacturer","baseboard-product-name","baseboard-serial-number","baseboard-version","bios-release-date","bios-revision","bios-vendor","bios-version","chassis-asset-tag","chassis-manufacturer","chassis-serial-number","chassis-version","processor-manufacturer","processor-version","system-family","system-manufacturer","system-product-name","system-serial-number","system-sku-number","system-uuid","system-version"],"type":"string"}]},"SmbiosTableRef":{"anyOf":[{"type":"object","properties":{"handle":{"type":"number"}},"additionalProperties":false,"required":["handle"]},{"type":"object","properties":{"type":{"type":"number"},"index":{"type":"number"}},"additionalProperties":false,"required":["type"]},{"enum":["32-bit Memory Error","64-bit Memory Error","Additional Information","Baseboard","Boot Integrity Services","Built-in Pointing Device","Cache","Chassis","Cooling Device","Electrical Current Probe","Firmware Inventory","Firmware Language","Group Associations","Hardware Security","IPMI Device","Management Controller Host Interface","Management Device","Management Device Component","Management Device Threshold Data","Memory Array Mapped Address","Memory Channel","Memory Controller","Memory Device","Memory Device Mapped Address","Memory Module","OEM Strings","Onboard Devices","Onboard Devices Extended Information","Out-of-band Remote Access","Physical Memory Array","Platform Firmware","Port Connector","Portable Battery","Power Supply","Processor","Processor Additional Information","String Property","System","System Boot","System Configuration Options","System Event Log","System Power Controls","System Reset","System Slots","TPM Device","Temperature Probe","Voltage Probe"],"type":"string"},{"type":"number"}]},"HashComponentHardDiskData":{"type":"object","properties":{"type":{"type":"string","const":"hd-data"},"device":{"type":"string"},"offsetRef":{"enum":["end","start"],"type":"string"},"offset":{"$ref":"#/definitions/BigNumber"},"value":{"anyOf":[{"$ref":"#/definitions/BinaryDataFromFile"},{"$ref":"#/definitions/BinaryDataFromLiteral"},{"$ref":"#/definitions/BinaryDataFromBuffer"},{"$ref":"#/definitions/BinaryMissingData"}]}},"additionalProperties":false,"required":["offset","offsetRef","type","value"]},"BigNumber":{"type":["string","number"]},"BinaryDataFromFile":{"type":"object","properties":{"type":{"type":"string","const":"file"},"file":{"type":"string"},"offset":{"type":"number"},"size":{"type":"number"}},"additionalProperties":false,"required":["file","type"]},"BinaryDataFromLiteral":{"type":"object","properties":{"type":{"$ref":"#/definitions/global.BufferEncoding"},"buffer":{"type":"string"}},"additionalProperties":false,"required":["buffer","type"]},"global.BufferEncoding":{"enum":["ascii","base64","base64url","binary","hex","latin1","ucs-2","ucs2","utf-16le","utf-8","utf16le","utf8"],"type":"string"},"BinaryDataFromBuffer":{"type":"object","properties":{"type":{"type":"string","const":"buffer"},"buffer":{"type":"object"}},"additionalProperties":false,"required":["buffer","type"]},"BinaryMissingData":{"type":"object","properties":{"type":{"type":"string","const":"missing"},"size":{"type":"number"}},"additionalProperties":false,"required":["type"]},"HashComponentHardDiskSize":{"type":"object","properties":{"type":{"type":"string","const":"hd-size"},"device":{"type":"string"},"value":{"$ref":"#/definitions/BigNumber"}},"additionalProperties":false,"required":["type","value"]},"HashComponentFileData":{"type":"object","properties":{"type":{"type":"string","const":"file-data"},"device":{"type":"string"},"file":{"type":"string"},"offsetRef":{"enum":["end","full","start"],"type":"string"},"offset":{"type":["string","number"]},"value":{"anyOf":[{"$ref":"#/definitions/BinaryDataFromFile"},{"$ref":"#/definitions/BinaryDataFromLiteral"},{"$ref":"#/definitions/BinaryDataFromBuffer"},{"$ref":"#/definitions/BinaryMissingData"}]}},"additionalProperties":false,"required":["file","type","value"]},"HashComponentFileSize":{"type":"object","properties":{"type":{"type":"string","const":"file-size"},"device":{"type":"string"},"file":{"type":"string"},"value":{"$ref":"#/definitions/BigNumber"}},"additionalProperties":false,"required":["file","type","value"]},"HashComponentMiscStringData":{"type":"object","properties":{"type":{"enum":["boot-file","boot-hd-device","boot-partition-device"],"type":"string"},"value":{"type":"string"}},"additionalProperties":false,"required":["type","value"]}},"$schema":"http://json-schema.org/draft-07/schema#"}
+{"type":"object","properties":{"$schema":{"type":"string"},"inputFile":{"description":"Path to the input efi file to embed.","type":"string"},"outputFile":{"description":"Path to the output efi file to write.","type":"string"},"skipGenCode":{"description":"Whether to skip generating code","type":"boolean"},"skipExtract":{"description":"Whether to skip extracting source code\n(can be useful if the extraction was already done)","type":"boolean"},"skipMake":{"description":"Whether to skip calling make\n(can be useful to change the code before calling make)","type":"boolean"},"buildFolder":{"description":"Folder where to build the code.\nDefaults to a temporary folder that is removed when the build is finished.","type":"string"},"hashComponents":{"description":"Data to include in the hash for encryption.","type":"array","items":{"$ref":"#/definitions/HashComponent"}},"smbios":{"description":"Path to the input smbios dump file.\nCan be produced by: dmidecode --dump-bin <filePath>","type":"string"},"enrollSecureBoot":{"description":"Secure boot keys to enroll automatically if the system is in setup mode.","$ref":"#/definitions/SecureBootEnrollConfig"}},"additionalProperties":false,"required":["inputFile"],"definitions":{"HashComponent":{"anyOf":[{"$ref":"#/definitions/HashComponentRandom"},{"$ref":"#/definitions/HashEfiVariable"},{"$ref":"#/definitions/HashComponentSmbios"},{"$ref":"#/definitions/HashComponentHardDiskData"},{"$ref":"#/definitions/HashComponentHardDiskSize"},{"$ref":"#/definitions/HashComponentFileData"},{"$ref":"#/definitions/HashComponentFileSize"},{"$ref":"#/definitions/HashComponentMiscStringData"}]},"HashComponentRandom":{"type":"object","properties":{"type":{"type":"string","const":"random"},"length":{"type":"number"}},"additionalProperties":false,"required":["length","type"]},"HashEfiVariable":{"type":"object","properties":{"type":{"type":"string","const":"efivar"},"guid":{"type":"string"},"name":{"type":"string"},"value":{"$ref":"#/definitions/BinaryData"}},"additionalProperties":false,"required":["guid","name","type","value"]},"BinaryData":{"anyOf":[{"$ref":"#/definitions/BinaryDataFromFile"},{"$ref":"#/definitions/BinaryDataFromLiteral"},{"$ref":"#/definitions/BinaryDataFromBuffer"}]},"BinaryDataFromFile":{"type":"object","properties":{"type":{"type":"string","const":"file"},"file":{"type":"string"},"offset":{"type":"number"},"size":{"type":"number"}},"additionalProperties":false,"required":["file","type"]},"BinaryDataFromLiteral":{"type":"object","properties":{"type":{"$ref":"#/definitions/global.BufferEncoding"},"buffer":{"type":"string"}},"additionalProperties":false,"required":["buffer","type"]},"global.BufferEncoding":{"enum":["ascii","base64","base64url","binary","hex","latin1","ucs-2","ucs2","utf-16le","utf-8","utf16le","utf8"],"type":"string"},"BinaryDataFromBuffer":{"type":"object","properties":{"type":{"type":"string","const":"buffer"},"buffer":{"type":"object"}},"additionalProperties":false,"required":["buffer","type"]},"HashComponentSmbios":{"type":"object","properties":{"type":{"type":"string","const":"smbios"},"ref":{"$ref":"#/definitions/SmbiosFieldRef"},"value":{"type":"string"}},"additionalProperties":false,"required":["ref","type"]},"SmbiosFieldRef":{"anyOf":[{"type":"object","properties":{"table":{"$ref":"#/definitions/SmbiosTableRef"},"offset":{"type":"number"},"type":{"enum":["byte","dword","qword","string","uuid","word"],"type":"string"}},"additionalProperties":false,"required":["offset","table","type"]},{"enum":["baseboard-asset-tag","baseboard-manufacturer","baseboard-product-name","baseboard-serial-number","baseboard-version","bios-release-date","bios-revision","bios-vendor","bios-version","chassis-asset-tag","chassis-manufacturer","chassis-serial-number","chassis-version","processor-manufacturer","processor-version","system-family","system-manufacturer","system-product-name","system-serial-number","system-sku-number","system-uuid","system-version"],"type":"string"}]},"SmbiosTableRef":{"anyOf":[{"type":"object","properties":{"handle":{"type":"number"}},"additionalProperties":false,"required":["handle"]},{"type":"object","properties":{"type":{"type":"number"},"index":{"type":"number"}},"additionalProperties":false,"required":["type"]},{"enum":["32-bit Memory Error","64-bit Memory Error","Additional Information","Baseboard","Boot Integrity Services","Built-in Pointing Device","Cache","Chassis","Cooling Device","Electrical Current Probe","Firmware Inventory","Firmware Language","Group Associations","Hardware Security","IPMI Device","Management Controller Host Interface","Management Device","Management Device Component","Management Device Threshold Data","Memory Array Mapped Address","Memory Channel","Memory Controller","Memory Device","Memory Device Mapped Address","Memory Module","OEM Strings","Onboard Devices","Onboard Devices Extended Information","Out-of-band Remote Access","Physical Memory Array","Platform Firmware","Port Connector","Portable Battery","Power Supply","Processor","Processor Additional Information","String Property","System","System Boot","System Configuration Options","System Event Log","System Power Controls","System Reset","System Slots","TPM Device","Temperature Probe","Voltage Probe"],"type":"string"},{"type":"number"}]},"HashComponentHardDiskData":{"type":"object","properties":{"type":{"type":"string","const":"hd-data"},"device":{"type":"string"},"offsetRef":{"enum":["end","start"],"type":"string"},"offset":{"$ref":"#/definitions/BigNumber"},"value":{"anyOf":[{"$ref":"#/definitions/BinaryDataFromFile"},{"$ref":"#/definitions/BinaryDataFromLiteral"},{"$ref":"#/definitions/BinaryDataFromBuffer"},{"$ref":"#/definitions/BinaryMissingData"}]}},"additionalProperties":false,"required":["offset","offsetRef","type","value"]},"BigNumber":{"type":["string","number"]},"BinaryMissingData":{"type":"object","properties":{"type":{"type":"string","const":"missing"},"size":{"type":"number"}},"additionalProperties":false,"required":["type"]},"HashComponentHardDiskSize":{"type":"object","properties":{"type":{"type":"string","const":"hd-size"},"device":{"type":"string"},"value":{"$ref":"#/definitions/BigNumber"}},"additionalProperties":false,"required":["type","value"]},"HashComponentFileData":{"type":"object","properties":{"type":{"type":"string","const":"file-data"},"device":{"type":"string"},"file":{"type":"string"},"offsetRef":{"enum":["end","full","start"],"type":"string"},"offset":{"type":["string","number"]},"value":{"anyOf":[{"$ref":"#/definitions/BinaryDataFromFile"},{"$ref":"#/definitions/BinaryDataFromLiteral"},{"$ref":"#/definitions/BinaryDataFromBuffer"},{"$ref":"#/definitions/BinaryMissingData"}]}},"additionalProperties":false,"required":["file","type","value"]},"HashComponentFileSize":{"type":"object","properties":{"type":{"type":"string","const":"file-size"},"device":{"type":"string"},"file":{"type":"string"},"value":{"$ref":"#/definitions/BigNumber"}},"additionalProperties":false,"required":["file","type","value"]},"HashComponentMiscStringData":{"type":"object","properties":{"type":{"enum":["boot-file","boot-hd-device","boot-partition-device"],"type":"string"},"value":{"type":"string"}},"additionalProperties":false,"required":["type","value"]},"SecureBootEnrollConfig":{"type":"object","properties":{"kek":{"$ref":"#/definitions/BinaryData"},"db":{"$ref":"#/definitions/BinaryData"},"pk":{"$ref":"#/definitions/BinaryData"}},"additionalProperties":false,"required":["db","kek","pk"]}},"$schema":"http://json-schema.org/draft-07/schema#"}

package/type.d.ts

@@ -26,6 +26,12 @@ export interface HashComponentRandom {
     type: "random";
     length: number;
 }
+export interface HashEfiVariable {
+    type: "efivar";
+    guid: string;
+    name: string;
+    value: BinaryData;
+}
 export interface HashComponentSmbios {
     type: "smbios";
     ref: SmbiosFieldRef;
@@ -61,7 +67,12 @@ export interface HashComponentMiscStringData {
     type: "boot-hd-device" | "boot-partition-device" | "boot-file";
     value: string;
 }
-export type HashComponent = HashComponentRandom | HashComponentSmbios | HashComponentFileData | HashComponentFileSize | HashComponentHardDiskData | HashComponentHardDiskSize | HashComponentMiscStringData;
+export type HashComponent = HashComponentRandom | HashEfiVariable | HashComponentSmbios | HashComponentFileData | HashComponentFileSize | HashComponentHardDiskData | HashComponentHardDiskSize | HashComponentMiscStringData;
+export interface SecureBootEnrollConfig {
+    kek: BinaryData;
+    db: BinaryData;
+    pk: BinaryData;
+}
 export interface Config {
     $schema?: string;
     /**
@@ -100,4 +111,8 @@ export interface Config {
      * Can be produced by: dmidecode --dump-bin <filePath>
      */
     smbios?: string;
+    /**
+     * Secure boot keys to enroll automatically if the system is in setup mode.
+     */
+    enrollSecureBoot?: SecureBootEnrollConfig;
 }