)]}' { "log": [ { "commit": "719fc794c77ab6d09fe3cfaa563b18cf778a4d15", "tree": "f29fc3e9b0eb8a109a644ff7c97eb5b4f0365a3f", "parents": [ "e82a34f7b1dead85bd595aab5a9471c776d5ddbe" ], "author": { "name": "Willy Tu", "email": "wltu@google.com", "time": "Mon Dec 15 22:26:20 2025 +0000" }, "committer": { "name": "Willy Tu", "email": "wltu@google.com", "time": "Tue Dec 16 09:44:34 2025 -0800" }, "message": "key_rotation: Support image_family restriction\n\nCheck the IMAGE_FAMILY from BIOS key against the image family of the BIOS image.\n\nTested:\n- Failure Example:\n```\nDec 15 23:12:49 ladai15-nfd11.prod.google.com msvfud[4718]: libcr51sign_validate: potential image descriptor found @10000\nDec 15 23:12:49 ladai15-nfd11.prod.google.com msvfud[4718]: check cr51hash: b15fef5a03633bc69e1b1fea284e199272a331b66234b6da4304766a53306133\nDec 15 23:12:49 ladai15-nfd11.prod.google.com msvfud[4718]: Hoth RoT config defined 0 KEY_ROTATION_CHUNK_TYPE_CODE_BASH\nDec 15 23:12:49 ladai15-nfd11.prod.google.com msvfud[4718]: Not match any trusted bios allowed hash\nDec 15 23:12:49 ladai15-nfd11.prod.google.com msvfud[4718]: Calculating fingerprint of key in CR51 signature structure with scheme(SIGNATURE_RSA3072_PKCS15), size(780)\nDec 15 23:12:49 ladai15-nfd11.prod.google.com msvfud[4718]: fingerprint of key in CR51 signature: ba6681661fb19e5f5fa59453257f8a5edc020787caf7d60668ab8dfc40de7b8d\nDec 15 23:12:49 ladai15-nfd11.prod.google.com msvfud[4718]: Hoth RoT config defined 1 KEY_ROTATION_CHUNK_TYPE_CODE_BKEY\nDec 15 23:12:49 ladai15-nfd11.prod.google.com msvfud[4718]: trusted bios key finger print in KEY_ROTATION_CHUNK_TYPE_CODE_BKEY_0: ba6681661fb19e5f5fa59453257f8a5edc020787caf7d60668ab8dfc40de7b8d\nDec 15 23:12:49 ladai15-nfd11.prod.google.com msvfud[4718]: Match trusted bios key finger print in KEY_ROTATION_CHUNK_TYPE_CODE_BKEY_0, but mismatch IMAGE_FAMILY 117 vs. 162\nDec 15 23:12:49 ladai15-nfd11.prod.google.com msvfud[4718]: Not match any trusted bios key\nDec 15 23:12:49 ladai15-nfd11.prod.google.com msvfud[4718]: validate_signature_with_key_in_signature_struct: key in signature struct is not trusted\n```\n\nGoogle-Bug-Id: 466454964\nGoogle-Bug-Id: 468135652\nChange-Id: Iaba285d29681529a1b21610ae3434162f4c1471d\nSigned-off-by: Willy Tu \u003cwltu@google.com\u003e\n" }, { "commit": "e82a34f7b1dead85bd595aab5a9471c776d5ddbe", "tree": "6d91f8044704617448afcef038022e0cbe74762d", "parents": [ "3ddbaa47b17f3510ad892365c20d576ddea1444c" ], "author": { "name": "Dan Zhang", "email": "zhdaniel@google.com", "time": "Mon Jun 02 04:49:57 2025 +0000" }, "committer": { "name": "Dan Zhang", "email": "zhdaniel@google.com", "time": "Fri Jul 11 23:56:09 2025 +0000" }, "message": "flashupdate: Support key rotation\n\nIf the RoT-Config support BIOS Key rotation, the Cr51Validator will\nuse BIOS trust bundle information fetched from RoT config to validate\nthe BIOS CR51 descriptor.\n\nThe BIOS trust bundle will be:\n* the trusted signature verification (public) key\u0027s finger printer.\n* the allowed cr51 descriptor hash\n\nIf the RoT-Config does not support, will fallback to use key information\nbuilt-in gBMC firmware.\n\nRoT-Config support BIOS key rotation means the RoT-Config record contain\nat least one public key finger printer chunk.\n\nFor dev signed bios, the dev signature verification key will only be\nbuilt-in gBMC image. So when dev signed bios is allowed, the built-in\nkey will be tried if image cannot be valided by keys within RoT-Config.\n\nTested:\nwith testing bios RoT configraution\n\nGoogle-Bug-Id: 421797519\nChange-Id: I7ee686b94c49113ee8f406f19628851de21868b6\nSigned-off-by: Dan Zhang \u003czhdaniel@google.com\u003e\n" }, { "commit": "3ddbaa47b17f3510ad892365c20d576ddea1444c", "tree": "3f6e3de56995c2c66f82c5ffb2bde49ec452adfb", "parents": [ "ce042ef84b1becae83eb12d279ebfd7b68ee62b5" ], "author": { "name": "Vamsy Krishna Nooney", "email": "vamsykn@google.com", "time": "Tue Dec 10 13:09:37 2024 -0800" }, "committer": { "name": "Vamsy Krishna Nooney", "email": "vamsykn@google.com", "time": "Tue Dec 10 13:09:42 2024 -0800" }, "message": "reformat for clang-format-18\n\nGoogle-Bug-Id: 340631818\nChange-Id: I9cbb2e9a18fb3344e25660ea80a5645417d37942\nSigned-off-by: Vamsy Krishna Nooney \u003cvamsykn@google.com\u003e\n" }, { "commit": "ce042ef84b1becae83eb12d279ebfd7b68ee62b5", "tree": "1eb85a6a2eeaceae86c417cf2f041fcecd9c65a3", "parents": [ "ff1207f5db2fc22094b21dfe61209cd318a5bb4d" ], "author": { "name": "Vamsy Krishna Nooney", "email": "vamsykn@google.com", "time": "Mon Dec 09 13:32:33 2024 -0800" }, "committer": { "name": "Vamsy Krishna Nooney", "email": "vamsykn@google.com", "time": "Mon Dec 09 18:25:00 2024 -0800" }, "message": "Move flashtools to gbmc public\n\nTested:\nUnit tests successful.\nroot@56e9c2889b3f:/workspace# ninja test -C build\nninja: Entering directory `build\u0027\n[0/1] Running all tests.\n 1/30 flashtools / hello OK 0.13s\n 2/30 flasher / args OK 0.12s\n 3/30 flasher / convert OK 0.12s\n 4/30 flasher / device OK 0.11s\n 5/30 flasher / device/fake OK 0.11s\n 6/30 flasher / device/mutated OK 0.11s\n 7/30 flasher / file OK 0.10s\n 8/30 flasher / file/memory OK 0.10s\n 9/30 flasher / file/simple OK 0.10s\n10/30 flasher / mod OK 0.09s\n11/30 flasher / ops/auto OK 0.09s\n12/30 flasher / ops/erase OK 0.09s\n13/30 flasher / ops/read OK 0.08s\n14/30 flasher / ops/verify OK 0.08s\n15/30 flasher / ops/write OK 0.07s\n16/30 flasher / util OK 0.07s\n17/30 flashupdate / flashupdate/args OK 0.07s\n18/30 flashupdate / flashupdate/config OK 0.06s\n19/30 flashupdate / flashupdate/flash OK 0.06s\n20/30 flashupdate / flashupdate/version OK 0.06s\n21/30 flashupdate / hash_descriptor OK 0.04s\n22/30 flashupdate / read OK 0.03s\n23/30 flashupdate / info OK 0.05s\n24/30 flashupdate / invalidate OK 0.05s\n25/30 flashupdate / update_state OK 0.05s\n26/30 flashupdate / update_version OK 0.04s\n27/30 flashupdate / verify_staging OK 0.03s\n28/30 flashupdate / fetch_version OK 0.02s\n29/30 flashupdate / erase OK 0.02s\n30/30 flashupdate / write OK 0.03s\n\nOk: 30\nExpected Fail: 0\nFail: 0\nUnexpected Pass: 0\nSkipped: 0\nTimeout: 0\n\nChange-Id: I43d2092f5102d56726055ba2345af16930838e93\nSigned-off-by: Vamsy Krishna Nooney \u003cvamsykn@google.com\u003e\n" }, { "commit": "ff1207f5db2fc22094b21dfe61209cd318a5bb4d", "tree": "4b825dc642cb6eb9a060e54bf8d69288fbee4904", "parents": [], "author": { "name": "Vivekanand Veeracholan", "email": "vveerach@google.com", "time": "Mon Dec 09 13:17:43 2024 -0800" }, "committer": { "name": "Vivekanand Veeracholan", "email": "vveerach@google.com", "time": "Mon Dec 09 13:17:43 2024 -0800" }, "message": "Empty initial commit\n" } ] }