DxeImageVerification Support

.pytool/CISettings.py

@@ -167,8 +167,13 @@ def GetDependencies(self):
         return [
             {
                 "Path": "MU_BASECORE",
-                "Url": "https://github.com/microsoft/mu_basecore.git",
-                "Commit": "922377cb580e03c45628ddb4e0a0871ccf2f6f2d"
+                # MU_CHANGE [TEMP] - pin to fork commit carrying the new
+                # BaseCryptLib/OneCrypto APIs (GetAuthenticodeHash,
+                # GetTrustAnchorX509FromAuthData, FreeTrustAnchorX509Cache,
+                # GetAuthenticodeHashAlgorithm, X509GetTbsCertHash). Revert to
+                # https://github.com/microsoft/mu_basecore.git once merged.
+                "Url": "https://github.com/flickdm/mu_basecore.git",
+                "Commit": "709ab9b016ecf0555142ba5bc0da55227f34a7cd"
             },
             {
                 "Path": "Features/MM_SUPV",

MbedTlsPkg/Library/BaseCryptLib/BaseCryptLib.inf

@@ -43,6 +43,8 @@
   Pk/CryptDhNull.c
   Pk/CryptX509.c
   Pk/CryptAuthenticode.c
+  Pk/CryptAuthenticodeHash.c # MU_CHANGE
+  Pk/CryptTrustAnchor.c # MU_CHANGE
   Pk/CryptTs.c
   Pk/CryptRsaPss.c
   Pk/CryptRsaPssSign.c
@@ -78,6 +80,13 @@
   SynchronizationLib
 [Protocols]
   gEfiMpServiceProtocolGuid
+
+[Guids]
+  ## SOMETIMES_CONSUMES ## GUID # Image hash type used by GetAuthenticodeHash
+  gEfiCertSha1Guid    # MU_CHANGE
+  gEfiCertSha256Guid  # MU_CHANGE
+  gEfiCertSha384Guid  # MU_CHANGE
+  gEfiCertSha512Guid  # MU_CHANGE
 #
 # Remove these [BuildOptions] after this library is cleaned up
 #

MbedTlsPkg/Library/BaseCryptLib/PeiCryptLib.inf

@@ -56,6 +56,8 @@
   Pk/CryptDhNull.c
   Pk/CryptX509Null.c
   Pk/CryptAuthenticodeNull.c
+  Pk/CryptAuthenticodeHashNull.c # MU_CHANGE
+  Pk/CryptTrustAnchorNull.c # MU_CHANGE
   Pk/CryptTsNull.c
   Pk/CryptRsaPss.c
   Pk/CryptRsaPssSignNull.c