src/lib/libsecureboot, branch releng/13.5

Remove $FreeBSD$: one-line bare tag

2023-08-23T17:43:33Z

Remove /^\s*\$FreeBSD\$$\n/ Similar commit in main: (cherry picked from commit 05248206f720)

Remove $FreeBSD$: one-line sh pattern

2023-08-23T17:43:30Z

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/ Similar commit in main: (cherry picked from commit d0b2dbfa0ecf)

Remove $FreeBSD$: one-line .c pattern

2023-08-23T17:43:26Z

Remove /^[\s*]*__FBSDID$"\$FreeBSD\$"$;?\s*\n/ Similar commit in main: (cherry picked from commit 1d386b48a555)

Remove $FreeBSD$: one-line .h pattern

2023-08-23T17:43:22Z

Remove /^\s*\*+\s*\$FreeBSD\$.*$\n/ Similar commit in main: (cherry picked from commit 42b388439bd3)

Remove $FreeBSD$: two-line .h pattern

2023-08-23T17:43:21Z

Remove /^\s*\*\n \*\s+\$FreeBSD\$$\n/ Similar commit in main: (cherry picked from commit b3e7694832e8)

Merge bearssl-20220418

2023-04-16T02:50:10Z

Main change is a callback for checking validity period of certificates. Merge commit 'f6acb9b9f81c96ae7c9592bee1bb89c4357cc3e5' Add -DHAVE_BR_X509_TIME_CHECK to libsecureboot/Makefile.inc (cherry picked from commit cc9e6590773dba57440750c124173ed531349a06)

lib/libsecureboot: Fix some typos

2023-04-14T07:26:10Z

Signed-off-by: Elyes HAOUAS Pull Request: https://github.com/freebsd/freebsd-src/pull/544 (cherry picked from commit cb25444c05071463d7f690590ed6288b015ec0fb)

Add -S option to veriexec

2023-04-14T07:25:45Z

During software installation, use veriexec -S to strictly enforce certificate validity checks (notBefore, notAfter). Otherwise ignore certificate validity period. It is generally unacceptible for the Internet to stop working just because someone did not upgrade their infrastructure for a decade. Sponsored by: Juniper Networks, Inc. Reviewed by: sebastien.bini_stormshield.eu Differential Revision: https://reviews.freebsd.org/D35758 (cherry picked from commit ab4f0a15188087e407426aac2a720035fd2a3b0a)

libsecureboot: Do not propagate empty string

2023-04-14T07:25:05Z

If Trust Anchors are provided by UEFI and not compiled into libsecureboot the segmentation fault occurs due to empty or NULL string usage. Obtained from: Semihalf Reviewed by: sjg Differential revision: https://reviews.freebsd.org/D35120 (cherry picked from commit e6ef5042e485f74e7233a9974010b16a7316167e)

Update libsecureboot

2023-04-14T05:19:33Z

Preparation for updating bearssl, pull in updates to libsecureboot. o fix handling of some out-of-memory cases o allow more control over reporting of Verified/Unverified files. this helps boot time when console output is slow o recheck verbose/debug level after reading any unverified file o more debug support for vectx o hash_string to support fake stat for tftp o tests/tvo add -v to simply verify signatures o vets.c allow for HAVE_BR_X509_TIME_CHECK which will greatly simplify verification in loader o report date when certificate fails validity period checks Reviewed by: stevek Sponsored by: Juniper Networks, Inc. (cherry picked from commit 666554111a7e6b4c1a9a6ff2e73f12cd582573bb)