From: Zbigniew Jędrzejewski-Szmek <zbyszek@amutable.com>
Date: Thu, 23 Apr 2026 09:48:56 +0000 (+0200)
Subject: measure: also measure forgotten .efifw section
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6fdc0f96f778bfce6dec92adf3031660bb1daf12;p=thirdparty%2Fsystemd.git

measure: also measure forgotten .efifw section
---

diff --git a/src/measure/measure-tool.c b/src/measure/measure-tool.c
index af52e5aeb86..09c04d888c8 100644
--- a/src/measure/measure-tool.c
+++ b/src/measure/measure-tool.c
@@ -292,9 +292,11 @@ static int parse_argv(int argc, char *argv[], char ***ret_args) {
                 OPTION_LONG_DATA("profile", "PATH", UNIFIED_SECTION_PROFILE,
                                  "Path to profile file (→ .profile)"): {}
                 OPTION_LONG_DATA("hwids", "PATH", UNIFIED_SECTION_HWIDS,
-                                 "Path to HWIDs file (→ .hwids)"):
+                                 "Path to HWIDs file (→ .hwids)"): {}
+                OPTION_LONG_DATA("efifw", "PATH", UNIFIED_SECTION_EFIFW,
+                                 "Path to EFI firmware file (→ .efifw)"): {}
                         /* Make sure that if new sections are added, the list here is updated. */
-                        assert_cc(UNIFIED_SECTION_HWIDS + 1 + 1 /* FIXME */ == _UNIFIED_SECTION_MAX);
+                        assert_cc(UNIFIED_SECTION_EFIFW + 1 == _UNIFIED_SECTION_MAX);
                         assert(opt->data < _UNIFIED_SECTION_MAX);
 
                         r = parse_path_argument(arg, /* suppress_root= */ false, arg_sections + opt->data);
diff --git a/test/units/TEST-70-TPM2.measure.sh b/test/units/TEST-70-TPM2.measure.sh
index bf30bd57b33..30fa51e5213 100755
--- a/test/units/TEST-70-TPM2.measure.sh
+++ b/test/units/TEST-70-TPM2.measure.sh
@@ -45,6 +45,12 @@ cat >/tmp/result.json <<EOF
 EOF
 "$SD_MEASURE" calculate --linux=/tmp/tpmdata1 --initrd=/tmp/tpmdata2 --bank=sha1 --bank=sha256 --bank=sha384 --bank=sha512 --phase=foo -j | diff -u - /tmp/result.json
 
+cat >/tmp/result <<EOF
+11:sha1=8a625cbc3c497b9a86dcf4f6a32582895ce969bb
+EOF
+"$SD_MEASURE" calculate \
+              --{linux,osrel,cmdline,initrd,ucode,splash,dtb,dtbauto,uname,sbat,pcrpkey,profile,hwids,efifw}=/tmp/tpmdata1 \
+              --bank=sha1 --phase=foo | cmp - /tmp/result
 rm /tmp/result /tmp/result.json
 
 # Generate key pair