Revert "ukify: introduce new --measure-base= switch"

This reverts commit bc3e2c5a5774ae7b212817d04e04abccf30088ae.

diff --git a/man/ukify.xml b/man/ukify.xml
index a11eb85c917e4af7fb56968db2bcb0f8f0a5933d..902736d4ed88689ba4b8babfa46a62d211d16644 100644 (file)
--- a/man/ukify.xml
+++ b/man/ukify.xml
@@ -240,19 +240,6 @@
           <xi:include href="version-info.xml" xpointer="v257"/></listitem>
         </varlistentry>
 
-        <varlistentry>
-          <term><option>--measure-base=<replaceable>PATH</replaceable></option></term>
-
-          <listitem><para>Takes a path to an existing PE file to use as base profile, for measuring
-          multi-profile UKIs. When calculating the PCR values, this has the effect that the sections
-          specified on the command line are combined with any sections from the PE file specified here (up to
-          the first <literal>.profile</literal> section, and only if not already specified on the command
-          line). Typically, this is used together with <option>--extend=</option> to both import and use as
-          measurement base an existing UKI.</para>
-
-          <xi:include href="version-info.xml" xpointer="v257"/></listitem>
-        </varlistentry>
-
         <varlistentry>
           <term><option>--tools=<replaceable>DIRS</replaceable></option></term>
 

diff --git a/src/ukify/ukify.py b/src/ukify/ukify.py
index 55c40164ae94f8ba01c1f9df3826cfc0a94e64c8..1a8c9507eeba4f95e85f507d5a5311a214a2c045 100755 (executable)
--- a/src/ukify/ukify.py
+++ b/src/ukify/ukify.py
@@ -503,14 +503,6 @@ def pe_strip_section_name(name):
 
 
 def call_systemd_measure(uki, opts):
-
-    if not opts.measure and not opts.pcr_private_keys:
-        return
-
-    measure_sections = ('.linux', '.osrel', '.cmdline', '.initrd',
-                       '.ucode', '.splash', '.dtb', '.uname',
-                       '.sbat', '.pcrpkey', '.profile')
-
     measure_tool = find_tool('systemd-measure',
                              '/usr/lib/systemd/systemd-measure',
                              opts=opts)
@@ -519,60 +511,15 @@ def call_systemd_measure(uki, opts):
 
     # PCR measurement
 
-    to_measure = []
-    tflist = []
-
-    # First, pick up the sections we shall measure now */
-    for s in uki.sections:
-        if not s.measure:
-            continue
-
-        if s.content is not None:
-            to_measure.append(f"--{s.name.removeprefix('.')}={s.content}")
-        else:
-            raise ValueError(f"Don't know how to measure section {s.name}");
-
-    # And now iterate through the base profile and measure what we haven't measured above
-    if opts.measure_base is not None:
-        pe = pefile.PE(opts.measure_base, fast_load=True)
-
-        # Find matching PE section in base image
-        for base_section in pe.sections:
-            name = pe_strip_section_name(base_section.Name)
-
-            # If we reach the first .profile section the base is over
-            if name == ".profile":
-                break
-
-            # Only some sections are measured
-            if name not in measure_sections:
-                continue
-
-            # Check if this is a section we already covered above
-            already_covered = False
-            for s in uki.sections:
-                if s.measure and name == s.name:
-                    already_covered = True
-                    break;
-
-            if already_covered:
-                continue
-
-            # Split out section and use as base
-            tf = tempfile.NamedTemporaryFile()
-            tf.write(base_section.get_data(length=base_section.Misc_VirtualSize))
-            tf.flush()
-            tflist.append(tf)
-
-            to_measure.append(f"--{name.removeprefix('.')}={tf.name}")
-
     if opts.measure:
         pp_groups = opts.phase_path_groups or []
 
         cmd = [
             measure_tool,
             'calculate',
-            *to_measure,
+            *(f"--{s.name.removeprefix('.')}={s.content}"
+              for s in uki.sections
+              if s.measure),
             *(f'--bank={bank}'
               for bank in banks),
             # For measurement, the keys are not relevant, so we can lump all the phase paths
@@ -592,7 +539,9 @@ def call_systemd_measure(uki, opts):
         cmd = [
             measure_tool,
             'sign',
-            *to_measure,
+            *(f"--{s.name.removeprefix('.')}={s.content}"
+              for s in uki.sections
+              if s.measure),
             *(f'--bank={bank}'
               for bank in banks),
         ]
@@ -1481,14 +1430,6 @@ CONFIG_ITEMS = [
         config_key = 'UKI/Extend',
     ),
 
-    ConfigItem(
-        '--measure-base',
-        metavar = 'UKI',
-        type = pathlib.Path,
-        help = 'path to existing UKI file whose relevant sections shall be used as base for PCR11 prediction',
-        config_key = 'UKI/MeasureBase',
-    ),
-
     ConfigItem(
         '--pcr-banks',
         metavar = 'BANK…',