kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

pvimg: info: Warn when the SE header has not been verified

Browse Source 
Add a warning to notify the user when the Secure Execution (SE) header
is present but its integrity and authenticity has not been verified.
This makes the lack of validation explicit and helps avoid unintended
use of untrusted data.

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2025-10-06 12:41:58 +00:00
committed by Jan Höppner
parent 19995638e9
commit 48c8fc8321
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
rust/pvimg/src/cmd/info.rs
View File

@@ -5,7 +5,7 @@
use std::io::Write;
use anyhow::Result;
use log::info;
use log::{info, warn};
use pv::{
misc::{open_file, read_file},
request::SymKey,
@@ -32,6 +32,7 @@ pub fn info(opt: &InfoArgs) -> Result<OwnExitCode> {
SymKey::try_from_data(hdr.key_type(), read_file(key_path, "Reading key")?.into())?;
serde_json::to_writer_pretty(&mut output, &hdr.decrypt(&key)?)?;
} else {
warn!("WARNING: The Secure Execution header integrity and authenticity was not verified. Specify '--hdr-key' to authenticate it. Do not trust the data without verification.");
serde_json::to_writer_pretty(&mut output, &hdr)?;
}
writeln!(output)?;