From 48c8fc832126636f7bd248a3310537683c7a1b08 Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Mon, 6 Oct 2025 12:41:58 +0000 Subject: [PATCH] pvimg: info: Warn when the SE header has not been verified MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a warning to notify the user when the Secure Execution (SE) header is present but its integrity and authenticity has not been verified. This makes the lack of validation explicit and helps avoid unintended use of untrusted data. Reviewed-by: Steffen Eiden Signed-off-by: Marc Hartmayer Signed-off-by: Jan Höppner --- rust/pvimg/src/cmd/info.rs | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rust/pvimg/src/cmd/info.rs b/rust/pvimg/src/cmd/info.rs index 2f593cf0..2abd2a09 100644 --- a/rust/pvimg/src/cmd/info.rs +++ b/rust/pvimg/src/cmd/info.rs @@ -5,7 +5,7 @@ use std::io::Write; use anyhow::Result; -use log::info; +use log::{info, warn}; use pv::{ misc::{open_file, read_file}, request::SymKey, @@ -32,6 +32,7 @@ pub fn info(opt: &InfoArgs) -> Result { SymKey::try_from_data(hdr.key_type(), read_file(key_path, "Reading key")?.into())?; serde_json::to_writer_pretty(&mut output, &hdr.decrypt(&key)?)?; } else { + warn!("WARNING: The Secure Execution header integrity and authenticity was not verified. Specify '--hdr-key' to authenticate it. Do not trust the data without verification."); serde_json::to_writer_pretty(&mut output, &hdr)?; } writeln!(output)?;