From 8d40b5c97adfa78737d00aab6a6b651c9a461492 Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Mon, 9 Feb 2026 10:24:19 +0100 Subject: [PATCH] pvimg info: Add '--show-secrets' flag MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add '--show-secrets' flag to 'pvimg info' to make secret output explicit and avoid accidental disclosure. Reviewed-by: Steffen Eiden Signed-off-by: Marc Hartmayer Signed-off-by: Jan Höppner --- rust/pvimg/src/cli.rs | 28 ++++++++++++++++++++++++---- rust/pvimg/src/cmd/info.rs | 13 ++++++++++--- 2 files changed, 34 insertions(+), 7 deletions(-) diff --git a/rust/pvimg/src/cli.rs b/rust/pvimg/src/cli.rs index 7f4962da..1df1d929 100644 --- a/rust/pvimg/src/cli.rs +++ b/rust/pvimg/src/cli.rs @@ -365,12 +365,32 @@ pub struct InfoArgs { #[arg(long, value_parser=OutputFormatSpecParser::default())] pub format: Option, - /// Use the key in FILE to decrypt the Secure Execution header. + /// Use the key in FILE to verify the Secure Execution header and optionally + /// use '--show-secrets' to decrypt it. /// - /// It is the key that was specified with the command line option - /// '--hdr-key' at the Secure Execution image creation. - #[arg(long, value_name = "FILE", value_hint = ValueHint::FilePath, alias = "key")] + /// The key must be the same key that was specified with '--hdr-key' when the + /// Secure Execution image was created. The key is used to: + /// 1. Verify the integrity and authenticity of the header + /// 2. Optionally decrypt secrets with '--show-secrets' + /// + /// Without this option, the information is displayed, but NOT verified, and + /// a warning is printed. The displayed data should not be trusted without + /// verification. + #[arg(long, value_name = "FILE", value_hint = ValueHint::FilePath, alias = "key", verbatim_doc_comment)] pub hdr_key: Option, + + /// This option reveals sensitive information that is normally encrypted in + /// the header, such as: + /// - Customer communication key (CCK) + /// - Image encryption key + /// - Other confidential data + /// + /// SECURITY WARNING: Only use this option in secure, trusted environments. + /// The decrypted secrets should never be exposed in untrusted systems. + /// + /// This option requires '--hdr-key' to decrypt the header. + #[arg(long, requires = "hdr_key", verbatim_doc_comment)] + pub show_secrets: bool, } #[derive(Args, Debug)] diff --git a/rust/pvimg/src/cmd/info.rs b/rust/pvimg/src/cmd/info.rs index bb23c7a0..e11c01ae 100644 --- a/rust/pvimg/src/cmd/info.rs +++ b/rust/pvimg/src/cmd/info.rs @@ -38,9 +38,16 @@ pub fn info(opt: &InfoArgs) -> Result { let decrypted_hdr = hdr .decrypt(&key) .context("Failed to authenticate and decrypt the Secure Execution header")?; - SeH::DecryptedSeHdr { - se_hdr: decrypted_hdr, - verified: true, + if opt.show_secrets { + SeH::DecryptedSeHdr { + se_hdr: decrypted_hdr, + verified: true, + } + } else { + SeH::SeHdr { + se_hdr: hdr, + verified: true, + } } } else { warn!("WARNING: The Secure Execution header integrity and authenticity was not verified. Specify '--hdr-key' to authenticate it. Do not trust the data without verification.");