modulepackage
0.0.0-20240726104243-6363e875afc6
Repository: https://github.com/canonical/tcglog-parser.git
Documentation: pkg.go.dev
# README
TCG Log Parser
This repository contains a go library for parsing TCG event logs. Also included is a simple command line tool that prints details of log entries to the console.
Relevant specifications
# Functions
ComputeEFIGPTDataDigest computes a UEFI_GPT_DATA digest from the supplied data.
ComputeEFIVariableDataDigest computes the EFI_VARIABLE_DATA digest associated with the supplied parameters.
ComputeEventDigest computes the digest associated with the supplied event data bytes, for events where the digest is a tagged hash of the event data.
ComputeSeparatorEventDigest computes the digest associated with the separator event.
ComputeStringEventDigest computes the digest associated with the supplied string, for events where the data is not informative.
ComputeSystemdEFIStubCommandlineDigest computes the digest measured by the systemd EFI stub linux loader for the specified kernel commandline.
No description provided by the author
NewLogForTesting creates a new log instance from the supplied list of events.
No description provided by the author
No description provided by the author
ReadLog reads an event log read from r using the supplied options.
# Constants
EV_ACTION.
EV_COMPACT_HASH.
EV_CPU_MICROCODE.
EV_EFI_ACTION.
EV_EFI_BOOT_SERVICES_APPLICATION.
EV_EFI_BOOT_SERVICES_DRIVER.
EV_EFI_EVENT_BASE.
EV_EFI_GPT_EVENT.
EV_EFI_GPT_EVENT2.
EV_EFI_HANDOFF_TABLES.
EV_EFI_HANDOFF_TABLES2.
EV_EFI_HCRTM_EVENT.
EV_EFI_PLATFORM_FIRMWARE_BLOB.
EV_EFI_PLATFORM_FIRMWARE_BLOB2.
EV_EFI_RUNTIME_SERVICES_DRIVER.
EV_EFI_SPDM_DEVICE_AUTHORITY.
EV_EFI_SPDM_DEVICE_POLICY.
EV_EFI_SPDM_FIRMWARE_BLOB.
EV_EFI_SPDM_FIRMWARE_CONFIG.
EV_EFI_VARIABLE_AUTHORITY.
EV_EFI_VARIABLE_BOOT.
EV_EFI_VARIABLE_BOOT2.
EV_EFI_VARIABLE_DRIVER_CONFIG.
EV_EVENT_TAG.
EV_IPL.
EV_IPL_PARTITION_DATA.
EV_NO_ACTION.
EV_NONHOST_CODE.
EV_NONHOST_CONFIG.
EV_NONHOST_INFO.
EV_OMIT_BOOT_DEVICE_EVENTS.
EV_PLATFORM_CONFIG_FLAGS.
EV_POST_CODE.
EV_POST_CODE2.
EV_PREBOOT_CERT.
EV_S_CRTM_CONTENTS.
EV_S_CRTM_VERSION.
EV_SEPARATOR.
EV_TABLE_OF_DEVICES.
GrubCmd indicates that the data measured by GRUB is associated with a GRUB command.
KernelCmdline indicates that the data measured by GRUB is associated with a kernel commandline.
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
# Variables
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
No description provided by the author
# Structs
EFIConfigurationTable corresponds to UEFI_CONFIGURATION_TABLE.
EFIGPTData corresponds to UEFI_GPT_DATA and is the event data for EV_EFI_GPT_EVENT and EV_EFI_GPT_EVENT2 events.
EFIHandoffTablePointers corresponds to UEFI_HANDOFF_TABLE_POINTERS and is the event data for EV_EFI_HANDOFF_TABLES events.
EFIHandoffTablePointers2 corresponds to UEFI_HANDOFF_TABLE_POINTERS2 and is the event data for EV_EFI_HANDOFF_TABLES2 events.
EFIImageLoadEvent corresponds to UEFI_IMAGE_LOAD_EVENT and is informative.
EFIPlatformFirmwareBlob corresponds to UEFI_PLATFORM_FIRMWARE_BLOB and is the event data for EV_EFI_PLATFORM_FIRMWARE_BLOB and some EV_POST_CODE events.
EFIPlatformFirmwareBlob2 corresponds to UEFI_PLATFORM_FIRMWARE_BLOB2 and is the event data for EV_EFI_PLATFORM_FIRMWARE_BLOB2 and some EV_POST_CODE2 events.
EFISpecIdEventAlgorithmSize represents a digest algorithm and its length and corresponds to the TCG_EfiSpecIdEventAlgorithmSize type.
EFIVariableData corresponds to the EFI_VARIABLE_DATA type and is the event data associated with the measurement of an EFI variable.
Event corresponds to a single event in an event log.
GrubStringEventData represents the data associated with an event measured by GRUB.
Log corresponds to a parsed event log.
LogOptions allows the behaviour of Log to be controlled.
SeparatorEventData is the event data associated with a EV_SEPARATOR event.
SP800_155_PlatformIdEventData corresponds to the event data for a SP800-155 Event EV_NO_ACTION event.
SP800_155_PlatformIdEventData2 corresponds to the event data for a SP800-155 Event2 EV_NO_ACTION event.
SP800_155_PlatformIdEventData3 corresponds to the event data for a SP800-155 Event3 EV_NO_ACTION event.
Spec corresponds to the TCG specification that an event log conforms to.
SpecIdEvent00 corresponds to the TCG_PCClientSpecIdEventStruct type and is the event data for a Specification ID Version EV_NO_ACTION event for BIOS platforms.
SpecIdEvent02 corresponds to the TCG_EfiSpecIdEventStruct type and is the event data for a Specification ID Version EV_NO_ACTION event on EFI platforms for TPM family 1.2.
SpecIdEvent03 corresponds to the TCG_EfiSpecIdEvent type and is the event data for a Specification ID Version EV_NO_ACTION event on EFI platforms for TPM family 2.0.
StartupLocalityEventData is the event data for a StartupLocality EV_NO_ACTION event.
SystemdEFIStubCommandline represents a kernel commandline measured by the systemd EFI stub linux loader.
TaggedEvent corresponds to TCG_PCClientTaggedEvent.
# Interfaces
EventData represents all event data types that appear in a log.
# Type aliases
AlgorithmListId is a slice of tpm2.HashAlgorithmId values,.
Digest is the result of hashing some data.
DigestMap is a map of algorithms to digests.
EventType corresponds to the type of an event in an event log.
GrubStringEventType indicates the type of data measured by GRUB in to a log by GRUB.
No description provided by the author
OpaqueEventData is event data whose format is unknown or implementation defined.
PCRIndex corresponds to the index of a PCR on the TPM.
No description provided by the author
StringEventData corresponds to event data that is an non-NULL terminated ASCII string.