Commit e90644eea1 for qemu.org

commit e90644eea1ce545482b923b81809b3b96bac1be3
Author: Martin Pitt <martin@amutable.com>
Date:   Sun Oct 18 22:01:25 2026 +0200

    hw/uefi: fix ContentInfo detection in wrap_pkcs7()

    Fix wrap_pkcs7()'s detection for an already present PKCS ContentInfo
    envelope: It previously compared byte 15 with 0x0a (ASN.1
    ENUMERATED) instead of 0xa0 (the [0] EXPLICIT context tag of
    ContentInfo.content). See the original edk2 function [1] where this was
    taken from.

    Due to that typo, an already wrapped signature got wrapped a second
    time, and gnutls_pkcs7_import() rejected it. This breaks Secure Boot key
    enrollment with .auth files carrying the envelope, as created by
    systemd's "bootctl --secure-boot-auto-enroll".

    [1] https://github.com/tianocore/edk2/blob/8f8372439d8ec5f565dbda1548c18deb068e0080/CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c#L68

    Fixes: 3e33af2cb306 ("hw/uefi: add var-service-pkcs7.c")
    Cc: qemu-stable@nongnu.org
    Signed-off-by: Martin Pitt <martin@amutable.com>
    Message-ID: <atUllV8bSaHylfKv@piware.de>
    Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>

diff --git a/hw/uefi/var-service-pkcs7.c b/hw/uefi/var-service-pkcs7.c
index 8a1f1395a2..a47f36492f 100644
--- a/hw/uefi/var-service-pkcs7.c
+++ b/hw/uefi/var-service-pkcs7.c
@@ -80,7 +80,7 @@ static void wrap_pkcs7(gnutls_datum_t *pkcs7)
         pkcs7->data[4] == 0x06 &&
         pkcs7->data[5] == 0x09 &&
         memcmp(pkcs7->data + 6, signed_data_oid, sizeof(signed_data_oid)) == 0 &&
-        pkcs7->data[15] == 0x0a &&
+        pkcs7->data[15] == 0xa0 &&
         pkcs7->data[16] == 0x82) {
         return;
     }