diff --git a/HIRS_Provisioner.NET/README.md b/HIRS_Provisioner.NET/README.md new file mode 100644 index 00000000..bb2be321 --- /dev/null +++ b/HIRS_Provisioner.NET/README.md @@ -0,0 +1,23 @@ +

HIRS Provisioner.NET

+ +The HIRS Provisioner.NET is an application that can leverage a machine and its TPM to: + + * verify system attributes (as chosen in the ACA policy) + * request and store an Attestation Identity Certificate and/or a LDevID Certificate + +The HIRS Provisioner.NET application, along with the HIRS ACA, will perform the following high level tasks +during the provision process. Please refer to appendix B for further details: +• The HIRS Provisioner retrieves the EK Certificate from the TPMs NVRAM. +• The HIRS Provisioner retrieves the Platform Certificate from the EFI partition, if present. +• The HIRS Provisioner retrieves the Reference Integrity Manifest (RIM) from the EFI partition, if present. +• The HIRS Provisioner retrieves the TPM Event Log. +• The HIRS Provisioner retrieves Component data from the device. +• An Attestation Identity Key is generated on the TPM, if one is not already present. +• The HIRS Provisioner forwards the collected data and sends it to the ACA. +• The HIRS ACA (Policy based) validates the Endorsement Credential. +• The HIRS ACA (Policy based) validates the Platform Credential(s). +• The HIRS ACA (Policy based) validates and new RIM(s) +• The performs credential validation according to its policy +• If validation is successful, the ACA issues an Attestation Identity Credential or LocalDevID (Policy based) to the device. + +For installation, setep, and usage please refer to the [HIRS_Provisioner.NET Readme](https://github.com/nsacyber/HIRS/blob/master/HIRS_AttestationCAPortal/src/main/webapp/docs/HIRS%20.NET%20Provisioner%20Readme_2.2.pdf) \ No newline at end of file diff --git a/HIRS_Provisioner.NET/hirs/HIRS_Provisioner.NET.csproj b/HIRS_Provisioner.NET/hirs/HIRS_Provisioner.NET.csproj index 72651af5..e55f98c8 100644 --- a/HIRS_Provisioner.NET/hirs/HIRS_Provisioner.NET.csproj +++ b/HIRS_Provisioner.NET/hirs/HIRS_Provisioner.NET.csproj @@ -8,7 +8,7 @@ true enable enable - 2.2.0 + 3.0.0 diff --git a/HIRS_ProvisionerTPM2/README.md b/HIRS_ProvisionerTPM2/README.md index 81d7e244..3bc71fa5 100644 --- a/HIRS_ProvisionerTPM2/README.md +++ b/HIRS_ProvisionerTPM2/README.md @@ -1,5 +1,8 @@ # HIRS TPM 2.0 Provisioner +Notice: The HIRS TPM 2.0 Provisioner is being deprecated. +Please refer to the [HIRS_Provisioner.Net](https://github.com/nsacyber/HIRS/tree/main/HIRS_Provisioner.NET) for currently supported HIRS provisioner. + ### Overview This document describes the HIRS TPM 2.0 Provisioner, a program that can leverage a machine and its TPM to: diff --git a/README.md b/README.md index 341e2749..5f949e4b 100644 --- a/README.md +++ b/README.md @@ -1,102 +1,154 @@

Host Integrity at Runtime and Start-up (HIRS)

-[![Build Status](https://travis-ci.org/nsacyber/HIRS.svg?branch=master)](https://travis-ci.org/nsacyber/HIRS) +![HIRS Build Status](https://github.com/nsacyber/HIRS/actions/workflows/system_test.yml/badge.svg)

Attestation Certificate Authority (ACA) and TPM Provisioning with Trusted Computing-based Supply Chain Validation

-The Host Integrity at Runtime and Start-up Attestation Certificate Authority is a Proof of Concept - Prototype intended to spur interest and adoption of the [Trusted Platform Module (TPM)](https://trustedcomputinggroup.org/work-groups/trusted-platform-module/). It's intended for testing and development purposes only and is not intended for production. The ACA's functionality supports the provisioning of both the TPM 1.2 and [TPM 2.0](https://trustedcomputinggroup.org/wp-content/uploads/2019_TCG_TPM2_BriefOverview_DR02web.pdf) with an [Attestation Identity Credential (AIC)](https://www.trustedcomputinggroup.org/wp-content/uploads/IWG-Credential_Profiles_V1_R1_14.pdf). The ACA can be configured to enforce the Validation of Endorsement and Platform Credentials to illustrate a supply chain validation capability. +The Host Integrity at Runtime and Start-up Attestation Certificate Authority is a Proof of Concept - Prototype intended to spur interest and adoption of the [Trusted Platform Module (TPM)](https://trustedcomputinggroup.org/work-groups/trusted-platform-module/). It's intended for testing and development purposes only and is not intended for production. The ACA's functionality supports the provisioning of [TPM 2.0](https://trustedcomputinggroup.org/wp-content/uploads/2019_TCG_TPM2_BriefOverview_DR02web.pdf) with an [Attestation Identity Certificate (AIC)](https://www.trustedcomputinggroup.org/wp-content/uploads/IWG-Credential_Profiles_V1_R1_14.pdf). The ACA can be configured to enforce the Validation of Endorsement and Platform Credentials to illustrate a supply chain validation capability. -The ACA provides a “provisioner” application to be installed on all devices which will be requesting Attestation Credentials. -The ACA is a web based server which processes Attestation Identity Requests. -![TPM Provisioning](images/TPM_Provisioning.jpg) +

+ +

+ +The HIRS ACA can be used to perform the Acceptance Test. The HIRS ACA is a web based server which processes Attestation Identity Requests. +The ACA provides a “provisioner” application to be installed on all devices which will be requesting Attestation Certificates. + +**Notice:** Github Discussions have been enabled for this repo. Please refer to the Dicussion entitled "[HIRS development changes](https://github.com/nsacyber/HIRS/discussions/498)" for development and support notifications. + +## Features + +### Attestation Certificate Authority (ACA) + * Issues Attestation Identity Certificates or TPM based [Local Device ID (LDevID) certificates](https://github.com/nsacyber/HIRS/wiki/DevID-Certificates) to validated devices holding a TPM + * Configures policies for enabling/disabling validation procedures + * Performs TCG-based Supply Chain Validation of connecting clients + * Optionally validates Endorsement, Platform Certificates, and Reference Integrity Manifests + * Endorsement Certificate Certificate Chain Validation + * Process EK Certificates per [TCG EK Credential Profile For TPM Family 2.0](https://trustedcomputinggroup.org/resource/tcg-ek-credential-profile-for-tpm-family-2-0/) + * Verifies the endorsement key used by the TPM was placed there by the original equipment manufacturer (OEM) + * Platform Certificate - Certificate Chain Validation + * Process Platform Certificates per [TCG Platform Attribute Credential Profile Specification Version 1.1 Revision 15](https://trustedcomputinggroup.org/wp-content/uploads/IWG_Platform_Certificate_Profile_v1p1_r15_pubrev.pdf) + * Updates for the [Platform Certificate Version 2.0](https://trustedcomputinggroup.org/wp-content/uploads/TCG-Platform-Certificate-Profile-Version-2.0-Revision-39.pdf) are in the current development cycle + * Verifies the provenance of the system's hardware components, such as the motherboard and chassis, by comparing measured component information against the manufacturers, models, and serial numbers listed in the Platform Certificate + * Firmware Integrity Validation + * Creates and verifies a nonce for the TPM Quote + * Process TMP Event Logs and checks digests against the TPM Quote + * Verifies individual event digests against the OEM provided Reference Integrity Measurements + * Checks that firmware and boot related file hashes match those provided by OEMs. + * Validates the import of All RIM files imported to the ACA (insure all RIM files were signed by trusted sources) + * Verifies that the firmware hashes captured by the TPMs Platform Configuration Registers (PCRs) match the firmware hashes obtained from the OEM(s). + * Verifies TCG/UEFI boot variables (e.g. BIOS setup data) have not been altered (e.g secure boot). + * Attestation CA Dashboard + * Displays all Validation Reports, Certificates, and Trust Chains + * Enables ACA policy configuration for validation of Endorsement and Platform Certificates + * Enables Import/Export of Certificate (Trust) Chains, Endorsement Certificates, and Platform Certificates + * Optionally allows uploaded Certificates of trusted parties + +### TPM Provisioner + * Requests an Attestation Identity Certificate for the TPM from the ACA. + * Transfer's TCG Artifacts to the ACA (TPM Endorsement Certificates, Platform Certificates, Reference Integrity Manifests, Event Logs, etc.) + * Reads the device's hardware, network, firmware, and OS info for platform and component validation + * Provides a TPM Quote for Firmware Integrity Checking + +## Installation Instructions + +For detailed instructions, see [Installation notes](https://github.com/nsacyber/HIRS/wiki/installation_notes). + +Packages used for installation can be found on the [release page](https://github.com/nsacyber/HIRS/releases). + +### Installing the HIRS ACA +There are several options for installing the HIRS ACA + +An ACA Docker image is automatically created for each release. To run the ACA container using docker + +``` +docker run --name=aca -p 8443:8443 ghcr.io/nsacyber/hirs/aca:latest +``` +To install the ACA on a Redhat or Rocky Linux download the latest rpm from the [release page](https://github.com/nsacyber/HIRS/releases) +then run the command + +``` +dnf install HIRS_AttestationCA*.rpm. +``` + +To install the ACA on a Ubuntu Linux download the latest rpm from the [release page](https://github.com/nsacyber/HIRS/releases) +then run the command +``` +dnf install HIRS_AttestationCA*.deb. +``` + +### Installing the HIRS_Provisioner.NET + +To install the HIRS_Provisioner.NET on a Redhat or Rocky Linux download the latest rpm package from the [release page](https://github.com/nsacyber/HIRS/releases) then run the command + +``` +sudo dnf install hirs-provisioner-tpm2*.rpm +``` + +To install the HIRS_Provisioner.NET on Ubuntu Linux download the latest deb package from the [release page](https://github.com/nsacyber/HIRS/releases) then run the command + +``` +sudo apt-get install hirs-provisioner-tpm2*.rpm +``` + +To install the HIRS_Provisioner.NET on Windows download the latest msi package from the [release page](https://github.com/nsacyber/HIRS/releases) then run the command + +``` +sudo apt-get install hirs-provisioner-tpm2*.rpm +``` + +Then follow the instructions for setting up the HIRS_provisioner.NET in the [HIRS_Provisioner.NET Readme](https://github.com/nsacyber/HIRS/blob/master/HIRS_AttestationCAPortal/src/main/webapp/docs/HIRS%20.NET%20Provisioner%20Readme_2.2.pdf). + +## Usage + +On Linux: To kick off a provision on the client, open a terminal and run the command + +``` +sudo tpm_aca_provision +``` + +On Windows: Open a powershell as administrator and enter the command + +``` +tpm_aca_provision +``` + +To see the results and interact with the ACA, using a browser go to the ACA Portal usng the URL: + +``` +https://localhost:8443/ +``` + +For more information see the [Getting Started Guide](https://github.com/nsacyber/HIRS/wiki/Gettingstarted) + +## Development History Version 1.1 added support for the [Platform Certificate v1.1 Specification](https://trustedcomputinggroup.org/resource/tcg-platform-certificate-profile/). This allows entities that are part of the supply chain (System integrators and Value Added Resellers) the ability to create Delta Platform Certificate to compliment the Base Platform Certificate created by the Platform Manufacturer. See the [Article on Base and Delta Platform Certificates](https://github.com/nsacyber/HIRS/wiki/Base-and-Delta-Platform-Certificates) for details. Version 2.0 added support for the [PC Client Reference Integrity Manifest (RIM) Specification](https://trustedcomputinggroup.org/resource/tcg-pc-client-reference-integrity-manifest-specification/) to provide firmware validation capability to the HIRS ACA. This requires that the manufacturer of a device provide a digitally signed RIM "Bundle" for each device. The HIRS ACA has a new page for uploading and viewing RIM Bundles and a policy setting for requiring Firmware validation. +Version 3.0 was completely refactored to build and run on multiple platforms. The Base OS used for development of the ACA was migrated to Rocky Linux with updates to current dependencies (e.g. Java, Tomcat, Mariadb, etc.) and development tools (e.g. Gradle). New features introduced in Version 3.0 include support for the PC Client RIM 1.1 specification including composite RIMs, time-stamps, and counter signatures and detailed linkages between TCG Event Logs, OEM issuer certificates, and Reference Integrity Manifests (RIMs) have been added to provide greater granularity of information. Support for TPM 1.2 (HIRS_Provisioner) and the Cplus version of the TPM provsioner (HIRS_ProvisionerTPM2) was dropped from Version 3.0 and replaced with the [HIRS_Provisioner.NET](https://github.com/nsacyber/HIRS/tree/master/HIRS_Provisioner.NET). + To support the TCG RIM concept a new [tools folder](https://github.com/nsacyber/HIRS/tree/master/tools) has been added to the HIRS project which contains a [tcg_rim_tool command line application](https://github.com/nsacyber/HIRS/tree/master/tools/tcg_rim_tool). The tcg_rim_tool can be used to create NISTIR 8060 compatible SWID tags that adhere to the TCG PC Client RIM specification. It also supports the ability to digitally sign the Base RIM file as the HIRS ACA will require a valid signature in order to upload any RIM file. See the [tgc_rim_tool READ.md](https://github.com/nsacyber/HIRS/blob/master/tools/tcg_rim_tool/README.md) for more details. -**Notice:** Github Dicussions have been enabled for this repo. Please refer to the Dicussion entitled "[HIRS development changes](https://github.com/nsacyber/HIRS/discussions/498)" for development and support notifications. - -## Features - -* TPM Provisioner - * Requests an Attestation Identity Credential for the TPM from the ACA. - * Takes ownership of TPM if not owned - * Uses REST calls to complete the transaction with the ACA - * Reads credentials from the TPM's NvRAM as part of the provisioning process. - * Reads the device's hardware, network, firmware, and OS info for platform validation -* Attestation Certificate Authority - * Issues Attestation Identity Credentials to validated devices holding a TPM - * Configures policies for enabling/disabling validation procedures - * Performs TCG-based Supply Chain Validation of connecting clients - * Optionally validates Endorsement and Platform Credentials -* Endorsement Credential Certificate Chain Validation - * Process EK Credentials per [TCG EK Credential Profile For TPM Family 2.0](https://trustedcomputinggroup.org/resource/tcg-ek-credential-profile-for-tpm-family-2-0/) - * Verifies the endorsement key used by the TPM was placed there by the original equipment manufacturer (OEM) -* Platform Credential Certificate Chain Validation - * Process Platform Credentials per [TCG Platform Attribute Credential Profile Specification Version 1.1 Revision 15](https://trustedcomputinggroup.org/wp-content/uploads/IWG_Platform_Certificate_Profile_v1p1_r15_pubrev.pdf) - * Verifies the provenance of the system's hardware components, such as the motherboard and chassis, by comparing measured component information against the manufacturers, models, and serial numbers listed in the Platform Credential -* Attestation CA Dashboard - * Displays all Validation Reports, Credentials, and Trust Chains - * Enables ACA policy configuration for validation of Endorsement and Platform Credentials - * Enables Import/Export of Certificate (Trust) Chains, Endorsement Credentials, and Platform Credentials - * Optionally allows uploaded credentials to be used in validation for machines that have been reprovisioned by trusted parties since leaving the OEM -* Firmware Integrity Validation - * Checks that firmware and boot related file hashes match those provided by OEMs. - * Validates the import of All RIM files imported to the ACA (insure all RIM files were signed by trusted sources) - * Verifies that the firmware hashes captured by the TPMs Platform Configuration Registers (PCRs) match the firmware hashes obtained from the OEM(s). - * Verifies TCG/UEFI boot variables (e.g. BIOS setup data) have not been altered (e.g secure boot). -## Requirements - -The HIRS Attestation Certificate Authority (ACA) supports installation on CentOS 6 and 7 instances. - -The HIRS Provisioner supports both types of TPMs, 1.2 and 2.0. TPM 1.2 support is available on CentOS 6 and 7. Due to the limitations on the libraries available on Centos 6, TPM 2.0 support is only available on Centos 7. - -## Installation Instructions - -For detailed instructions, see [Installation notes](https://github.com/nsacyber/HIRS/wiki/installation_notes). - -Packages used for installation (e.g. HIRS_Provisioner*el7.noarch.rpm) can be found on the [release page](https://github.com/nsacyber/HIRS/releases). - -### Installing the ACA - -Simply run the command `yum install HIRS_AttestationCA*el6.noarch.rpm` or `yum install HIRS_AttestationCA*el7.noarch.rpm` based on your OS. - -### Installing the Provisioner - -After enabling your TPM in BIOS/UEFI, determine if your machine has a TPM 1.2 or a TPM 2.0 by using the command:
-`dmesg | grep -i tpm_tis`. - -To install a TPM 1.2 Provisioner, run:
-`yum install tpm_module*.rpm`
-`yum install HIRS_Provisioner*el6.noarch.rpm` or `yum install HIRS_Provisioner*el7.noarch.rpm` based on OS
-`hirs-provisioner -c` - -To install a TPM 2.0 Provisioner, run:
-`yum install hirs-provisioner-tpm2*.rpm` - -To configure the provisioner, edit the hirs-site.config file in `/etc/hirs/hirs-site.config`. Edit the file to specify the ACA's fully qualified domain name and port. - -## Usage - -To kick off a provision on the client, run the command `sudo tpm_aca_provision`. - -To see the results and interact with the ACA, go to the ACA Portal at `https://ACAPortalAddress:ACAPortalPort/HIRS_AttestationCAPortal/portal/index`. - ## Quick Links: - +Background * [TPM 2.0: A brief introduction](https://trustedcomputinggroup.org/wp-content/uploads/2019_TCG_TPM2_BriefOverview_DR02web.pdf) -* [Getting started with The ACA and Platform Credentials](https://github.com/nsacyber/HIRS/wiki/Gettingstarted) +* [Getting started with the ACA and Platform Certificates](https://github.com/nsacyber/HIRS/wiki/Gettingstarted) + +HIRS Documentation * [HIRS ACA and TPM provisioner Users Guide](https://github.com/nsacyber/HIRS/blob/master/HIRS_AttestationCAPortal/src/main/webapp/docs/HIRS_ACA_UsersGuide_2.1.pdf) +* [HIRS_Provisioner.NET Readme](https://github.com/nsacyber/HIRS/blob/master/HIRS_AttestationCAPortal/src/main/webapp/docs/HIRS%20.NET%20Provisioner%20Readme_2.2.pdf) * [TCG RIM Tool Users Guide](https://github.com/nsacyber/HIRS/blob/master/HIRS_AttestationCAPortal/src/main/webapp/docs/TCG%20Rim%20Tool%20User%20Guide%202.1.pdf) * [TCG Event Log Tool Users Guide](https://github.com/nsacyber/HIRS/blob/master/HIRS_AttestationCAPortal/src/main/webapp/docs/TCG%20Event%20Log%20Tool%20User%20Guide%202.1.pdf) + +HIRS Notes * [Installation notes](https://github.com/nsacyber/HIRS/wiki/installation_notes) * [Project build instructions](https://github.com/nsacyber/HIRS/wiki/Hirs-build-guide) * [HIRS Attestation Certificate Authority FAQ](https://github.com/nsacyber/HIRS/wiki/FAQ) * [TPM Provisioner Debug](https://github.com/nsacyber/HIRS/wiki/provisioner_debug) * [ACA Debug](https://github.com/nsacyber/HIRS/wiki/aca_debug) -* Tools + +Tools * [Platform Certificate Creator](https://github.com/nsacyber/paccor) * [Reference Integrity Manifest tool (tcg_rim_tool)](https://github.com/nsacyber/HIRS/releases) * [Event Log tool (tcg_eventlog_tool)](https://github.com/nsacyber/HIRS/releases) diff --git a/VERSION b/VERSION index ac2cdeba..4a36342f 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.1.3 +3.0.0 diff --git a/images/ACA_ValidationReports.png b/images/ACA_ValidationReports.png new file mode 100644 index 00000000..1e2fda5f Binary files /dev/null and b/images/ACA_ValidationReports.png differ diff --git a/images/AcceptanceTest_CIS.png b/images/AcceptanceTest_CIS.png new file mode 100644 index 00000000..14b318a5 Binary files /dev/null and b/images/AcceptanceTest_CIS.png differ diff --git a/images/EndorsementCertificate.png b/images/EndorsementCertificate.png new file mode 100644 index 00000000..61aff732 Binary files /dev/null and b/images/EndorsementCertificate.png differ diff --git a/images/HIRS_ACA_MAIN_PAGE.png b/images/HIRS_ACA_MAIN_PAGE.png new file mode 100644 index 00000000..c96cd45a Binary files /dev/null and b/images/HIRS_ACA_MAIN_PAGE.png differ diff --git a/images/PlatformCertificate.png b/images/PlatformCertificate.png new file mode 100644 index 00000000..83083dbd Binary files /dev/null and b/images/PlatformCertificate.png differ diff --git a/images/RIM_Certificate.png b/images/RIM_Certificate.png new file mode 100644 index 00000000..de3cae4b Binary files /dev/null and b/images/RIM_Certificate.png differ diff --git a/images/TCG_AcceptanceTest.png b/images/TCG_AcceptanceTest.png new file mode 100644 index 00000000..c9066d8b Binary files /dev/null and b/images/TCG_AcceptanceTest.png differ diff --git a/tools/tcg_eventlog_tool/README.md b/tools/tcg_eventlog_tool/README.md index 99c76793..a6f2316f 100644 --- a/tools/tcg_eventlog_tool/README.md +++ b/tools/tcg_eventlog_tool/README.md @@ -1,12 +1,12 @@ -To support the [PC Client RIM Specification](https://trustedcomputinggroup.org/wp-content/uploads/TCG_PC_Client_RIM_r0p15_15june2020.pdf) which utilizes the TPM Event Log as a Support RIM type , it was useful to have a tool for inspecting the contents of the [TPM event log](https://github.com/nsacyber/HIRS/wiki/TPM-Event-Logs). A Linux command line tool named "elt" (event log tool) has been created to parse and print human readable output, provide hexidecimal events which can be used as test patterns, and to compare event logs for providing details on what events miscompared. +To support the [PC Client RIM Specification](https://trustedcomputinggroup.org/resource/tcg-pc-client-reference-integrity-manifest-specification/) which utilizes the TPM Event Log as a Support RIM type , it was useful to have a tool for inspecting the contents of the [TPM event log](https://github.com/nsacyber/HIRS/wiki/TPM-Event-Logs). A Linux command line tool named "elt" (event log tool) has been created to parse and print human readable output, provide hexidecimal events which can be used as test patterns, and to compare event logs for providing details on what events mis-compared. Note that a TCG Event Log will only be populated on a given device if the device: 1. Utilizes TCG compliant UEFI Firmware. -2. Has a TPM 1.2 or 2.0 that has been activated prior to the current boot. -3. Has a TCG aware OS (Most flavors of Linux and Windows 10). +2. Has a TPM 2.0. +3. Has a TPM aware OS (Most flavors of Linux and Windows). The default locations for the TCG Event Log are: -* Windows: C:\Windows\Logs\MeasuredBoot\ +* Windows: C:\Windows\Logs\MeasuredBoot\ * Linux: /sys/kernel/security/tpm0/ with a default name of "binary_bios_measurements" # Building @@ -15,8 +15,8 @@ The default locations for the TCG Event Log are: To build this tool navigate to the tcg_eventlog-tool directory and use the following command: > ./gradlew clean build -## Windows 10 -Several options exist for building on Windows 10: +## Windows +Several options exist for building on Windows 11: 1. Windows command shell (CMD.exe): * Navigate to the tcg_eventlog_tool folder and run the widows gradle wrapper: @@ -28,16 +28,26 @@ Several options exist for building on Windows 10: In both cases the tcg_eventlog_tool-X.X.jar file should have been placed in the build\libs\tools\ (Windows) or build/libs/tools/ (Linux) folder. # Packaging -Currenty only a install file for Linux RPM is supported. +Packages for this tool can be found on the [HIRS release page](https://github.com/nsacyber/HIRS/releases) -To create an RPM on a linux device use the following command in the same directory: -> ./gradlew buildRPM +Currently only a packaging for Linux is supported. + +To create an RPM on a Redhat or Rocky linux device use the following command in the same directory: +> ./gradlew buildRpm + +or for a Debian or Ubuntu Linux device: +> ./gradlew buildDeb + +the package can be found under the build/distributions/ folder # Installing -Currenty only a install package for Linux is supported. +Currently only a install package for Linux is supported. -To install this tool use the following commmand from the same directory: -> sudo yum localinstall build/distributions/tcg_eventlog_tool*.rpm +To install this tool on a Redhat or Rocky Linux distro use the following command from the same directory: +> sudo dnf install build/distributions/tcg_eventlog_tool*.rpm + +or for a Debian or Ubuntu Linux distro: +> sudo apt-get install build/distributions/tcg_eventlog_tool*.deb # Usage ## Linux diff --git a/tools/tcg_eventlog_tool/VERSION b/tools/tcg_eventlog_tool/VERSION index d3827e75..4a36342f 100644 --- a/tools/tcg_eventlog_tool/VERSION +++ b/tools/tcg_eventlog_tool/VERSION @@ -1 +1 @@ -1.0 +3.0.0 diff --git a/tools/tcg_rim_tool/README.md b/tools/tcg_rim_tool/README.md index b9690b82..05383f1c 100644 --- a/tools/tcg_rim_tool/README.md +++ b/tools/tcg_rim_tool/README.md @@ -1,15 +1,45 @@ -To support the [TCG RIM concept](https://trustedcomputinggroup.org/wp-content/uploads/TCG_RIM_Model_v1-r13_2feb20.pdf) a new command line application alled the The tcg_rim_tool has been created. -The tcg_rim_tool can be used to create NISTIR 8060 compatible SWID tags that adhere to the [TCG PC Client RIM specification](https://trustedcomputinggroup.org/wp-content/uploads/TCG_PC_Client_RIM_r0p15_15june2020.pdf). +To support the [TCG RIM concept](https://trustedcomputinggroup.org/resource/tcg-reference-integrity-manifest-rim-information-model/) a new command line application called the The tcg_rim_tool has been created. +The tcg_rim_tool can be used to create NISTIR 8060 compatible SWID tags that adhere to the [TCG PC Client RIM specification](https://trustedcomputinggroup.org/resource/tcg-pc-client-reference-integrity-manifest-specification/). It also supports the ability to digitally sign the Base RIM file as the HIRS ACA will require a valid signature in order to upload any RIM file. # Building -To build this tool navigate to the tcg_eventlog-tool directory and use the following commmand: +## Linux +To build this tool navigate to the tcg_eventlog-tool directory and use the following command: > ./gradlew clean build -# Packaging +## Windows +Several options exist for building on Windows 11: -To package the tcg_rim_tool use the [package.sh](https://github.com/nsacyber/HIRS/blob/master/tools/tcg_rim_tool/package.sh) script to produce an RPM file for Linux distrobustions that support thw RPM package manager. The rpm file will be located in the rpmbuild/RPMS/x86_64/ directory if the package script was sucessful. -Although packaging for other distributions is not currently avialble the tool can be built an run on other systems that support java and gradle, such as windows 10. +1. Windows command shell (CMD.exe): + * Navigate to the tcg_eventlog_tool folder and run the widows gradle wrapper: + > gradlew.bat clean build +2. Windows powershell with Windows Subsystem for Linux enabled. + * Navigate to the tcg_eventlog_tool folder and run the Linux gradle wrapper: + > ./gradlew clean build + +In both cases the tcg_rim_tool-X.X.jar file should have been placed in the build\libs\tools\ (Windows) or build/libs/tools/ (Linux) folder. + +# Packaging +Packages for this tool can be found on the [HIRS release page](https://github.com/nsacyber/HIRS/release + +Currently only a packaging for Linux is supported. + +To create an RPM package on a Redhat or Rocky linux device use the following command in the same directory: +> ./gradlew buildRpm + +or for a Debian or Ubuntu Linux distro: +> ./gradlew buildDeb + +the package can be found under the build/distributions/ folder + +# Installing +Currently only a install packages for Linux are supported. + +To install this tool on a Redhat or Rocky Linux distro use the following command from the same directory: +> sudo dnf install build/distributions/tcg_eventlog_tool*.rpm + +or for a Debian or Ubuntu Linux distro: +> sudo apt-get install build/distributions/tcg_eventlog_tool*.deb # Usage @@ -20,4 +50,4 @@ The tcg_eventlog_tool also can be invoked using java from the tcg_eventlog_tool > java -jar build/libs/tools/tcg_rim_tool-1.0.jar -h -Current options for the tool can be found using the -h option. +Current options for the tool can be found using the -h option. \ No newline at end of file