The v3.2.0 HIRS release requires that the HIRS Provisioner be updated to V.3.2.0 in order to work with the ACA V 3.2.0
PC Client RIM files previously created with either the tcg_rim_tool or the RIM Tool v1.0 will need to be recreated using Rim Tool v1.1 due to a bug that both tools had with saving the Base RIM with extra white spacing.

ACA:

New Features:

• New table column sorting and data export options on the ACA portal:
  • Can search on specific table columns
  • Can now search dates
  • Can select/delete multiple certificates/rims from tables.
  • Export to exel, csv, pdf
  • Print
• Links added to RIM detials page if embedded certificate is present
• Added a policy setting for enhanced logging collection
• Added new help pages

Updates:

• Removed the tcg_rim_tool in favor of the RIM Tool app (https://github.com/nsacyber/RIM-Tool)
• Updated to Java 25 and Bootstrap 5
• Migrated from JSP to Thymeleaf
• Updated various support libraries/dependencies
• updated TCG Event Log processing to inlcude new events details

Provisioner:

• Updated HIRS Provisioner to DOTNET 10

Bug Fixes/Error processing improvements:

• Fixed a bug with whitespaces being erronously removed from Swidtag/Base RIM files prior to signature verification
• Fixed a bug with Certificate DNs comma processing when matching DNs
• Fixed a bug with Provisioner handshakes to the ACA
• Fixed log when RIMs have incorrect Manuacturer or Model and RIMs are not matched to TCG Event Logs for provisioning
• Update TCG Eventlog processsing to ignore content data parsing issues as long as Event Digests are valid.
• Shows embedded certificates on the RIM details page
• Checks for embedded certificates within swidtag's/Base RIM files
• Handles missing RIM Bundle from provisioning process
• EK Certificate detials page shows TPM Security Assertions properly
• Updated use of AKI for certificate validation during validation
• Fixed RIM updates when updated RIM sent from provisioner
• Allow PEM files with extra text to be uploaded
• Handles detection of non-unique Root CA SKI's

Changes:

ACA:

• TCG Platform Certificate Component Class Registries Support added for TCG, SMBIOS, Storage, and PCIe Component class registries.
• Ability to download ACA Log files added to help page.
• Log level adjustments added to the ACA help page portal.
• Added a policy setting to store Protocol Buffer information in the log files.
• Added a policy setting to ignore validation of Vital Product Data for PCIE components.
• Dropped Support for Windows 10 native ACA Docker image. Windows 11 is supported. WSL images for Windows 10 still operational.
• Certificate Download from ACA Trust Management page now returns the complete ACA Trust Chain including ACA Leaf certificate, ACA intermediate certificate and the ACA root certificate.

Provisioner:

• Updated to .NET 8.
• Provisioner will by default collect component information for all Component Class Registries. This can be configured in the Provisioner settings file.

Bug Fixes:

• Multi part Pem reading issues: ACA will now only read first cert in a platform certificate file if multiple certs are found in the file.
• Class Registry Issues: ACA will handle Platform Certificates with class registry info.
• Search feature on several ACA pages are fixed.
• Fixed the 404 error that displayed on the site when the user attempted to download the Validation Report CSV file off of the ACA.
• Fixed the 404 error that displayed on the site when the user attempted to upload certain Platform Certificates to the ACA.
• Fixed the Powershell scripts that are used to setup a local version of the ACA on a Windows machine.
• Fixed an issue for Startup Locality event processing for FW validation
• Added TLS Web Client Authentication to the Extended Key Usage section for ACA-PKI certificates.
• Adjusted the “Ignore OS Events” Policy to accommodate PXE boot environments.

Changes on this release

• Rocky Linux versions 8 and 9 are supported
• Red Hat Enterprise Linux versions 8 and 9 are supported
• Ubuntu Linux versions 22 and 24 are supported
• Windows 11 (provisioner) is supported
• Support for TPM v1.2 is dropped
• Support for CentOS 6 and CentOS 7 is dropped.
• tcg_rim_tool supports the PC Client RIM version 1.1
• tcg_eventlog_tool supports changes to the TPM Event Log specified in version 1.06 of the TCG PC Client Specific Platform Firmware Profile Specification

Version 2.2.0 introduces the HIRS_Provisioner.NET. The HIRS_Provisioner.NET is a C# implementation of the HIRS Provisioner designed to be a replacement for the HIRS_ProvisionerTPM2. The HIRS_Provisioner.NET can be packaged for Windows as well as most Linux distributions. This portability will support a wider set of scenarios and products. See the HIRS_Provisioner.NET README.md for details.

An ACA Docker image is now automatically created for each release. See the packages page

HIRS ACA Updates:

• RIM Database page was added to search and view all RIM supplied Events into the ACAs database.
• Added an ACA policy option to ignore OS events if on FW Validation is required.
• FIM Assertions were enabled on the Platform Certificate details page
• RIM uploads modified to use platformManufacturerStr and platformModel from the Base RIM (swidtag to match the against provisioning request

TCG RIM TOOL Updates:

• Support for PEM formatted Keys and Certificates added
• Added capability to add timestamps
• Use of the default keystore must be implicitly stated
• Added a xml_dsig_tool to provide an alternate means to validate the signature on the tcg_rim_tool
• Fixed install issue when installed on same device as the ACA
• Support added for nested RIMS
• Support added for multiple signatures
• Meta attributes colloquialVersion, edition, product, and revision are now optional

This is a test release, intended to test a Github action to produce an ACA docker image. If successful an ACA test image will be posted to the package link on the right hand side of the main HIRS Github page.

There are no RPMs for this release.

Several small fixes:

• Updates database parameters for larger data sizes when using reference manifests from different operating systems.
• Fixes an issue with yum/rpm update removing the tcg_boot.properties file.

Centos 7
HIRS_AttestationCA-2.1.2-1644956897.4e7f45.el7.noarch.rpm            a913d42f8004433b235c6e078eec9fb35bd8240aa662e4f071807d74523feab1
HIRS_Provisioner_TPM_1_2-2.1.2-1644956897.4e7f45.el7.noarch.rpm      99ff9695334304490928a393e437d1554c221b6cbbb14aa061ca8ebd1a4414c5
HIRS_Provisioner_TPM_2_0-2.1.2-1644956897.4e7f45.el7.x86_64.rpm      32f6bb60fcc0a893db715664b6484e7c94a100c2349a1c60e70189ad28418868
     
Centos 6
HIRS_Provisioner_TPM_1_2-2.1.2-1644956897.4e7f45.el6.noarch.rpm      ce72ef510f5d93e9af4c47ef1563da3f99398b895b450409d270aa9740387689
HIRS_AttestationCA-2.1.2-1644956897.4e7f45.el6.noarch.rpm            87651367f835b286e7afca40929ba9267f07813b6626f3a4ef80a0f22edeb44e
tpm_module-2.1.2-1644956897.4e7f45.x86_64.rpm                        5c20aefd09ffdd8fa87fd9970d8e491410ee711f724d2ef514668303348cb311

This release includes gradle's recommended updates to log4j to address CVE-2021-44228.

Centos 7
HIRS_AttestationCA-2.1.1-1642089524.119f77.el7.noarch.rpm             5c4a2374ceaef04cb91334016402d91101ddb6014dee735ed63f74ddd76578a5    
HIRS_Provisioner_TPM_1_2-2.1.1-1642089524.119f77.el7.noarch.rpm       048eab7b2f29f74a9962bd494116c9836666e70d94baba2a69b61ab64219a012
HIRS_Provisioner_TPM_2_0-2.1.1-1642089524.119f77.el7.x86_64.rpm       d57e60a7af8b12224764a7a27614a440fa862dd6bb69faa3b1a7e3a82ff9266f
tcg_rim_tool-2.1.0-1.el7.x86_64.rpm                                   eec6d9336830e5efb4d52f2cf4771284d21048e293e4c714befc7009faf418ea
tcg_eventlog_tool-2.1.1-1.i386.rpm                                    429c886e4034584a804e22efcf22e6593953835eff8ea42a98647b395db9ccf6        

Centos 6
HIRS_AttestationCA-2.1.1-1642089524.119f77.el6.noarch.rpm             9748f8940cca465802e625bd6f32ccf050b6410422bc66228ffafeb5c3e3e606         
HIRS_Provisioner_TPM_1_2-2.1.1-1642089524.119f77.el6.noarch.rpm       b9cfa8d42a0c2c095fc894cca2175a1f1fdce622b445b1b86b07a736f745d2aa 
tpm_module-2.1.1-1642089524.119f77.x86_64.rpm                         e001669736336db38d9f45dee223629af836aa4fe2baba8dc4433216f00065a2

Release 2.1.0 adds support for supplemental PC Client Reference Integrity Manifests (RIMs) to support System Integrator and Value Added Reseller scenarios for the firmware validation capability of the HIRS ACA.

Other updates:

• Certificate Validation has been updated to validate the entire certificate path of the issuer.
• RIM upload validates RIM signatures and support RIM hashes, parse support RIM files (event logs), and adds individual events to a RIM Database.
• Downloadable Validation Report added to the Validation report page. Supports CSV and Json formats.
• Updated TCG Event Log data in Support RIM display
• Firmware link on Validation Report page now links to event log sent by the provisioner.
• Ignore GPT PCRs Entry policy added to Policy page to account for GPT events that may contain unique partition table guids in a Support RIM.
• The tcg_rim_tool has added Certificate Issuer checking to its validation capability.

SHA256 checksums:

Centos 7
HIRS_AttestationCA-2.1.0-1630344582.744aea.el7.noarch.rpm         8499a81e27a6c86bab031ba7dad1e0f1586de1a6b4fc2c5493380c446e16ef8b 
HIRS_Provisioner_TPM_1_2-2.1.0-1630344582.744aea.el7.noarch.rpm   db0ae2ed0fdb06dd5574c2ae4deffa9da77cebcacae05f1cf2866f68091127ae
HIRS_Provisioner_TPM_2_0-2.1.0-1630344582.744aea.el7.x86_64.rpm   e03aea3c44996c17b41e96239b48e7e17e22db8dbadd273eb01bdce87931fac8
tcg_rim_tool-2.1.0-1.el7.x86_64.rpm                               2344bee24bfb64951664a573b273f8afde6434d11d9e5e368f0315a34e2aafdb
tcg_eventlog_tool-2.1.0-1.i386.rpm                                83ee1e7a73daaaa2b9fcb1e0994ec04fdd1715e66d6e0b14d4e6938f3620a7f9

Centos 6
HIRS_AttestationCA-2.1.0-1630344582.744aea.el6.noarch.rpm         e804f37e385b17a8526cc5cf149d0ee847eec4606505ae2037dacd9f830300b5
HIRS_Provisioner_TPM_1_2-2.1.0-1630344582.744aea.el6.noarch.rpm   a1d3423aee1f5f6dcaf86cf5ef872eee3c340e6d6e4ba0c9a511caa9ce48225f
tpm_module-2.1.0-1630344582.744aea.x86_64.rpm                     07c904b8385eb6fce3c97ea9f094b75caa9f902e2e24dfa119fbecc89c326bee

Added ability to to download json version of a Validation Report.

Added new options for csv report download.
download_validation_reports.sh how has a -h option.