infrastructure-firmware-forensics

Thin bounded wrapper around CHIPSEC: cited Observations from BIOS write-protect and UEFI module scan output, no verdicts

Tier	infrastructure
Role	unclassified (baselined)
Path	`crates/infrastructure/firmware-forensics`
Edition	2021
Targets	infrastructure_firmware_forensics
Public items	8 across 0 modules
Tests	9

What it is for

Thin bounded wrapper around CHIPSEC: cited Observations from BIOS write-protect and UEFI module scan output, no verdicts of our own — CHIPSEC's own PASSED/FAILED/WARNING classification is cited verbatim, never translated into this crate's own "malicious"/"clean" language (docs/reference/STYLE.md).

Capabilities

`ChipsecMarker`

Thin bounded wrapper around CHIPSEC: cited Observations from BIOS

Item
`pub enum ChipsecMarker`

`ChipsecResultLine`

Thin bounded wrapper around CHIPSEC: cited Observations from BIOS

Item
`pub struct ChipsecResultLine`
`fn parse_chipsec_lines(stdout : & str) -> Vec <ChipsecResultLine>`
`fn to_observations(lines : & ChipsecResultLine, rule_id : & str) -> Vec <Observation>`

`FirmwareError`

Thin bounded wrapper around CHIPSEC: cited Observations from BIOS

Item
`pub enum FirmwareError`
`async fn bios_write_protect_check(chipsec_main : impl Into <PathBuf>, limits : ExecLimits,) -> Result <Vec <Observation>, FirmwareError>`
`async fn scan_uefi_modules(chipsec_main : impl Into <PathBuf>, limits : ExecLimits,) -> Result <Vec <Observation>, FirmwareError>`
`async fn dump_spi_flash(chipsec_util : impl Into <PathBuf>, out_root : & PathGuard, out_filename : & str, limits : ExecLimits,) -> Result <PathBuf, FirmwareError>`

How to use it

No examples/ target and no doctest in this crate's rustdoc. The tests listed under Verification are the closest executable usage.

Module structure

No public modules: the crate root is its whole surface.

Public surface

`crate root`

Item	What it is
`pub enum ChipsecMarker`	CHIPSEC's own classification of a single result line, preserved as-is.
`pub struct ChipsecResultLine`	One recognized CHIPSEC result line.
`pub enum FirmwareError`	Every way a firmware check can fail.
`fn parse_chipsec_lines(stdout : & str) -> Vec <ChipsecResultLine>`	—
`fn to_observations(lines : & ChipsecResultLine, rule_id : & str) -> Vec <Observation>`	Lift parsed CHIPSEC lines into cited Observations under the given rule id.
`async fn bios_write_protect_check(chipsec_main : impl Into <PathBuf>, limits : ExecLimits,) -> Result <Vec <Observation>, FirmwareError>`	`chipsec_main -m common.bios_wp` — is SPI flash write-protection actually locked.
`async fn scan_uefi_modules(chipsec_main : impl Into <PathBuf>, limits : ExecLimits,) -> Result <Vec <Observation>, FirmwareError>`	`chipsec_main -m tools.uefi.scan_uefi` — anomalous UEFI module scan.
`async fn dump_spi_flash(chipsec_util : impl Into <PathBuf>, out_root : & PathGuard, out_filename : & str, limits : ExecLimits,) -> Result <PathBuf, FirmwareError>`	`chipsec_util spi dump <path>` — full SPI flash dump

No pub use re-exports: every item above is declared in this crate.

Boundary

Reaches into foundation.

Shares tier infrastructure with 82 other crates: infrastructure-acquire, infrastructure-adapters-google-calendar, infrastructure-adapters-google-gmail, infrastructure-adapters-google-places, infrastructure-adapters-google-trends, infrastructure-adapters-shodan, infrastructure-adapters-yelp, infrastructure-agent, … (82 total).

_What this crate deliberately does NOT own is a judgment. No committed registry records one for it, so none is stated here._

Where it sits

Tier (ontology)	`infrastructure`
Architectural role (taxonomy)	`unclassified (baselined)`
Location	`crates/infrastructure/firmware-forensics`
Vocabulary in force (lexicon)	`current`

Tier flow. Which tiers this crate's own edges cross.

flowchart LR
  n_infrastructure["infrastructure"] --> n_foundation["foundation"]

Dependencies

Runtime, in this workspace.

Crate	Tier	Optional	Only on
`foundation-bounded-io`	foundation	no	always
`infrastructure-host-forensics`	infrastructure	no	always

Runtime, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`thiserror`	`^2`	—	no	always

Development, from outside the workspace.

Crate	Requirement	Features	Optional	Only on
`tokio`	`^1`	`full`	no	always

Build. None.

Depended on by. Nothing in this workspace.

Signal flow — what reaches this crate, and what it reaches.

flowchart LR
  SELF["infrastructure-firmware-forensics"]
  SELF -->|runtime| n_foundation_bounded_io["foundation-bounded-io"]
  SELF -->|runtime| n_infrastructure_host_forensics["infrastructure-host-forensics"]
  classDef self fill:#1f883d,stroke:#1f883d,color:#fff;
  class SELF self;

Feature flags

No Cargo features are defined: every capability is unconditional, so no consumer can receive a half-wired crate.

Targets

Kind	Name	Source
lib	`infrastructure_firmware_forensics`	`src/lib.rs`

Error model

Error type	Named by
`FirmwareError`	`bios_write_protect_check`, `dump_spi_flash`, `scan_uefi_modules`

Operational characteristics

Property	Evidence
async public surface	yes
async runtime	none detected
database access	none detected
network I/O	none detected
unsafe code	none detected
environment variables	yes

No unsafe block, unsafe fn, unsafe impl or unsafe trait was found by the parser anywhere in this crate's source.

Configuration

Variable	Read in
`CARGO_MANIFEST_DIR`	`src/lib.rs`

No workspace crate depends on this one.

Verification

Kind	Count
Unit tests	9
Integration tests	0
Examples	0
Doctests	0

Evidence by module. How often each public module is named by something executable.

Module	Tests	Examples	Consumers
`crate root`	8	0	0

What the tests establish, by name:

bios_write_protect_check_wires_stdout_through_the_parser — src/lib.rs
dump_spi_flash_rejects_a_target_outside_the_guard_root — src/lib.rs
dump_spi_flash_runs_and_returns_the_resolved_path — src/lib.rs
nonzero_exit_still_produces_an_observation_not_a_silent_drop — src/lib.rs
parse_chipsec_lines_empty_input_yields_no_synthesized_result — src/lib.rs
parse_chipsec_lines_extracts_all_three_markers — src/lib.rs
parse_chipsec_lines_ignores_unrecognized_lines — src/lib.rs
scan_uefi_modules_wires_stdout_through_the_parser — src/lib.rs
to_observations_cites_marker_and_message_verbatim_no_verdict_language — src/lib.rs

Documentation coverage

Measure	Documented	Total
Public items with rustdoc	7	8
Public modules with a `//!` block	0	0

pie showData
    title Public items with rustdoc
    "Documented" : 7
    "No rustdoc detected" : 1

Metrics

Metric	Value
Rust source files	1
Source lines	277
Code lines	222
Public API items	8
Public modules	0
Tests	9
Examples	0
Cargo features	0
Direct runtime dependencies	3
Workspace reverse dependencies	0

pie showData
    title Public API by kind
    "enum" : 2
    "function" : 5
    "struct" : 1

pie showData
    title Rust source composition
    "Code" : 222
    "Blank or comment" : 55

Generation

Rendered by tools-corpus corpus readme from repository evidence alone, renderer schema 2, lexicon current. No model, network service or database was consulted. Regenerate with tools-corpus corpus readme --write; verify with --check.

What it is for

Capabilities

ChipsecMarker

ChipsecResultLine

FirmwareError

How to use it

Module structure

Public surface

Boundary

Where it sits

Dependencies

Feature flags

Targets

Error model

Operational characteristics

Configuration

Related capabilities

Verification

Documentation coverage

Metrics

Generation

`ChipsecMarker`

`ChipsecResultLine`

`FirmwareError`