Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[Documentation]: Guidance for OEM self-generation of Secure Boot variable contents and append updates

Abierto
#281 6 comentarios 0 reacciones 2 asignados Ver en GitHub

@SochiOgbuanya ya está trabajando en esto.

Desde el 16/12/2025.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

state:backlog state:needs-maintainer-feedback state:needs-triage type:documentation
Request Description

Hello,

We're using secureboot_objects to generate our own KEK/db/dbx contents for VMs running on the XCP-ng hypervisor. During this process, we've run into a few issues:

  • https://github.com/microsoft/secureboot_objects/commit/e64d1a5c89e5bc851f72297ab8979a5cec0ffd20 has changed all current templates to point to dbx_info_msft_latest.json instead of recommending to ship an empty dbx by default. Is this an intentional change?
  • LegacyFirmwareDefaults.toml suggests to use our own signature owner GUID. Yet WHCP instructs that the MS GUID be used for KEK, without a mention of timestamp. So what's the signature owner and timestamp we should use in our generated SB databases (KEK/db/dbx)?
  • Self-generated dbx databases are not append-compatible with the signed versions. In other words, even if we shipped our own dbx, Windows will append its own signed database to the dbx variable. This would quickly consume all of the dbx variable's available space and cause subsequent updates to fail. Do you have any guidance on how to avoid this issue?
  • Similarly, are the signed versions append-compatible with what Windows uses to update the dbx? Will there be issues with duplicate EFI_SIGNATURE_DATA if the signed version was shipped?

A final note: We hope that the Secure Boot objects could be shipped under a permissive license (e.g. BSD) that allows us to ship these objects in open-source projects.

Are you going to make the change?

Someone else needs to make the change

Do you need maintainer feedback?

Maintainer feedback requested

Anything else?

No response

Lenguaje dominante
Python
Estrellas
289
Forks
89
Merge medio
3 d 10 h
PR fusionados (30 d)
7

Guía de contribución

Abrir la guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de microsoft/secureboot_objects

Todos los issues de microsoft/secureboot_objects

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.