WithSecureBootPolicyProfile should accommodate systems that support timestamp revocation
Open
efi-pcr-profiles
preinstall-checks
- Dominant language
- Go
- Stars
- 23
- Forks
- 29
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 2
Description
`WithSecureBootPolicyProfile` will generate an incorrect profile on systems that support timestamp revocation (ie, that have a `dbt` database), not that I've seen any of these devices yet. This is detected explicitly in the new pre-install checks I'm working on, disabling support for `WithSecureBootPolicyProfile` in this case, but support for `dbt` should probably be added.
Support for timestamp revocation can be detected from the `OsIndicationsSupported` global variable, which secboot is already looking at.
Contributor guide
Assessment
This issue has not been assessed yet.