canonical / canonical/secboot

`Platform Secure Boot is not enabled` is wrong for AMD systems

Open
#501 3 comments 0 reactions 1 assignee Claimed by @chrisccoulson View on GitHub
Dominant language
Go
Stars
23
Forks
29
Avg merge
2d 8h
Merged PRs (30d)
2

Description

The current [check for fused_part](https://github.com/canonical/secboot/blob/master/efi/preinstall/check_host_security_amd.go#L97) on AMD systems does **not** represent Platform Secure Boot.

The details for fused part are here:
https://docs.kernel.org/admin-guide/abi-testing.html#abi-sys-bus-pci-devices-bdf-fused-part

I don't disagree with this check being here, but it should tell the user that the part is not fused.

Now in terms of PSB; there is a [check available](https://lore.kernel.org/linux-crypto/20260123033457.645189-1-superm1@kernel.org/), but it's not yet merged in the mainline kernel. But I also don't think that should gate secure boot, because some OEMs have their own PSB solutions. For example HP has something called [HP Sure Start](https://github.com/fwupd/fwupd/commit/c8e9d8d3ca072ea10f3370e0f46f247a9db8c3f0).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.