hashicorp / hashicorp/packer-plugin-azure

Add support for securityProfile / uefiSettings on shared_image_gallery_destination

Open
#514 1 comment 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
63
Forks
103
PR merge metrics
No merged PRs in 30d

Description

#### Community Note

Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request.
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request.
If you are interested in working on this issue or have submitted a pull request, please leave a comment.

#### Description

It is possible to enroll/replace UEFI keys on an Azure Compute Gallery Image Version using ARM Template:

```"securityProfile": {
"uefiSettings": {
"signatureTemplateNames": [
"MicrosoftUefiCertificateAuthorityTemplate"
],
"additionalSignatures": {
"db": [
{
"type": "x509",
"value": [
"Base64 formatted certificate",
"Base64 formatted certificate"
]
}
],
"dbx": [
{
"type": "sha256",
"value": [
"Base64 formatted sha256 hash",
"Base64 formatted sha256 hash"
]
}
]
}
}
}
```

This example comes from Azure's documentation [Secure Boot UEFI keys](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-secure-boot-custom-uefi#scenario-2-append-keys-to-db-and-dbx-to-a-signature-template).

The packer-plugin-azure provider has a parameter block `shared_image_gallery_destination` but it's not currently possible to set `securityProfile` or `securityProfile.uefiSettings`.

Alternatively it would be great to be able to add custom ARM Template code.

#### Use Case(s)

Azure has a feature "Trusted launch" that is basically a secure boot. Some software such as proprietary anti viruses try to load themselves into the kernel and fails because they are signed by an external authority unrecognized by UEFI.

We usually use `mokutil` to enroll more keys but this is not supported on Azure.

The only method to do that is through an Azure Compute Gallery / Image / Version. Only at creation time.

#### Potential configuration

```
```

#### Potential References

- [Secure Boot UEFI keys](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-secure-boot-custom-uefi) (Azure documentation)

Contributor guide

Open the contributing guide

Research direction

Start by locating the shared_image_gallery_destination parameter block and its Azure Compute Gallery image-version request handling. Compare the supported fields with Azure's Secure Boot UEFI keys documentation, then verify the completed support through the provider's existing configuration and acceptance-test patterns; done means securityProfile.uefiSettings can be configured for the destination.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.