hashicorp / hashicorp/packer-plugin-azure
Add support for securityProfile / uefiSettings on shared_image_gallery_destination
- Dominant language
- Go
- Stars
- 63
- Forks
- 103
- PR merge metrics
- No merged PRs in 30d
Description
#### Community Note
Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request.
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request.
If you are interested in working on this issue or have submitted a pull request, please leave a comment.
#### Description
It is possible to enroll/replace UEFI keys on an Azure Compute Gallery Image Version using ARM Template:
```"securityProfile": {
"uefiSettings": {
"signatureTemplateNames": [
"MicrosoftUefiCertificateAuthorityTemplate"
],
"additionalSignatures": {
"db": [
{
"type": "x509",
"value": [
"Base64 formatted certificate",
"Base64 formatted certificate"
]
}
],
"dbx": [
{
"type": "sha256",
"value": [
"Base64 formatted sha256 hash",
"Base64 formatted sha256 hash"
]
}
]
}
}
}
```
This example comes from Azure's documentation [Secure Boot UEFI keys](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-secure-boot-custom-uefi#scenario-2-append-keys-to-db-and-dbx-to-a-signature-template).
The packer-plugin-azure provider has a parameter block `shared_image_gallery_destination` but it's not currently possible to set `securityProfile` or `securityProfile.uefiSettings`.
Alternatively it would be great to be able to add custom ARM Template code.
#### Use Case(s)
Azure has a feature "Trusted launch" that is basically a secure boot. Some software such as proprietary anti viruses try to load themselves into the kernel and fails because they are signed by an external authority unrecognized by UEFI.
We usually use `mokutil` to enroll more keys but this is not supported on Azure.
The only method to do that is through an Azure Compute Gallery / Image / Version. Only at creation time.
#### Potential configuration
```
```
#### Potential References
- [Secure Boot UEFI keys](https://learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch-secure-boot-custom-uefi) (Azure documentation)
Contributor guide
Research direction
Start by locating the shared_image_gallery_destination parameter block and its Azure Compute Gallery image-version request handling. Compare the supported fields with Azure's Secure Boot UEFI keys documentation, then verify the completed support through the provider's existing configuration and acceptance-test patterns; done means securityProfile.uefiSettings can be configured for the destination.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100