microsoft / microsoft/secureboot_objects
[Feature]: Publish a single .efiauth2 file for each PostSignedObjects\DBX\SignedByKEK2011\dbx_Arch_Legacy subfolder
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 289
- Forks
- 89
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 7
Description
Feature Overview
It's inconvenient to end-users for MS to publish multiple .efiauth2 files for each of the SignedByKEK2011 subfolders, because having an unknown number of DBX files requires someone to write an automation script to crawl the GitHub folder.
I thought the point was to have one file which could be downloaded, compared against, or applied to the host. If new EFI hashes are to be published, a new consolidated DBX file should be provided, instead of a set of side by side files.
Solution Overview
In future DBX updates, consolidate the SignedByKEK2011 efiauth2 files into a single file (by architecture) provided in the repro
dbx_${Arch}_Legacy.efiauth2
Alternatives Considered
No response
Urgency
Medium
Are you going to implement the feature request?
No
Do you need maintainer feedback?
No maintainer feedback needed
Anything else?
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by inspecting the PostSignedObjects/DBX/SignedByKEK2011/dbx_Arch_Legacy subfolders and the existing architecture-specific .efiauth2 files. Determine how DBX updates are assembled and published; done means each architecture has one consolidated dbx_${Arch}_Legacy.efiauth2 file in the repository.
Written by the indexing model from the issue text.
Assessment
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100