microsoft / microsoft/secureboot_objects
[Bug]: PostSignedObjects/SignedByKEK2023/dbx_x64.efiauth2 is incomplete
Open
Nobody has claimed this yet.
state:needs-owner
state:needs-triage
type:bug
urgency:high
- Dominant language
- Python
- Stars
- 289
- Forks
- 89
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 7
Description
Is there an existing issue for this?
- I have searched existing issues
Current Behavior
It contains 291 hashes.
Expected Behavior
The previous version had 443 hashes, and with two hashes added I'd expect the number of hashes go up to 445, not down to 291.
Steps To Reproduce
- pip install virt-firmware
- download https://gitlab.com/kraxel/virt-firmware/-/blob/master/experimental/inspect-sbvar-update.py
- python inspect-sbvar-update.py -u PostSignedObjects/SignedByKEK2023/dbx_x64.efiauth2
Build Environment
- OS(s):
- Tool Chain(s):
- Targets Impacted:
Version Information
Tag: v1.7.0-signed
Urgency
High
Are you going to fix this?
Someone else needs to fix it
Do you need maintainer feedback?
No maintainer feedback needed
Anything else?
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by installing virt-firmware and running inspect-sbvar-update.py -u against PostSignedObjects/SignedByKEK2023/dbx_x64.efiauth2. Compare its 291 hashes with the previous version and determine why the two expected additions leave the object at 291; done means the signed object contains the expected 445 hashes and the inspection command confirms it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100