Re: [PATCH edk2-firmware/qemu-server/manager 0/4] ovmf: support pre-enrolled-keys for ARM EFI disks

["Lukas Sichert" <l.sichert@proxmox.com>]

On 2026-05-20 16:20, Fiona Ebner <f.ebner@proxmox.com> wrote:

> Have the firmware package for ARM ship the secureboot-enabled CODE
> image. The VARS image with the pre-enrolled-keys was already shipped.
>
> Let qemu-server actually honor the pre-enrolled-keys setting and use
> those images when requested.
>
> Finally, a small UX improvment to make the task warning when the
> firmware package is outdated visible in the UI.
>
> Might be nice to have soonish after the next point release since ARM
> support was generally improved with that release.


I tested this by building pve-edk2-firmware on an x86 machine and the
qemu-server and pve-manager packages on an ARM machine, then installing
all packages on that ARM machine.

Before applying the patch, the following warning was printed in the task
log:

WARN: EFI disk without 'ms-cert=2023k' option, suggesting that not all
UEFI 2023 certificates from Microsoft are enrolled yet.

After applying the patch, the warning disappeared and the EFI disk had
the ms-cert=2023k option. Inside the VM, I verified the result using:
'mokutil --sb-state', which returned 'SecureBoot enabled'.

One minor issue:
I do not know whether this is intentional, but after applying only the
first patch in pve-edk2-firmware, make deb fails. After applying the
second patch as well, it succeeds.

This fixes the issue for me, so please consider:

Tested-by: Lukas Sichert <l.sichert@promxox.com>