From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id DC93B1FF17E for ; Thu, 11 Dec 2025 13:31:37 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 60BEF148E7; Thu, 11 Dec 2025 13:31:57 +0100 (CET) From: Fiona Ebner To: pve-devel@lists.proxmox.com Date: Thu, 11 Dec 2025 13:31:26 +0100 Message-ID: <20251211123145.143908-7-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20251211123145.143908-1-f.ebner@proxmox.com> References: <20251211123145.143908-1-f.ebner@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1765456306983 X-SPAM-LEVEL: Spam detection results: 0 AWL -0.016 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pve-devel] [PATCH manager 6/6] ui: qemu: hardware: efi: allow enrolling Microsoft UEFI CA 2023 X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox VE development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pve-devel-bounces@lists.proxmox.com Sender: "pve-devel" When the following conditions are met: - no pending change on the EFI disk - OS type Windows 10 or 11 - EFI disk has pre-enrolled-keys - There is no ms-cert=2023 marker yet suggest enrolling the new Microsoft UEFI CA 2023. The previous Microsoft UEFI CA 2011 will expire in June 2026, so there needs to be an easy way to update. Signed-off-by: Fiona Ebner --- www/manager6/qemu/HardwareView.js | 78 +++++++++++++++++++++++++++++++ 1 file changed, 78 insertions(+) diff --git a/www/manager6/qemu/HardwareView.js b/www/manager6/qemu/HardwareView.js index cf5e2a0f..3025da74 100644 --- a/www/manager6/qemu/HardwareView.js +++ b/www/manager6/qemu/HardwareView.js @@ -442,6 +442,63 @@ Ext.define('PVE.qemu.HardwareView', { handler: run_editor, }); + let runEfiEnroll = function () { + let rec = sm.getSelection()[0]; + if (!rec) { + return; + } + + let efidisk = PVE.Parser.parsePropertyString(rec.data.value, 'file'); + efidisk['ms-cert'] = '2023'; + + let params = {}; + params[rec.data.key] = PVE.Parser.printPropertyString(efidisk); + Proxmox.Utils.API2Request({ + url: `/api2/extjs/${baseurl}`, + waitMsgTarget: me, + method: 'POST', + params: params, + callback: () => me.reload(), + failure: (response) => Ext.Msg.alert('Error', response.htmlStatus), + success: function (response, options) { + if (response.result.data !== null) { + Ext.create('Proxmox.window.TaskProgress', { + autoShow: true, + upid: response.result.data, + listeners: { + destroy: () => me.reload(), + }, + }); + } + }, + }); + }; + + let efiEnrollButton = new Proxmox.button.Button({ + text: gettext('Enroll MS 2023 Cert'), + selModel: sm, + disabled: true, + hidden: true, + handler: runEfiEnroll, + confirmMsg: + gettext( + 'If the VM uses BitLocker, run the following command inside Windows Powershell:', + ) + + '
manage-bde -protectors -disable <drive>
' + + Ext.String.format( + // TRANSLATORS: for a shell command: "placeholder could be 'concrete value'" + gettext("For example, {0} could be '{1}'."), + '<drive>', + 'C:', + ) + + '
' + + gettext('This is required for each drive with BitLocker before proceeding!') + + '
' + + gettext( + 'Otherwise, you will be prompted for the BitLocker recovery key on the next boot!', + ), + }); + let move_menuitem = new Ext.menu.Item({ text: gettext('Move Storage'), tooltip: gettext('Move disk to another storage'), @@ -616,6 +673,8 @@ Ext.define('PVE.qemu.HardwareView', { let selection_model = me.getSelectionModel(); let rec = selection_model.getSelection()[0]; + let isWin10or11 = false; + counts = {}; // en/disable hardwarebuttons let hasCloudInit = false; me.rstore.getData().items.forEach(function ({ id, data }) { @@ -629,6 +688,10 @@ Ext.define('PVE.qemu.HardwareView', { let type = match[1]; counts[type] = (counts[type] || 0) + 1; } + + if (id === 'ostype' && (data.value === 'win10' || data.value === 'win11')) { + isWin10or11 = true; + } }); // heuristic only for disabling some stuff, the backend has the final word. @@ -655,6 +718,7 @@ Ext.define('PVE.qemu.HardwareView', { if (!rec) { remove_btn.disable(); edit_btn.disable(); + efiEnrollButton.disable(); diskaction_btn.disable(); revert_btn.disable(); return; @@ -686,6 +750,16 @@ Ext.define('PVE.qemu.HardwareView', { ); remove_btn.RESTMethod = isUnusedDisk || (isDisk && isRunning) ? 'POST' : 'PUT'; + let suggestEfiEnroll = false; + if (isEfi) { + let drive = PVE.Parser.parsePropertyString(value, 'file'); + suggestEfiEnroll = + !pending && + isWin10or11 && + PVE.Parser.parseBoolean(drive['pre-enrolled-keys'], false) && + drive['ms-cert'] !== '2023'; + } + edit_btn.setDisabled( deleted || !row.editor || @@ -694,6 +768,9 @@ Ext.define('PVE.qemu.HardwareView', { (isDisk && !diskCap), ); + efiEnrollButton.setDisabled(!suggestEfiEnroll); + efiEnrollButton.setHidden(!suggestEfiEnroll); + diskaction_btn.setDisabled( pending || !diskCap || isCloudInit || !(isDisk || isEfi || tpmMoveable), ); @@ -822,6 +899,7 @@ Ext.define('PVE.qemu.HardwareView', { }, remove_btn, edit_btn, + efiEnrollButton, diskaction_btn, revert_btn, ], -- 2.47.3 _______________________________________________ pve-devel mailing list pve-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel