Re: [PATCH edk2-firmware/qemu-server/manager 0/4] ovmf: support pre-enrolled-keys for ARM EFI disks

[Fiona Ebner <f.ebner@proxmox.com>]

Am 22.07.26 um 2:42 PM schrieb Lukas Sichert:
> On 2026-05-20 16:20, Fiona Ebner <f.ebner@proxmox.com> wrote:
> 
>> Have the firmware package for ARM ship the secureboot-enabled CODE
>> image. The VARS image with the pre-enrolled-keys was already shipped.
>>
>> Let qemu-server actually honor the pre-enrolled-keys setting and use
>> those images when requested.
>>
>> Finally, a small UX improvment to make the task warning when the
>> firmware package is outdated visible in the UI.
>>
>> Might be nice to have soonish after the next point release since ARM
>> support was generally improved with that release.
> 
> 
> I tested this by building pve-edk2-firmware on an x86 machine and the
> qemu-server and pve-manager packages on an ARM machine, then installing
> all packages on that ARM machine.
> 
> Before applying the patch, the following warning was printed in the task
> log:
> 
> WARN: EFI disk without 'ms-cert=2023k' option, suggesting that not all
> UEFI 2023 certificates from Microsoft are enrolled yet.
> 
> After applying the patch, the warning disappeared and the EFI disk had
> the ms-cert=2023k option. Inside the VM, I verified the result using:
> 'mokutil --sb-state', which returned 'SecureBoot enabled'.
> 
> One minor issue:
> I do not know whether this is intentional, but after applying only the
> first patch in pve-edk2-firmware, make deb fails. After applying the
> second patch as well, it succeeds.

No, it's not intentional. Including error messages in such cases is
helpful ;) But no need anymore. I reproduced the issue and it was the
hunk for pve-edk2-firmware-aarch64.install, which should already be part
of the first patch. I'll send a v2 with that.

> 
> This fixes the issue for me, so please consider:
> 
> Tested-by: Lukas Sichert <l.sichert@promxox.com>
> 

Thanks for testing!