[edk2-devel] ArmPlatformPkg: does SecureBootDefaultKeys.fdf.inc need updated to add more DB files?

[edk2-devel] ArmPlatformPkg: does SecureBootDefaultKeys.fdf.inc need updated to add more DB files?

[Rebecca Cran]

I've been following 
https://github.com/edk2-porting/edk2-rk3588/issues/69 to add Secure Boot 
support, and found this page that has guidance from Microsoft: 
https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/windows-secure-boot-key-creation-and-management-guidance?view=windows-11 
.


Currently ArmPlatformPkg/SecureBootDefaultKeys.fdf.inc supports 3 DB 
files, but the Microsoft page appears to have 5 available for download?


Microsoft Windows Production PCA 2011

https://go.microsoft.com/fwlink/p/?linkid=321192

Windows UEFI CA 2023

https://go.microsoft.com/fwlink/?linkid=2239776

Microsoft Corporation UEFI CA 2011

https://go.microsoft.com/fwlink/p/?linkid=321194

Microsoft UEFI CA 2023

https://go.microsoft.com/fwlink/?linkid=2239872

Microsoft Option ROM UEFI CA 2023

https://go.microsoft.com/fwlink/?linkid=2284009


The RPi4 CI script 
(https://github.com/pftf/RPi4/blob/master/.github/workflows/linux_edk2.yml#L50-L58) 
downloads these 4:

curl -L https://go.microsoft.com/fwlink/?linkid=321192 -o keys/ms_db1.cer
curl -L https://go.microsoft.com/fwlink/?linkid=321194 -o keys/ms_db2.cer
curl -L https://go.microsoft.com/fwlink/?linkid=2239776 -o keys/ms_db3.cer
curl -L https://go.microsoft.com/fwlink/?linkid=2239872 -o keys/ms_db4.cer


Do we only want 3 of the available files, or are all of them relevant?


-- 
Rebecca Cran



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#120715): https://edk2.groups.io/g/devel/message/120715
Mute This Topic: https://groups.io/mt/109402104/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-