From 18249f278a1f08c42fcbf6f9ab6a2af397fe15c1 Mon Sep 17 00:00:00 2001 From: Andrea Bolognani Date: Wed, 3 Aug 2022 18:07:12 +0200 Subject: [PATCH] kbase: Always explicitly enable secure-boot firmware feature MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It should be enough to enable or disable the enrolled-keys feature to control whether Secure Boot is enforced, but there's a slight complication: many distro packages for edk2 include, in addition to general purpose firmware images, builds that are targeting the Confidential Computing use case. For those, the firmware descriptor will not advertise the enrolled-keys feature, which will technically make them suitable for satisfying a configuration such as In practice, users will expect the general purpose build to be used in this case. Explicitly asking for the secure-boot feature to be enabled achieves that result at the cost of some slight additional verbosity. Signed-off-by: Andrea Bolognani Reviewed-by: Daniel P. Berrangé --- docs/kbase/secureboot.rst | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/kbase/secureboot.rst b/docs/kbase/secureboot.rst index 8f151c1f2a..5fa59ad5e2 100644 --- a/docs/kbase/secureboot.rst +++ b/docs/kbase/secureboot.rst @@ -14,6 +14,7 @@ ask for Secure Boot to be enabled with + @@ -24,6 +25,7 @@ and for it to be disabled with + @@ -44,6 +46,7 @@ snippet: +