[pve-devel] [PATCH qemu-server v2 4/9] config: apply pending: efi: enroll Microsoft UEFI CA 2023 when setting ms-cert=2023 option

[Fiona Ebner]

Like this, the 'qm enroll-efi-keys' operation can be done via API too.

The previous Microsoft UEFI CA 2011 will expire in June 2026, so there
should be a way to update that can be automated and done as a pending
change while guests are running.

Suggested-by: Fabian Grünbichler <f.gruenbichler at proxmox.com>
Suggested-by: Thomas Lamprecht <t.lamprecht at proxmox.com>
Signed-off-by: Fiona Ebner <f.ebner at proxmox.com>
---

Changes in v2:
* improve readability/structure of drive_change() function

 src/PVE/QemuServer.pm      |  9 +++++++++
 src/PVE/QemuServer/OVMF.pm | 20 ++++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 80ee4542..5d2d4f78 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -4989,6 +4989,15 @@ sub vmconfig_apply_pending {
             if (defined($conf->{$opt}) && is_valid_drivename($opt)) {
                 my $old_drive = parse_drive($opt, $conf->{$opt});
                 vmconfig_register_unused_drive($storecfg, $vmid, $conf, $old_drive);
+                if ($opt eq 'efidisk0') {
+                    my $new_drive = parse_drive($opt, $conf->{pending}->{$opt});
+                    PVE::QemuServer::OVMF::drive_change(
+                        $storecfg,
+                        $vmid,
+                        $old_drive,
+                        $new_drive,
+                    );
+                }
             } elsif (defined($conf->{pending}->{$opt}) && $opt =~ m/^net\d+$/) {
                 my $new_net = PVE::QemuServer::Network::parse_net($conf->{pending}->{$opt});
                 if ($conf->{$opt}) {
diff --git a/src/PVE/QemuServer/OVMF.pm b/src/PVE/QemuServer/OVMF.pm
index 4aa98100..436edb47 100644
--- a/src/PVE/QemuServer/OVMF.pm
+++ b/src/PVE/QemuServer/OVMF.pm
@@ -5,6 +5,7 @@ use warnings;
 
 use JSON qw(to_json);
 
+use PVE::GuestHelpers qw(safe_string_ne);
 use PVE::RESTEnvironment qw(log_warn);
 use PVE::Storage;
 use PVE::Tools;
@@ -317,4 +318,23 @@ sub ensure_ms_2023_cert_enrolled {
     return $efidisk;
 }
 
+sub drive_change {
+    my ($storecfg, $vmid, $old_drive, $new_drive) = @_;
+
+    if (
+        $old_drive->{file} eq $new_drive->{file} # change affecting the same volume
+        && safe_string_ne($old_drive->{'ms-cert'}, $new_drive->{'ms-cert'}) # ms-cert changed
+        && $new_drive->{'ms-cert'}
+        && $new_drive->{'ms-cert'} eq '2023'
+    ) {
+        # The ms-cert marker was newly changed to 2023, ensure it's enrolled. Clear it first to
+        # avoid detecting as already enrolled.
+        delete $new_drive->{'ms-cert'};
+        ensure_ms_2023_cert_enrolled($storecfg, $vmid, $new_drive);
+    }
+
+    # Otherwise, there is nothing special to do. Note that changing away from ms-cert=2023 is
+    # allowed too, the marker is not the source of truth.
+}
+
 1;
-- 
2.47.3