[pve-devel] [PATCH manager v2 8/9] ui: qemu: hardware: efi: allow enrolling Microsoft+Windows UEFI CA 2023

[Fiona Ebner]

When the following conditions are met:
- no pending change on the EFI disk
- OS type Windows 10 or 11
- EFI disk has pre-enrolled-keys
- There is no ms-cert=2023 marker yet
suggest enrolling the new Microsoft and Windows UEFI CA 2023.

The previous Microsoft UEFI CA 2011 will expire in June 2026 and the
previous Windows UEFI CA 2011 will expire in October 2026, so there
needs to be an easy way to update.

Signed-off-by: Fiona Ebner <f.ebner at proxmox.com>
---

Changes in v2:
* add more context to confirm dialog

 www/manager6/qemu/HardwareView.js | 82 +++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/www/manager6/qemu/HardwareView.js b/www/manager6/qemu/HardwareView.js
index cf5e2a0f..69216932 100644
--- a/www/manager6/qemu/HardwareView.js
+++ b/www/manager6/qemu/HardwareView.js
@@ -442,6 +442,67 @@ Ext.define('PVE.qemu.HardwareView', {
             handler: run_editor,
         });
 
+        let runEfiEnroll = function () {
+            let rec = sm.getSelection()[0];
+            if (!rec) {
+                return;
+            }
+
+            let efidisk = PVE.Parser.parsePropertyString(rec.data.value, 'file');
+            efidisk['ms-cert'] = '2023';
+
+            let params = {};
+            params[rec.data.key] = PVE.Parser.printPropertyString(efidisk);
+            Proxmox.Utils.API2Request({
+                url: `/api2/extjs/${baseurl}`,
+                waitMsgTarget: me,
+                method: 'POST',
+                params: params,
+                callback: () => me.reload(),
+                failure: (response) => Ext.Msg.alert('Error', response.htmlStatus),
+                success: function (response, options) {
+                    if (response.result.data !== null) {
+                        Ext.create('Proxmox.window.TaskProgress', {
+                            autoShow: true,
+                            upid: response.result.data,
+                            listeners: {
+                                destroy: () => me.reload(),
+                            },
+                        });
+                    }
+                },
+            });
+        };
+
+        let efiEnrollButton = new Proxmox.button.Button({
+            text: gettext('Enroll updated certificates'),
+            selModel: sm,
+            disabled: true,
+            hidden: true,
+            handler: runEfiEnroll,
+            confirmMsg:
+                gettext(
+                    'Enroll the Microsoft and Windows UEFI 2023 CA required for secure boot update.'
+                ) +
+                '<br>' +
+                gettext(
+                    'If the VM uses BitLocker, run the following command inside Windows Powershell:',
+                ) +
+                '<br><code>manage-bde -protectors -disable <drive></code><br>' +
+                Ext.String.format(
+                    // TRANSLATORS: for a shell command: "placeholder could be 'concrete value'"
+                    gettext("For example, {0} could be '{1}'."),
+                    '<code><drive></code>',
+                    '<code>C:</code>',
+                ) +
+                '<br>' +
+                gettext('This is required for each drive with BitLocker before proceeding!') +
+                '<br>' +
+                gettext(
+                    'Otherwise, you will be prompted for the BitLocker recovery key on the next boot!',
+                ),
+        });
+
         let move_menuitem = new Ext.menu.Item({
             text: gettext('Move Storage'),
             tooltip: gettext('Move disk to another storage'),
@@ -616,6 +677,8 @@ Ext.define('PVE.qemu.HardwareView', {
             let selection_model = me.getSelectionModel();
             let rec = selection_model.getSelection()[0];
 
+            let isWin10or11 = false;
+
             counts = {}; // en/disable hardwarebuttons
             let hasCloudInit = false;
             me.rstore.getData().items.forEach(function ({ id, data }) {
@@ -629,6 +692,10 @@ Ext.define('PVE.qemu.HardwareView', {
                     let type = match[1];
                     counts[type] = (counts[type] || 0) + 1;
                 }
+
+                if (id === 'ostype' && (data.value === 'win10' || data.value === 'win11')) {
+                    isWin10or11 = true;
+                }
             });
 
             // heuristic only for disabling some stuff, the backend has the final word.
@@ -655,6 +722,7 @@ Ext.define('PVE.qemu.HardwareView', {
             if (!rec) {
                 remove_btn.disable();
                 edit_btn.disable();
+                efiEnrollButton.disable();
                 diskaction_btn.disable();
                 revert_btn.disable();
                 return;
@@ -686,6 +754,16 @@ Ext.define('PVE.qemu.HardwareView', {
             );
             remove_btn.RESTMethod = isUnusedDisk || (isDisk && isRunning) ? 'POST' : 'PUT';
 
+            let suggestEfiEnroll = false;
+            if (isEfi) {
+                let drive = PVE.Parser.parsePropertyString(value, 'file');
+                suggestEfiEnroll =
+                    !pending &&
+                    isWin10or11 &&
+                    PVE.Parser.parseBoolean(drive['pre-enrolled-keys'], false) &&
+                    drive['ms-cert'] !== '2023';
+            }
+
             edit_btn.setDisabled(
                 deleted ||
                     !row.editor ||
@@ -694,6 +772,9 @@ Ext.define('PVE.qemu.HardwareView', {
                     (isDisk && !diskCap),
             );
 
+            efiEnrollButton.setDisabled(!suggestEfiEnroll);
+            efiEnrollButton.setHidden(!suggestEfiEnroll);
+
             diskaction_btn.setDisabled(
                 pending || !diskCap || isCloudInit || !(isDisk || isEfi || tpmMoveable),
             );
@@ -822,6 +903,7 @@ Ext.define('PVE.qemu.HardwareView', {
                 },
                 remove_btn,
                 edit_btn,
+                efiEnrollButton,
                 diskaction_btn,
                 revert_btn,
             ],
-- 
2.47.3