[pve-devel] [PATCH qemu-server v2 6/9] efi disk: distinguish between having only MS 2023 cert and also having Windows 2023 cert

[Fiona Ebner]

Like this, the need to enroll the Windows 2023 cert can easily be
detected and done for drives where the Microsoft 2023 cert was already
enrolled.

Signed-off-by: Fiona Ebner <f.ebner at proxmox.com>
---

New in v2.

 src/PVE/CLI/qm.pm           | 2 +-
 src/PVE/QemuServer.pm       | 2 +-
 src/PVE/QemuServer/Drive.pm | 6 ++++--
 src/PVE/QemuServer/OVMF.pm  | 8 ++++----
 4 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/src/PVE/CLI/qm.pm b/src/PVE/CLI/qm.pm
index adf90f3c..bdae9641 100755
--- a/src/PVE/CLI/qm.pm
+++ b/src/PVE/CLI/qm.pm
@@ -734,7 +734,7 @@ __PACKAGE__->register_method({
             PVE::QemuServer::OVMF::ensure_ms_2023_cert_enrolled($storecfg, $vmid, $efidisk);
 
         if (!$updated) {
-            print "skipping - no pre-enrolled keys or already got ms-cert=2023 marker\n";
+            print "skipping - no pre-enrolled keys or already got ms-cert=2023w marker\n";
             return;
         }
 
diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 5d2d4f78..3e8be180 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -5433,7 +5433,7 @@ my sub check_efi_vars {
     my $efidisk = parse_drive('efidisk0', $conf->{efidisk0});
     if (PVE::QemuServer::OVMF::should_enroll_ms_2023_cert($efidisk)) {
         # TODO: make the first print a log_warn with PVE 9.2 to make it more noticeable!
-        print "EFI disk without 'ms-cert=2023' option, suggesting that the Microsoft UEFI 2023"
+        print "EFI disk without 'ms-cert=2023w' option, suggesting that the Microsoft UEFI 2023"
             . " certificate is not enrolled yet. The UEFI 2011 certificate expires in June 2026!\n";
         print "While the VM is shut down, run 'qm enroll-efi-keys $vmid' to enroll it.\n";
         print "If the VM uses BitLocker, run the following command inside Windows Powershell:\n";
diff --git a/src/PVE/QemuServer/Drive.pm b/src/PVE/QemuServer/Drive.pm
index 0d59d1df..ae907b5c 100644
--- a/src/PVE/QemuServer/Drive.pm
+++ b/src/PVE/QemuServer/Drive.pm
@@ -523,10 +523,12 @@ my %efitype_fmt = (
     },
     'ms-cert' => {
         type => 'string',
-        enum => [qw(2011 2023)],
+        enum => [qw(2011 2023 2023w)],
         description =>
             "Informational marker indicating the version of the latest Microsoft UEFI certificate"
-            . " that has been enrolled by Proxmox VE.",
+            . " that has been enrolled by Proxmox VE. The value '2023w' means that both the"
+            . " 'Microsoft UEFI CA 2023' and the 'Windows UEFI CA 2023' certificates are included."
+            . " The value '2023' is deprecated and for compatibility only.",
         optional => 1,
         default => '2011',
     },
diff --git a/src/PVE/QemuServer/OVMF.pm b/src/PVE/QemuServer/OVMF.pm
index a8317ea6..01b037ef 100644
--- a/src/PVE/QemuServer/OVMF.pm
+++ b/src/PVE/QemuServer/OVMF.pm
@@ -180,7 +180,7 @@ sub create_efidisk($$$$$$$$) {
     my $size = PVE::Storage::volume_size_info($storecfg, $volid, 3);
 
     if ($efidisk->{'pre-enrolled-keys'} && is_ms_2023_cert_enrolled($ovmf_vars)) {
-        $efidisk->{'ms-cert'} = '2023';
+        $efidisk->{'ms-cert'} = '2023w';
     }
 
     return ($volid, $size / 1024);
@@ -283,7 +283,7 @@ sub should_enroll_ms_2023_cert {
     my ($efidisk) = @_;
 
     return if !$efidisk->{'pre-enrolled-keys'};
-    return if $efidisk->{'ms-cert'} && $efidisk->{'ms-cert'} eq '2023';
+    return if $efidisk->{'ms-cert'} && $efidisk->{'ms-cert'} eq '2023w';
 
     return 1;
 }
@@ -323,7 +323,7 @@ sub ensure_ms_2023_cert_enrolled {
 
     die "efidisk0: enrolling Microsoft UEFI CA 2023 failed - $err" if $err;
 
-    $efidisk->{'ms-cert'} = '2023';
+    $efidisk->{'ms-cert'} = '2023w';
     return $efidisk;
 }
 
@@ -334,7 +334,7 @@ sub drive_change {
         $old_drive->{file} eq $new_drive->{file} # change affecting the same volume
         && safe_string_ne($old_drive->{'ms-cert'}, $new_drive->{'ms-cert'}) # ms-cert changed
         && $new_drive->{'ms-cert'}
-        && $new_drive->{'ms-cert'} eq '2023'
+        && $new_drive->{'ms-cert'} =~ m/^2023/
     ) {
         # The ms-cert marker was newly changed to 2023, ensure it's enrolled. Clear it first to
         # avoid detecting as already enrolled.
-- 
2.47.3