[pve-devel] [PATCH manager v2 8/9] ui: qemu: hardware: efi: allow enrolling Microsoft+Windows UEFI CA 2023

[Fiona Ebner]

Am 20.01.26 um 6:49 PM schrieb Thomas Lamprecht:
> Am 13.01.26 um 11:54 schrieb Fiona Ebner:
>> diff --git a/www/manager6/qemu/HardwareView.js b/www/manager6/qemu/HardwareView.js
>> index cf5e2a0f..69216932 100644
>> --- a/www/manager6/qemu/HardwareView.js
>> +++ b/www/manager6/qemu/HardwareView.js
>> @@ -442,6 +442,67 @@ Ext.define('PVE.qemu.HardwareView', {
>>              handler: run_editor,
>>          });
>>  
>> +        let runEfiEnroll = function () {
>> +            let rec = sm.getSelection()[0];
>> +            if (!rec) {
>> +                return;
>> +            }
>> +
>> +            let efidisk = PVE.Parser.parsePropertyString(rec.data.value, 'file');
>> +            efidisk['ms-cert'] = '2023';
>> +
>> +            let params = {};
>> +            params[rec.data.key] = PVE.Parser.printPropertyString(efidisk);
>> +            Proxmox.Utils.API2Request({
>> +                url: `/api2/extjs/${baseurl}`,
>> +                waitMsgTarget: me,
>> +                method: 'POST',
>> +                params: params,
>> +                callback: () => me.reload(),
>> +                failure: (response) => Ext.Msg.alert('Error', response.htmlStatus),
>> +                success: function (response, options) {
>> +                    if (response.result.data !== null) {
>> +                        Ext.create('Proxmox.window.TaskProgress', {
>> +                            autoShow: true,
>> +                            upid: response.result.data,
>> +                            listeners: {
>> +                                destroy: () => me.reload(),
>> +                            },
>> +                        });
>> +                    }
>> +                },
>> +            });
>> +        };
>> +
>> +        let efiEnrollButton = new Proxmox.button.Button({
>> +            text: gettext('Enroll updated certificates'),
>> +            selModel: sm,
>> +            disabled: true,
>> +            hidden: true,
>> +            handler: runEfiEnroll,
>> +            confirmMsg:
>> +                gettext(
>> +                    'Enroll the Microsoft and Windows UEFI 2023 CA required for secure boot update.'
>> +                ) +
>> +                '<br>' +
> 
> would probably add an extra line break here to better distinguish the description of what's
> happening here with the note below.

Ack.

>> +                gettext(
>> +                    'If the VM uses BitLocker, run the following command inside Windows Powershell:',
>> +                ) +
>> +                '<br><code>manage-bde -protectors -disable <drive></code><br>' +
>> +                Ext.String.format(
>> +                    // TRANSLATORS: for a shell command: "placeholder could be 'concrete value'"
>> +                    gettext("For example, {0} could be '{1}'."),
>> +                    '<code><drive></code>',
>> +                    '<code>C:</code>',
>> +                ) +
>> +                '<br>' +
>> +                gettext('This is required for each drive with BitLocker before proceeding!') +
>> +                '<br>' +
>> +                gettext(
>> +                    'Otherwise, you will be prompted for the BitLocker recovery key on the next boot!',
>> +                ),
>> +        });
>> +
>>          let move_menuitem = new Ext.menu.Item({
>>              text: gettext('Move Storage'),
>>              tooltip: gettext('Move disk to another storage'),
>> @@ -616,6 +677,8 @@ Ext.define('PVE.qemu.HardwareView', {
>>              let selection_model = me.getSelectionModel();
>>              let rec = selection_model.getSelection()[0];
>>  
>> +            let isWin10or11 = false;
>> +
>>              counts = {}; // en/disable hardwarebuttons
>>              let hasCloudInit = false;
>>              me.rstore.getData().items.forEach(function ({ id, data }) {
>> @@ -629,6 +692,10 @@ Ext.define('PVE.qemu.HardwareView', {
>>                      let type = match[1];
>>                      counts[type] = (counts[type] || 0) + 1;
>>                  }
>> +
>> +                if (id === 'ostype' && (data.value === 'win10' || data.value === 'win11')) {
>> +                    isWin10or11 = true;
> 
> Hmm, this is not complete though? What if my Linux distro uses a MS blessed
> signing key for the bootloader and switch to the 2023 one?

Ah, very good point! Right, they do depend on the Microsoft KEK too..

> Maybe always show it if windows or pre-enrolled-keys is true?

Ack. The backend currently also checks for OS type being Win10/11, I'll
adapt it there too.

>> @@ -822,6 +903,7 @@ Ext.define('PVE.qemu.HardwareView', {
>>                  },
>>                  remove_btn,
>>                  edit_btn,
>> +                efiEnrollButton,
> 
> Slightly torn here on button placement. Semantically it would fit better in the
> disk-action sub-menu, and while it's a bit less subtle there, it's IMO not that
> much more noticeable as is.
> If you strongly disagree with me, which I'm naturally fine with, I'd vouch for at
> least move it to the end so that the other buttons do not "jump" location when
> selection changes from another HW property to an efidisk one.

Okay, I'll move it to the disk-action sub menu. Will also add a docs patch.