Repository navigation
[Feature]: Publish a single .efiauth2 file for each PostSignedObjects\DBX\SignedByKEK2011\dbx_Arch_Legacy subfolder #462
Description
Activity
Can efiauth2 handle multiple full EfiAuthentication2 structs in the same file?
For windows the 2011-signed files are packages together into a .cab, we could share that here as well or use something like .zip
What would you vote for?
For the previous GitHub releases, a single DBXupdate.bin file was provided. For the end-user, what is the purpose of having a baseline file and two (or potentially more) incremental files? Most users just want the latest version of all the structs in a single file.
If change control needs to be expressed, it should be written to an external Change Log instead of having separate files represent the changes that have happened since the baseline file was released.
In Windows, the SecureBootUpdates folder only provides one DBXupdate.bin file. We don't have the one released in Oct 2025 and two extra files representing the two batches of banned files since Oct 2025. Having a ZIP implies MS is free to add as many incremental files over time (without bounds).
That's putting a burden on anyone who's consuming the ZIP file to keep up with changes.
How many files will there be? How are they going to be named? The files used to be .bin, and now they're .efiauth2 which doesn't match the previous naming patterns. Once a precedent is established, it would be nicer to follow it unless there's an overreaching reason for the new change.
SignedByKEK2023 gets a single file per architecture type, but SignedByKEK2011 gets a collection of files. That doesn't make a lot of sense if both set of changes is supposed to be identical, but the only difference is their signing certs.
For windows the 2011-signed files are packages together into a .cab
I guess I have two questions: In what order do we deploy the EfiAuthentication2 structs? What percentage of firmware globally can accept concatenated variable appends?
Feature Overview
It's inconvenient to end-users for MS to publish multiple .efiauth2 files for each of the SignedByKEK2011 subfolders, because having an unknown number of DBX files requires someone to write an automation script to crawl the GitHub folder.
I thought the point was to have one file which could be downloaded, compared against, or applied to the host. If new EFI hashes are to be published, a new consolidated DBX file should be provided, instead of a set of side by side files.
Solution Overview
In future DBX updates, consolidate the SignedByKEK2011 efiauth2 files into a single file (by architecture) provided in the repro
dbx_${Arch}_Legacy.efiauth2
Alternatives Considered
No response
Urgency
Medium
Are you going to implement the feature request?
No
Do you need maintainer feedback?
No maintainer feedback needed
Anything else?
No response