0）Open Sean asked that since we are adding V2 image database support, if we need to mention that the implementation can do the de-duplication for V1 and V2, and only record one copy in the variable flash region. The final verification result is same, and it can save flash space. Jiewen thought that it could be implementation choice, and there is no need to mention in the UEFI specification. Team agreed that no UEFI specification change is needed.
We can see the benefit of collapsing - to save flash space and to make search logic simpler. But it MAY change the expectation from caller, if the caller sets one version and gets another version. It may also impact PCR7 result, because the collapsing and non-collapsing firmware implementation may return different result. On the other hand, we need to think about how we we encourage people to switch from V1 format to V2 format. If we always support V1 for compatibility, then it might be hard to switch to V2. For the EDK2, we may add a PCD to control how the firmware supports image database version. (e.g. if it needs to expose V1 or V2 cap, or both), and may add a PCD as policy to perform the de-duplication / collapse. E.g. if there is a new V2 entry, delete old matching V1 entry. Or if there is a new V2 entry, convert all old V1 entry to V2 entry. However, it might be a challenge for dual OS. E.g. One OS supports V2 while the other only supports V1. There is idea to use OsIndicator variable to get info from OS. But there need to have 2 ways communication. ECIT is the reporting mechanism. And the first SetVariable(V2) can be used as an indicator that the OS support V2, and trigger the collapsing. Anyway, if the firmware changes the input value before save to variable space, it will impact PCR7. *AR: Sean* to talk MSFT bitlocker team to double confirm the impact. Then we can decide how to do the work in EDK2. But it will not impact the UEFI spec. Since we are going to add V2 in firmware, need to check if there is any impact to Linux/Grub. If it ignores unknown type, that would be good. If it rejects the database because of unknow type, that would be a problem, and we need to fix. 1) Backlog review https://github.com/orgs/tianocore/projects/10/views/1 No new issue. 2) Old issue refresh 2.1) multiple signature format - https://github.com/jyao1/UEFI-Specification-Release/pull/1 Change PKCS#7 to CMS. Looks good. 2.2) Image Validation Result Table - https://github.com/Javagedes/UEFI-Specification-Release/pull/1/changes Change the Data in EFI_SIGNATURE_VERIFICATION_RESULT to be the authority (align with TCG PCR7 measurement). Add SignatureType to let consumer distinguish the V1 or V2 database format. Add 8-bytes alignment padding. Overall it looks good. A follow-up question: Do we need change the Event in TCG PCR7 for V2 database format? *AR: Joey/Doug* to have internal sync first to determine if we need SignatureType for PCR7. NOTE: Since this is for TCG, it does not impact UEFI specification. 3) Some idea for image verification https://github.com/microsoft/mu_basecore/pull/1809 https://github.com/Javagedes/mu_basecore/tree/personal/joeyvagedes/securitypkg-image-validation/SecurityPkg/Test/ShellTest/ImageValidationTestApp#all-tests Some feedback: Add V2 test case 4) Ready to go back to USST? Totally we have 23 issues in https://github.com/orgs/tianocore/projects/10/views/1. 22 are ready for review. The only exception is ECIT - https://github.com/tianocore/edk2/issues/12408. MSFT think the ECIT need more feedback from different teams to see if the current definition is good enough. Decision: Submit request to USWG for discussion in the next week (Aug 20, 2026) - *AR: Jiewen* to initiate email to USWG chair. Switch back to USST next week (Aug 19, 2026) for the final sync. - *AR: Jiewen* to cancel EDK2 PQC meeting, and setup USST meeting next week. A reminder: *AR: All* - If there is any feedback for a issue, please comment in code first github first, then we can do prototype publicly. Please do not commit to mantis or in USST directly. Thank you Yao, Jiewen -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#122077): https://edk2.groups.io/g/devel/message/122077 Mute This Topic: https://groups.io/mt/120731450/21656 Group Owner: [email protected] Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
