Hi Ian, Thank you for the series.
On Fri, Jul 10, 2026 at 14:23, Ian Mullins <[email protected]> wrote: > This series implements the EFI_SECURITY_ARCH_PROTOCOL and > EFI_SECURITY2_ARCH_PROTOCOL. The primary motivation is to support EFI > applications like systemd-stub in Unified Kernel Images (UKI) so they > can temporarily override authentication for embedded payloads. > > Note: This work was originally authored by Enric Balletbo i Serra. > I am submitting it upstream on his behalf with additional testing. > > --- > Testing Performed > > I have validated these patches across various secure boot scenarios on > both physical hardware and emulators to ensure the new overrides work > without regressing standard secure boot enforcement. > > Hardware: Renesas R-Car S4 (EBBR UKI boot) > - [PASS] Unsigned image, Secure Boot disabled, without patch > (Boots) > - [PASS] Unsigned image, Secure Boot compiled (not enforcing), > without patch (Boots) > - [PASS] Signed image, Secure Boot enforcing, without patch > (Fails to boot as expected) > - [PASS] Signed image, Secure Boot enforcing, with patch > (Boots successfully) > - [PASS] Signed image (wrong keys), Secure Boot enforcing, with patch > (Fails to boot as expected) > > Emulator: QEMU (qemu UKI boot) > - [PASS] Unsigned image, Secure Boot disabled, without patch > (Boots) > - [PASS] Unsigned image, Secure Boot enabled, without patch > (Boots) > - [PASS] Signed image, Secure Boot enabled, without patch > (Fails to boot as expected) > - [PASS] Signed image, Secure Boot enabled, with patch > (Boots successfully) > > Signed-off-by: Ian Mullins <[email protected]> I've run the newly provided sandbox tests with: $ ./test/py/test.py --bd sandbox --build -k test_efi_secboot And I see all test pass (22) Tested-by: Mattijs Korpershoek <[email protected]> # sandbox > > ---
