microsoft/secureboot_objects v1.6.0

v1.6.0

Repository: microsoft/secureboot_objects

Tag: v1.6.0

Published: 2025-10-20T03:51:35Z

Prerelease: no

Release notes: ⚠️ IMPORTANT

Signed DBX and Revocations have been updated to include the revocations for Igel* - see https://github.com/microsoft/secureboot_objects/pull/272

Updating post signed folder with signed DB update packages for 3P UEFI CA and Option ROM CA - see https://github.com/microsoft/secureboot_objects/pull/226

Bumping SVN revocation for Windows bootmgr from 5 to 7 - see https://github.com/microsoft/secureboot_objects/pull/263

What's Changed

Updating Post signed DBX folder with latest revocation of vulnerable IGEL shims @SochiOgbuanya (#272)

Change Details

Description

Secure Boot Bypass due to vulnerable IGEL Linux shims

Attacker who has gained physical access to the device can plant vulnerable shims that allow loading older Linux loader which in turn loads unsigned Kernel. It is integrity bypass for boot code.

• [ ] Impacts functionality?
• [X] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

Verified by trying to boot using vulnerable IGEL boot module to ensure the modules are blocked from booting on Secure boot enabled system

Integration Instructions

N/A

Clean up Post Signed Objects Branch @Flickdm (#265)

Change Details

Description

Cleaning up documentation to point to the Wiki.

Additionally,

• Deleted uncessary copy of kek_update_map.json
• Fixing auth_var_tool.py so it creates the output folder if it doesn't exist

For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

• [ ] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [X] Includes documentation?

How This Was Tested

Local testing to verify functionality of wiki

Integration Instructions

N/A

Bumping SVN revocation for Windows bootmgr from 5 to 7 @SochiOgbuanya (#263)

Change Details

Description

Windows bootmgr svn revocation bumped from 5 to 7 as Windows Boot Manager can be rolled back to previous vulnerable version to trigger Secure boot rollback.

For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

• [ ] Impacts functionality? No
• [x] Impacts security? Yes
• [ ] Breaking change?
• [ ] Includes tests? No
• [ ] Includes documentation? No

How This Was Tested

Booted to latest Windows version and blocked affected versions

Integration Instructions

N/A

Update InstallSecureBootKeys.ps1 @serock (#246)

Change Details

Fixes microsoft/secureboot_objects#245

Description

Changed "$esult" to "$Result" so that the script can properly determine if the DBX was enrolled successfully.

• [ ] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

Tested on a Dell Inspiron 3847 with the MicrosoftAndThirdParty/Firmware files from https://github.com/microsoft/secureboot_objects/releases/download/v1.5.1/edk2-x64-secureboot-binaries.zip and a customized DBX.bin file.

Integration Instructions

N/A

Feature: Authenticated Variable Tooling @Flickdm (#236)

Change Details

Description

This pull request introduces two major updates: a CLI utility for working with secure boot objects in the operating system and a test script to generate test certificates to debug and work with a platform. These scripts can be used to perform the full end to end secure boot workflow in two configurations - local signing, or remote signing.

Full chain usage will be added to the WIKI and a link will be added here.

• [ ] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [X] Includes documentation?

https://github.com/microsoft/secureboot_objects/wiki/Secure-Boot-Workflow#secure-boot-workflow-setup-mode-key-installation-and-management

How This Was Tested

Local Testing on Devkit

Integration Instructions

N/A

Fix "Lable" misspelling in Make2023BootableMedia.ps1 @[copilot-swe-agent[bot]](https://github.com/apps/copilot-swe-agent) (#221)

Change Details

Fixed multiple spelling errors in the PowerShell script Make2023BootableMedia.ps1:

Primary fix:

• Corrected ISO_Lable to ISO_Label throughout the script (4 occurrences on lines 230, 718, 719, and 725)
• This ensures consistency with the correctly spelled variable declaration on line 806

Additional spelling corrections:

• Fixed "Avalable" to "Available" in ADK requirement message (line 76)
• Fixed "defualt" to "default" in comment (line 717)
• Fixed "$ISOLable" to "$ISOLabel" in comment (line 717)

The variable name inconsistency could have caused runtime errors when the script attempts to reference $global:ISO_Label but some parts of the code were setting $global:ISO_Lable. All variable references now use the correct spelling ISO_Label.

Fixes #220.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Updating Post signed folder with signed db update packages for 3P CAs. @SochiOgbuanya (#226)

Change Details

Description

Updating post signed folder with signed DB update packages for 3P UEFI CA and Option ROM CA

Added db update packages for 3P UEFI CA 2023 and Option ROM CA 2023 to post signed folder. Moved older json to archives.

• [ ] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

Updated on local machines and @hughsie tested via fwupd

Integration Instructions

FIrmware does not require this payload however third party operating systems may

Create pipeline to validate DBX JSON certificate references @[copilot-swe-agent[bot]](https://github.com/apps/copilot-swe-agent) (#225)

Change Details

This PR implements a validation pipeline to ensure that DBX JSON files reference certificate files that actually exist in the PreSignedObjects/DBX/Certificates folder.

Problem

When new DBX JSON files are created, the internal certificate names referenced in the JSON don't always match the external filenames in the Certificates...