Like this, the 'qm enroll-efi-keys' operation can be done via API too. The previous Microsoft UEFI CA 2011 will expire in June 2026, so there should be a way to update that can be automated and done as a pending change while guests are running.
Suggested-by: Fabian Grünbichler <[email protected]> Suggested-by: Thomas Lamprecht <[email protected]> Signed-off-by: Fiona Ebner <[email protected]> --- Changes in v2: * improve readability/structure of drive_change() function src/PVE/QemuServer.pm | 9 +++++++++ src/PVE/QemuServer/OVMF.pm | 20 ++++++++++++++++++++ 2 files changed, 29 insertions(+) diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm index 80ee4542..5d2d4f78 100644 --- a/src/PVE/QemuServer.pm +++ b/src/PVE/QemuServer.pm @@ -4989,6 +4989,15 @@ sub vmconfig_apply_pending { if (defined($conf->{$opt}) && is_valid_drivename($opt)) { my $old_drive = parse_drive($opt, $conf->{$opt}); vmconfig_register_unused_drive($storecfg, $vmid, $conf, $old_drive); + if ($opt eq 'efidisk0') { + my $new_drive = parse_drive($opt, $conf->{pending}->{$opt}); + PVE::QemuServer::OVMF::drive_change( + $storecfg, + $vmid, + $old_drive, + $new_drive, + ); + } } elsif (defined($conf->{pending}->{$opt}) && $opt =~ m/^net\d+$/) { my $new_net = PVE::QemuServer::Network::parse_net($conf->{pending}->{$opt}); if ($conf->{$opt}) { diff --git a/src/PVE/QemuServer/OVMF.pm b/src/PVE/QemuServer/OVMF.pm index 4aa98100..436edb47 100644 --- a/src/PVE/QemuServer/OVMF.pm +++ b/src/PVE/QemuServer/OVMF.pm @@ -5,6 +5,7 @@ use warnings; use JSON qw(to_json); +use PVE::GuestHelpers qw(safe_string_ne); use PVE::RESTEnvironment qw(log_warn); use PVE::Storage; use PVE::Tools; @@ -317,4 +318,23 @@ sub ensure_ms_2023_cert_enrolled { return $efidisk; } +sub drive_change { + my ($storecfg, $vmid, $old_drive, $new_drive) = @_; + + if ( + $old_drive->{file} eq $new_drive->{file} # change affecting the same volume + && safe_string_ne($old_drive->{'ms-cert'}, $new_drive->{'ms-cert'}) # ms-cert changed + && $new_drive->{'ms-cert'} + && $new_drive->{'ms-cert'} eq '2023' + ) { + # The ms-cert marker was newly changed to 2023, ensure it's enrolled. Clear it first to + # avoid detecting as already enrolled. + delete $new_drive->{'ms-cert'}; + ensure_ms_2023_cert_enrolled($storecfg, $vmid, $new_drive); + } + + # Otherwise, there is nothing special to do. Note that changing away from ms-cert=2023 is + # allowed too, the marker is not the source of truth. +} + 1; -- 2.47.3 _______________________________________________ pve-devel mailing list [email protected] https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
