Chris Fenner
@chrisfenner.bsky.social
Here is the biggest problem I can see. PCR7 contains DB (authority keys and hashes) already but it gets extended again with each key the first time it gets used.
![5. Before launching an EFI Driver or an EFI Boot Application (and regardless of whether the launch is due to the EFI Boot Manager picking an image from the DriverOrder or BootOrder UEFI variables or an already launched image calling the UEFI Loadlmage() function), the UEFI firmware SHALL determine if the entry in the EFI_IMAGE_SECURITY_DATABASE_GUID/EF|_ IMAGE_SECURITY_DATABASE variable that was used to validate the EFI image has previously been measured with the EV_EF_VARIABLE_AUTHORITY event type in PCR[7]. If it has not been, it MUST be measured into PCR[7] as follows. If it has been measured previously, it MUST NOT be measured again. The measurement SHALL occur in conjunction with image load.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:jk43wuenubqwx5gonueklyrn/bafkreigjhy43dr73gezdh6nfyx7xuxlhfc7zlhjkoobphmqrcpj23q64ce@jpeg)
January 24, 2026 at 3:42 PM
Here is the biggest problem I can see. PCR7 contains DB (authority keys and hashes) already but it gets extended again with each key the first time it gets used.
THOUGHTS IN PLAINTEXT
January 13, 2026 at 2:51 PM
THOUGHTS IN PLAINTEXT
I wrote about a feature I got disabled-by-default in Linux last year dlp.rip/decorative-c...
January 4, 2026 at 3:13 AM
I wrote about a feature I got disabled-by-default in Linux last year dlp.rip/decorative-c...