With https://github.com/microsoft/secureboot_objects/tree/main/PostSignedObjects/Optional/DB providing the Windows UEFI CA 2023, Microsoft UEFI CA 2023 and Microsoft Option ROM UEFI CA 2023, along with the OEM signed KEK updates from https://github.com/microsoft/secureboot_objects/tree/main/PostSignedObjects/KEK, it should technically be possible to provide a version of Mosby that can apply the 2023 updates without requiring Setup Mode (since these are all signed ESLs).
However, to get complete coverage of Secure Boot certificates, and especially with some platforms missing some of the 2011 certs, we would also need KEK 2011 signed versions of Microsoft Corporation UEFI CA 2011 and Microsoft Windows Production PCA 2011 which (to my knowledge) Microsoft does not have public binaries for (this is of course assuming that MS KEK 2011 is installed on all the platforms we want to deal with, which I believe is a fair assertion to make). And with the KEK 2011 expiration ticking (2026.05.24) we have only one month left to ask Microsoft to create such signed cert packages!
And for good measure, it would also be nice to have an official MS PK cert sign by the PK, not for the purpose of running Mosby outside of Setup Mode, but for systems that want an actionable PK (which means a real OEM one) and that won't install a PK unless it is signed by itself.
With https://github.com/microsoft/secureboot_objects/tree/main/PostSignedObjects/Optional/DB providing the
Windows UEFI CA 2023,Microsoft UEFI CA 2023andMicrosoft Option ROM UEFI CA 2023, along with the OEM signed KEK updates from https://github.com/microsoft/secureboot_objects/tree/main/PostSignedObjects/KEK, it should technically be possible to provide a version of Mosby that can apply the 2023 updates without requiring Setup Mode (since these are all signed ESLs).However, to get complete coverage of Secure Boot certificates, and especially with some platforms missing some of the 2011 certs, we would also need KEK 2011 signed versions of
Microsoft Corporation UEFI CA 2011andMicrosoft Windows Production PCA 2011which (to my knowledge) Microsoft does not have public binaries for (this is of course assuming that MS KEK 2011 is installed on all the platforms we want to deal with, which I believe is a fair assertion to make). And with the KEK 2011 expiration ticking (2026.05.24) we have only one month left to ask Microsoft to create such signed cert packages!And for good measure, it would also be nice to have an official MS PK cert sign by the PK, not for the purpose of running Mosby outside of Setup Mode, but for systems that want an actionable PK (which means a real OEM one) and that won't install a PK unless it is signed by itself.