[Bug]: PostSignedObjects/SignedByKEK2023/dbx_x64.efiauth2 is incomplete

[kraxel]

Is there an existing issue for this?

• I have searched existing issues

Current Behavior

It contains 291 hashes.

Expected Behavior

The previous version had 443 hashes, and with two hashes added I'd expect the number of hashes go up to 445, not down to 291.

Steps To Reproduce

• pip install virt-firmware
• download https://gitlab.com/kraxel/virt-firmware/-/blob/master/experimental/inspect-sbvar-update.py
• python inspect-sbvar-update.py -u PostSignedObjects/SignedByKEK2023/dbx_x64.efiauth2

Build Environment

- OS(s):
- Tool Chain(s):
- Targets Impacted:

Version Information

Tag: v1.7.0-signed

Urgency

High

Are you going to fix this?

Someone else needs to fix it

Do you need maintainer feedback?

No maintainer feedback needed

Anything else?

No response

[garlin-cant-code]

154 EFI hashes were "retired" back in April 2026.
151 of them are Windows boot manager entries, which are superseded if you banned PCA 2011. The other 3 are owned by Ubuntu.

Please see #396

[kraxel]

154 EFI hashes were "retired" back in April 2026. 151 of them are Windows boot manager entries, which are superseded if you banned PCA 2011. The other 3 are owned by Ubuntu.

But that works only if you actually ban PCA2011.

The PreSignedObjects/DBX/dbx_info_msft_latest.json file tracks which revoked binary was signed with which certificate.
I think it would be useful to have one signed dbx update for each certificate, so you can pick which ones are needed depending on the 'db' certificates enrolled.

[garlin-cant-code]

The SecureBootUpdates folder in Windows has shipped with the smaller update file since April 2026. No one from MS has responded to my previous two bugs on this subject, asking for clarity about the changes.

It's obvious to me what they've done, but as the repo owner they have a responsibility to clearly state in README's why the changes were made, where to find older versions of the file, and why it may or may not impact your use of the file.

I think a "DBX update without the Windows Boot Managers superseded by banning PCA 2011" and "DBX update with no removals" as side-by-side versions would make a lot of sense.