Chris Fenner @chrisfenner.bsky.social · 24/01/2026Here is the biggest problem I can see. PCR7 contains DB (authority keys and hashes) already but it gets extended again with each key the first time it gets used. 110
Chris Fenner @chrisfenner.bsky.social · 04/01/2026I wrote about a feature I got disabled-by-default in Linux last year dlp.rip/decorative-c... 151
![5. Before launching an EFI Driver or an EFI Boot Application (and regardless of whether the launch is due to the EFI Boot Manager picking an image from the DriverOrder or BootOrder UEFI variables or an already launched image calling the UEFI Loadlmage() function), the UEFI firmware SHALL determine if the entry in the EFI_IMAGE_SECURITY_DATABASE_GUID/EF|_ IMAGE_SECURITY_DATABASE variable that was used to validate the EFI image has previously been measured with the EV_EF_VARIABLE_AUTHORITY event type in PCR[7]. If it has not been, it MUST be measured into PCR[7] as follows. If it has been measured previously, it MUST NOT be measured again. The measurement SHALL occur in conjunction with image load.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:jk43wuenubqwx5gonueklyrn/bafkreigjhy43dr73gezdh6nfyx7xuxlhfc7zlhjkoobphmqrcpj23q64ce)
