MOK key enrollment in shim doesn't work when using Ventoy

[miczyg1]

Dasharo version
Any

Dasharo variant
Any

Affected component(s) or functionality
UEFI Secure Boot, shim

Brief summary
When using Ventoy with Secure Boot enabled, the MOK key enrollment doesn't work, the platform hangs.

How reproducible
100%

How to reproduce

Steps to reproduce the behavior:

1. Download and install Ventoy into USB stick https://www.ventoy.net/en/doc_start.html with Secure Boot enabled (selected in the Options panel)
2. Plug the stick to the MSI machine and boot it.
3. Wait for `Verification failed: (0x1A) Security Violation) screen and press enter (OK).
4. Choose enroll key

Expected behavior
After selecting Enroll key from disk next windows should pop up with possible disks to search for the keys.

Actual behavior
The platform hangs when choosing to enroll key from disk.

Screenshots
none

Additional context
none

Solutions you've tried
none

[miczyg1]

Found bugs in Shim's/MOKManagers's filesystem browser, which resulted in hangs of the shim when trying to enroll from a disk.

Fix: rhboot/shim#622

[desowin]

I have observed exactly the same issue on PRO Z790-P WIFI (MS-7E06) running Dasharo (coreboot+UEFI) v0.9.1 with WD Red SN700 2000GB is installed in M2_2 slot. Disk is GPT partitioned and first partition is 1GiB large EFI System partition.

In my case the steps to reproduce were:

1. Put shimx64.efi (from e.g. https://aur.archlinux.org/packages/shim-signed) alongside MOK-signed (or even unsigned) grubx64.efi
2. Enable Secure Boot
3. Boot shimx64.efi
4. "Perform MOK management" blue screen pops up with options "Continue boot", "Enroll key from disk", "Enroll hash from disk"
5. Select "Enroll key from disk" (or "Enroll hash from disk")
6. Menu freezes, only physical reset helps

Working workaround is to enroll the key in userspace, so there is no need to browse disks in shim MOK manager:

1. Disable Secure Boot
2. boot Linux
3. Enroll MOK key with userspace mokutil (choose some arbitrary password for later use)
4. Reboot
5. Enable Secure Boot
6. Actually enroll the key from step 3 by entering the password provided in step 3

[wessel-novacustom]

Found bugs in Shim's/MOKManagers's filesystem browser, which resulted in hangs of the shim when trying to enroll from a disk.

Fix: rhboot/shim#622

@miczyg1 It looks like you have implemented a fix. If so, and if the issue no longer occurs, please consider to close the issue.

[miczyg1]

Unless the PR with a fix is merged, the issue is relevant.

[m-iwanicki]

@miczyg1 PR was merged. Issue can probably be closed?