SBAT component versions

[Jeff Hewett (jhewett)]

I recently started doing some testing with SBAT in the 15.4 shim and would like to confirm my understanding of how version entries work. I started with an SBAT entry for the GRUB version of 2.04, then 2.06, then 2.02. I was expecting the 2.02 version to fail with secure boot however it booted successfully. It appears from the shim code that the version is tracked via a UEFI variable to ensure a lower version won’t boot. Maybe I’ve misunderstood the intended behavior(??)

Thanks,
Jeff H.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.einval.com/pipermail/efi/attachments/20210525/6b2886fe/attachment.htm>