feat: add UEFI SecureBoot enable/disable and key reset support by mcanevet · Pull Request #457 · bmc-toolbox/bmclib

mcanevet · 2026-08-06T12:34:35Z

What does this PR implement/change/remove?

bmclib has no way to enable/disable UEFI SecureBoot or reset its key databases, despite gofish (already a direct dependency) fully supporting both via the ComputerSystem's SecureBoot resource (SecureBootEnable + .Update(), and .ResetKeys()).

Adds the standard three-layer bmclib capability, following the exact pattern of bmc/bios.go/bmc/boot_device.go:

internal/redfishwrapper: GetSecureBoot/SetSecureBoot/ResetSecureBootKeys wrapping gofish's schemas.SecureBoot.
bmc: SecureBootStateGetter/SecureBootSetter/SecureBootKeysResetter interfaces with the usual FromInterfaces dispatch.
Client.GetSecureBoot/SetSecureBoot/ResetSecureBootKeys passthroughs.

Wired into every provider that embeds redfishwrapper.Client - redfish (generic), dell, supermicro, and lenovo - plus new Feature* constants (FeatureGetSecureBoot, FeatureSetSecureBoot, FeatureResetSecureBootKeys) on each. This matches how every other redfishwrapper-backed capability (BIOS config, power state, NMI, ...) is exposed at each provider layer, even though the implementation is the same delegation in every case.

Checklist

Tests added
Similar commits squashed

The HW vendor this change applies to (if applicable)

Any BMC reached via the generic Redfish, Dell, Supermicro, or Lenovo XCC provider.

The HW model number, product name this change applies to (if applicable)

N/A - generic Redfish SecureBoot resource, not vendor-specific.

The BMC firmware and/or BIOS versions that this change applies to (if applicable)

Requires the standard Redfish SecureBoot resource under ComputerSystem.

What version of tooling - vendor specific or opensource does this change depend on (if applicable)

gofish (already a direct dependency, github.com/stmcginnis/gofish/schemas).

Description for changelog/release notes

Add SetSecureBoot/GetSecureBoot/ResetSecureBootKeys support for the redfish, dell, supermicro, and lenovo providers.

Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges.

Temporary replace directive so this branch builds against the SecureBoot support this depends on (bmc-toolbox/bmclib#457) before that PR merges. DO NOT MERGE this commit - drop it (go mod edit -dropreplace, then go mod tidy) once bmclib#457 lands and a tagged bmclib release picks it up.

Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges.

Temporary replace directive so this branch builds against the SecureBoot support this depends on (bmc-toolbox/bmclib#457) before that PR merges. DO NOT MERGE this commit - drop it (go mod edit -dropreplace, then go mod tidy) once bmclib#457 lands and a tagged bmclib release picks it up.

Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>

Temporary replace directive so this branch builds against the SecureBoot support this depends on (bmc-toolbox/bmclib#457) before that PR merges. DO NOT MERGE this commit - drop it (go mod edit -dropreplace, then go mod tidy) once bmclib#457 lands and a tagged bmclib release picks it up. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>

Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>

Temporary replace directive so this branch builds against the SecureBoot support this depends on (bmc-toolbox/bmclib#457) before that PR merges. DO NOT MERGE this commit - drop it (go mod edit -dropreplace, then go mod tidy) once bmclib#457 lands and a tagged bmclib release picks it up. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>

bmclib has no way to enable/disable UEFI SecureBoot or reset its key databases, despite gofish (already a direct dependency) fully supporting both via the ComputerSystem's SecureBoot resource (SecureBootEnable + .Update(), and .ResetKeys()). Adds the standard three-layer bmclib capability, following the exact pattern of bmc/bios.go/bmc/boot_device.go: - internal/redfishwrapper: GetSecureBoot/SetSecureBoot/ResetSecureBootKeys wrapping gofish's schemas.SecureBoot. - bmc: SecureBootStateGetter/SecureBootSetter/SecureBootKeysResetter interfaces with the usual FromInterfaces dispatch. - Client.GetSecureBoot/SetSecureBoot/ResetSecureBootKeys passthroughs. Wired into every provider that embeds redfishwrapper.Client - redfish (generic), dell, supermicro, and lenovo - matching how every other redfishwrapper-backed capability (BIOS config, power state, NMI, ...) is exposed at each of those provider layers, even though the implementation is the same delegation in each case. Tests added at the redfishwrapper and bmc dispatch layers (Dell fixture), and at the lenovo provider layer (XCC fixture/mock server, already scaffolded for SecureBoot ahead of this). Description for changelog/release notes: Add SetSecureBoot/GetSecureBoot/ResetSecureBootKeys support for the redfish, dell, supermicro, and lenovo providers.

…ata ID GetSecureBoot/SetSecureBoot/ResetSecureBootKeys returned nil on an incompatible System odata ID, which the bmc dispatch loop treats as a successful result and stops trying other providers. Return ErrRedfishSystemOdataID instead, matching inventory.go's handling of the same check.

mergify · 2026-08-18T05:46:51Z

Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>

Replace string parameters in SecureBoot functions with typed constants to: - Make valid values explicit and discoverable - Reduce validation burden on callers - Match bmclib's pattern (BootDeviceType, etc.) Also add nil checks after SecureBoot() calls - gofish returns nil,nil when the resource link is empty, which previously caused silent success. Implements reviewer feedback from PR bmc-toolbox#457.

Extends the SecureBoot support added in bmc-toolbox#457 with per-database operations, newly possible now that gofish's SecureBootDatabase gained AddCertificate/ AddSignature (stmcginnis/gofish#561). Unlike the whole-subsystem ResetSecureBootKeys, these target a single database (e.g. "db", "KEK") without touching PK - the mechanism a caller needs to enroll a custom certificate into db/KEK while leaving an already-provisioned PK (and whatever Setup Mode state it implies) alone. Adds the same three-layer bmclib capability as bmc-toolbox#457, wired into the same four providers: - internal/redfishwrapper: ResetSecureBootDatabaseKeys/ImportSecureBootCertificate, finding the target database by DatabaseID in the SecureBootDatabases collection. - bmc: SecureBootDatabaseKeysResetter/SecureBootCertificateImporter interfaces with the usual FromInterfaces dispatch. - Client.ResetSecureBootDatabaseKeys/ImportSecureBootCertificate passthroughs. Wired into redfish (generic), dell, supermicro, and lenovo - matching how GetSecureBoot/SetSecureBoot/ResetSecureBootKeys are exposed at each of those provider layers already. Bumps gofish to a pseudo-version pinned to the AddCertificate/AddSignature commit, ahead of the next tagged release. Tests added at the bmc dispatch layer and the redfishwrapper layer (new Dell SecureBootDatabases/db fixtures, named to match virtualmedia_collection.json's <resource>_collection.json convention), including a not-found case when the requested database isn't present in the collection.

Replace string parameters in SecureBoot functions with typed constants to: - Make valid values explicit and discoverable - Reduce validation burden on callers - Match bmclib's pattern (BootDeviceType, etc.) Also add nil checks after SecureBoot() calls - gofish returns nil,nil when the resource link is empty, which previously caused silent success. Implements reviewer feedback from PR bmc-toolbox#457.

Replace string parameters in SecureBoot functions with typed constants to: - Make valid values explicit and discoverable - Reduce validation burden on callers - Match bmclib's pattern (BootDeviceType, etc.) Also add nil checks after SecureBoot() calls - gofish returns nil,nil when the resource link is empty, which previously caused silent success. Implements reviewer feedback from PR bmc-toolbox#457. example: add Secure Boot usage examples Add comprehensive example showing how to use the Secure Boot functionality: - Get current Secure Boot state - Enable/disable Secure Boot - Reset all Secure Boot keys - Reset a specific database's keys (db, KEK, PK, dbx) - Import certificates into a database Demonstrates usage of the typed constants for reset types and databases.

Replace string parameters in SecureBoot functions with typed constants to: - Make valid values explicit and discoverable - Reduce validation burden on callers - Match bmclib's pattern (BootDeviceType, etc.) Also add nil checks after SecureBoot() calls - gofish returns nil,nil when the resource link is empty, which previously caused silent success. Update all mock implementations to use the new typed signatures. Implements reviewer feedback from PR bmc-toolbox#457.

Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>

Extends the whole-subsystem SecureBoot support from bmc-toolbox#457 with per-database operations, newly possible now that gofish's SecureBootDatabase gained AddCertificate/AddSignature (stmcginnis/gofish#561). Unlike ResetSecureBootKeys (which resets PK/KEK/db/dbx together), these target a single database (e.g. "db", "KEK") without touching PK - the mechanism a caller needs to enroll a custom certificate into db/KEK while leaving an already-provisioned PK (and whatever Setup Mode state it implies) alone. - internal/redfishwrapper: ResetSecureBootDatabaseKeys/ ImportSecureBootCertificate, finding the target database by DatabaseID in the SecureBootDatabases collection. - bmc: SecureBootDatabaseKeysResetter/SecureBootCertificateImporter interfaces with the usual FromInterfaces dispatch, plus ResetSecureBootDatabaseKeysType/SecureBootDatabase typed constants (matching bmclib's existing BootDeviceType pattern, replacing raw strings so valid values are explicit and discoverable). - client.go: passthroughs for both operations. - providers/providers.go: FeatureResetSecureBootDatabaseKeys/ FeatureImportSecureBootCertificate registry entries, needed by the provider-layer commits that follow. Also adds a nil check after SecureBoot() calls in the existing ResetSecureBootKeys/SetSecureBoot/GetSecureBoot path - gofish returns nil,nil when the resource link is empty, which previously caused silent success. This intentionally leaves every provider on the old string-typed ResetSecureBootKeys signature and without the new per-database methods; each provider is wired up (and migrated to the typed signature) in its own following commit, per review feedback on bmc-toolbox#460 to keep provider changes independently revertable from this core layer. Bumps gofish to a pseudo-version pinned to the AddCertificate/ AddSignature commit, ahead of the next tagged release. Tests added at the bmc dispatch layer and the redfishwrapper layer (new Dell SecureBootDatabases/db fixtures, named to match virtualmedia_collection.json's <resource>_collection.json convention), including a not-found case when the requested database isn't present in the collection.

Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>

Adds SecureBootAction (enable/disable), SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK), SecureBootDatabaseResetKeysAction (reset a single key database, e.g. "db" or "KEK", without touching PK), and SecureBootCertificateImportAction (import a certificate into a single key database, referencing the PEM via a ConfigMap key rather than inlining it - a certificate isn't secret, but is typically too large and too reused across Workflows to put directly into an Action) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ResetSecureBootKeys/ ResetSecureBootDatabaseKeys/ImportSecureBootCertificate. Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there directly - e.g. resetting a node to Setup Mode right before the PXE boot attempt that provisioning depends on, then re-enabling SecureBoot once the OS install is done. That's the motivating use case: enrolling a SecureBoot trust anchor at provisioning time, while the machine is still under Tinkerbell's control, rather than relying on boot-time enrollment which happens after the Workflow has already finished. This depended on bmc-toolbox/bmclib#457 and tinkerbell#460, which add the underlying support to bmclib itself. Both have since merged upstream, so go.mod/go.sum now pin github.com/bmc-toolbox/bmclib/v2 to a pseudo-version of the merged commit rather than a temporary fork replace - the same pattern already used elsewhere in this project's go.mod (e.g. jaypipes/ghw, grpc-ecosystem/go-grpc-prometheus, protobuf). This pin can be swapped for a tagged bmclib release once one is cut. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>

Moves off the pseudo-version pinned when this PR was opened (before bmc-toolbox/bmclib#457/tinkerbell#460 merged) to bmc-toolbox/bmclib's current HEAD, so this PR's bmclib requirement matches the other open rufio BMC-action PRs exactly and doesn't produce a go.mod/go.sum diff when they're combined. Signed-off-by: Mickael Canevet <mickael.canevet@proton.ch>

Adds SecureBootAction (enable/disable), SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK), SecureBootDatabaseResetKeysAction (reset a single key database, e.g. "db" or "KEK", without touching PK), and SecureBootCertificateImportAction (import a certificate into a single key database, referencing the PEM via a ConfigMap key rather than inlining it - a certificate isn't secret, but is typically too large and too reused across Workflows to put directly into an Action) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ResetSecureBootKeys/ ResetSecureBootDatabaseKeys/ImportSecureBootCertificate. Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there directly - e.g. resetting a node to Setup Mode right before the PXE boot attempt that provisioning depends on, then re-enabling SecureBoot once the OS install is done. That's the motivating use case: enrolling a SecureBoot trust anchor at provisioning time, while the machine is still under Tinkerbell's control, rather than relying on boot-time enrollment which happens after the Workflow has already finished. This depended on bmc-toolbox/bmclib#457 and tinkerbell#460, which add the underlying support to bmclib itself. Both have since merged upstream, so go.mod/go.sum now pin github.com/bmc-toolbox/bmclib/v2 to a pseudo-version of the merged commit rather than a temporary fork replace - the same pattern already used elsewhere in this project's go.mod (e.g. jaypipes/ghw, grpc-ecosystem/go-grpc-prometheus, protobuf). This pin can be swapped for a tagged bmclib release once one is cut. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>

mcanevet force-pushed the feat/secure-boot branch from 3a7bcdf to 66980e7 Compare August 14, 2026 08:18

mcanevet mentioned this pull request Aug 14, 2026

feat(rufio): add a secureBoot BMC action tinkerbell/tinkerbell#930

Open

joelrebel requested changes Aug 14, 2026

View reviewed changes

Comment thread internal/redfishwrapper/secure_boot.go Outdated

Comment thread internal/redfishwrapper/secure_boot.go Outdated

Comment thread internal/redfishwrapper/secure_boot.go Outdated

mcanevet requested a review from joelrebel August 14, 2026 15:46

joelrebel approved these changes Aug 18, 2026

View reviewed changes

mcanevet added 2 commits August 18, 2026 07:43

joelrebel force-pushed the feat/secure-boot branch from 7ef2e64 to 51a7f0e Compare August 18, 2026 05:43

joelrebel added the ready-to-merge label Aug 18, 2026

mergify Bot added the queued label Aug 18, 2026

mergify Bot merged commit 89df130 into bmc-toolbox:main Aug 18, 2026
4 of 5 checks passed

mergify Bot removed the queued label Aug 18, 2026

mcanevet mentioned this pull request Aug 26, 2026

feat: add per-database UEFI Secure Boot key reset and certificate import #460

Merged

2 tasks done

This was referenced Oct 6, 2026

Feature/lenovo core interfaces (PR2) #442

Open

feat: add GetPowerMetrics/SetPowerCap support #474

Merged

Navigation Menu

Repository navigation

feat: add UEFI SecureBoot enable/disable and key reset support - #457

feat: add UEFI SecureBoot enable/disable and key reset support#457
mergify[bot] merged 2 commits into
bmc-toolbox:mainfrom
mcanevet:feat/secure-boot

mcanevet commented Aug 6, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mergify Bot commented Aug 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

mcanevet commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR implement/change/remove?

Checklist

The HW vendor this change applies to (if applicable)

The HW model number, product name this change applies to (if applicable)

The BMC firmware and/or BIOS versions that this change applies to (if applicable)

What version of tooling - vendor specific or opensource does this change depend on (if applicable)

Description for changelog/release notes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mergify Bot commented Aug 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge Queue Status

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mcanevet commented Aug 6, 2026 •

edited

Loading

mergify Bot commented Aug 18, 2026 •

edited

Loading