feat: add UEFI SecureBoot enable/disable and key reset support - #457
Merged
Conversation
mcanevet
force-pushed
the
feat/secure-boot
branch
from
August 14, 2026 08:18
3a7bcdf to
66980e7
Compare
mcanevet
added a commit
to mcanevet/tinkerbell
that referenced
this pull request
Aug 14, 2026
Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges.
mcanevet
added a commit
to mcanevet/tinkerbell
that referenced
this pull request
Aug 14, 2026
Temporary replace directive so this branch builds against the SecureBoot support this depends on (bmc-toolbox/bmclib#457) before that PR merges. DO NOT MERGE this commit - drop it (go mod edit -dropreplace, then go mod tidy) once bmclib#457 lands and a tagged bmclib release picks it up.
2 tasks
mcanevet
added a commit
to mcanevet/tinkerbell
that referenced
this pull request
Aug 14, 2026
Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges.
mcanevet
added a commit
to mcanevet/tinkerbell
that referenced
this pull request
Aug 14, 2026
Temporary replace directive so this branch builds against the SecureBoot support this depends on (bmc-toolbox/bmclib#457) before that PR merges. DO NOT MERGE this commit - drop it (go mod edit -dropreplace, then go mod tidy) once bmclib#457 lands and a tagged bmclib release picks it up.
mcanevet
added a commit
to mcanevet/tinkerbell
that referenced
this pull request
Aug 14, 2026
Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>
mcanevet
added a commit
to mcanevet/tinkerbell
that referenced
this pull request
Aug 14, 2026
Temporary replace directive so this branch builds against the SecureBoot support this depends on (bmc-toolbox/bmclib#457) before that PR merges. DO NOT MERGE this commit - drop it (go mod edit -dropreplace, then go mod tidy) once bmclib#457 lands and a tagged bmclib release picks it up. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>
mcanevet
added a commit
to mcanevet/tinkerbell
that referenced
this pull request
Aug 14, 2026
Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>
mcanevet
added a commit
to mcanevet/tinkerbell
that referenced
this pull request
Aug 14, 2026
Temporary replace directive so this branch builds against the SecureBoot support this depends on (bmc-toolbox/bmclib#457) before that PR merges. DO NOT MERGE this commit - drop it (go mod edit -dropreplace, then go mod tidy) once bmclib#457 lands and a tagged bmclib release picks it up. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>
joelrebel
requested changes
Aug 14, 2026
joelrebel
approved these changes
Aug 18, 2026
bmclib has no way to enable/disable UEFI SecureBoot or reset its key databases, despite gofish (already a direct dependency) fully supporting both via the ComputerSystem's SecureBoot resource (SecureBootEnable + .Update(), and .ResetKeys()). Adds the standard three-layer bmclib capability, following the exact pattern of bmc/bios.go/bmc/boot_device.go: - internal/redfishwrapper: GetSecureBoot/SetSecureBoot/ResetSecureBootKeys wrapping gofish's schemas.SecureBoot. - bmc: SecureBootStateGetter/SecureBootSetter/SecureBootKeysResetter interfaces with the usual FromInterfaces dispatch. - Client.GetSecureBoot/SetSecureBoot/ResetSecureBootKeys passthroughs. Wired into every provider that embeds redfishwrapper.Client - redfish (generic), dell, supermicro, and lenovo - matching how every other redfishwrapper-backed capability (BIOS config, power state, NMI, ...) is exposed at each of those provider layers, even though the implementation is the same delegation in each case. Tests added at the redfishwrapper and bmc dispatch layers (Dell fixture), and at the lenovo provider layer (XCC fixture/mock server, already scaffolded for SecureBoot ahead of this). Description for changelog/release notes: Add SetSecureBoot/GetSecureBoot/ResetSecureBootKeys support for the redfish, dell, supermicro, and lenovo providers.
…ata ID GetSecureBoot/SetSecureBoot/ResetSecureBootKeys returned nil on an incompatible System odata ID, which the bmc dispatch loop treats as a successful result and stops trying other providers. Return ErrRedfishSystemOdataID instead, matching inventory.go's handling of the same check.
joelrebel
force-pushed
the
feat/secure-boot
branch
from
August 18, 2026 05:43
7ef2e64 to
51a7f0e
Compare
Contributor
Merge Queue Status
This pull request spent 13 seconds in the queue, including 2 seconds running CI. Required conditions to merge
|
mcanevet
added a commit
to mcanevet/tinkerbell
that referenced
this pull request
Aug 26, 2026
Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>
2 tasks
mcanevet
added a commit
to mcanevet/tinkerbell
that referenced
this pull request
Aug 27, 2026
Adds SecureBootAction (enable/disable) and SecureBootResetKeysAction (ResetAllKeysToDefault/DeleteAllKeys/DeletePK) to bmc.Action, wired into rufio's Task reconciler via bmclib's GetSecureBoot/SetSecureBoot/ ResetSecureBootKeys (bmc-toolbox/bmclib#457, not yet merged). Since bmc.Action is reused as Workflow.spec.bootOptions.custombootConfig's preparingActions/postActions element type, this also becomes usable there once bmclib#457 lands - e.g. resetting a Dell node to SetupMode right before the PXE boot attempt that provisioning depends on. Verified via the existing fake-provider-backed TestTaskReconcile harness (registrar dispatch through a real bmclib.Client, no live BMC needed) - new cases cover success/failure for both actions. go.mod/ go.sum intentionally left uncommitted: they carry a local replace directive pointing bmc-toolbox/bmclib/v2 at a local checkout of the unmerged bmclib#457 branch, needed to build this locally before that PR merges. Signed-off-by: Mickaël Canévet <mickael.canevet@proton.ch>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR implement/change/remove?
bmclib has no way to enable/disable UEFI SecureBoot or reset its key databases, despite gofish (already a direct dependency) fully supporting both via the ComputerSystem's SecureBoot resource (
SecureBootEnable+.Update(), and.ResetKeys()).Adds the standard three-layer bmclib capability, following the exact pattern of
bmc/bios.go/bmc/boot_device.go:internal/redfishwrapper:GetSecureBoot/SetSecureBoot/ResetSecureBootKeyswrapping gofish'sschemas.SecureBoot.bmc:SecureBootStateGetter/SecureBootSetter/SecureBootKeysResetterinterfaces with the usualFromInterfacesdispatch.Client.GetSecureBoot/SetSecureBoot/ResetSecureBootKeyspassthroughs.Wired into every provider that embeds
redfishwrapper.Client-redfish(generic),dell,supermicro, andlenovo- plus newFeature*constants (FeatureGetSecureBoot,FeatureSetSecureBoot,FeatureResetSecureBootKeys) on each. This matches how every other redfishwrapper-backed capability (BIOS config, power state, NMI, ...) is exposed at each provider layer, even though the implementation is the same delegation in every case.Checklist
The HW vendor this change applies to (if applicable)
Any BMC reached via the generic Redfish, Dell, Supermicro, or Lenovo XCC provider.
The HW model number, product name this change applies to (if applicable)
N/A - generic Redfish SecureBoot resource, not vendor-specific.
The BMC firmware and/or BIOS versions that this change applies to (if applicable)
Requires the standard Redfish
SecureBootresource underComputerSystem.What version of tooling - vendor specific or opensource does this change depend on (if applicable)
gofish (already a direct dependency,
github.com/stmcginnis/gofish/schemas).Description for changelog/release notes