[24.10 FEAT] [VS2009] KVM: Secure IPL Simulation - libvirt part

[bugproxy]

This item will allow to verify the secure IPL process without the need to have a specific hardware or firmware level. QEMU must be modified to allow to specify one or more certificates used for kernel signing. Further, QEMU must allow to request signature checking during IPL. The QEMU BIOS must be extended to do the certificate checking, which requires a way to pass the certificates to the BIOS. And finally, libvirt must be extended in support of the QEMU changes.

[Frank Heimes (fheimes)]

Thx for the heads-up. Very interesting feature!
Do you already know the upstream libvirt version that will have this functionality included?

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2024-02-06 07:05 EDT-------
This feature requires further coding which will not complete in time for Noble FF.
Therefore, we need to postpone this for now to the next release.
Due to the importance of this item, we will need to have this SRUed to the Noble LTS release once it will have landed in 24.10.

==> Changing milestone to "24.10"

[Frank Heimes (fheimes)]

Thanks for the heads-up!
I'll move it for now to 24.10.
I /believe/ once the development of the 'O'-release is open, we can include it into this, so that it will become SRU-able to 'N' - according to SRU policy 'Other safe cases':

"For Long Term Support releases we sometimes want to introduce new features. They must not change the behaviour on existing installations[...]. If existing software needs to be modified to make use of the new feature, it must be demonstrated that these changes are unintrusive, have a minimal regression potential, and have been tested properly. To avoid regressions on upgrade, any such feature must then also be added to any newer supported Ubuntu release. Once a new feature/package has been introduced, subsequent changes to it are subject to the usual requirements of SRUs to avoid regressions."