Releases · pbatard/Mosby

Remove SSPU/SSPV provision (SkuSiPolicyUpdateSigners/SkuSiPolicyVersion) since setting SkuSiPolicyVersion effectively prevents regular Windows installation media from booting unless you boot it with Secure Boot disabled at least once and SkuSiPolicyUpdateSigners is not interchangeable between systems in the first place.
See KB5042562 on how you can apply Microsoft's UEFI lock on your own, by copying SkuSiPolicy.p7b to the ESP, after understanding that doing so may result in Windows boot media fail to boot on your system without providing any hint as to why it isn't booting, and why this might continue to be the case even after you remove the existing Windows instance.

Fix various issues that could lead to Security Violation errors when trying to update KEKs or PK.
Add an alert for TPM Measured Boot when BitLocker is in use.
Add an option (-r) to attempt to reinstall the manufacturer's default PK/KEK/DB certificates (while filtering out compromised PKs, such as the infamous DO NOT TRUST - AMI Test PK).
Add an option (-n) to create a NoPK.auth that can be used to reset the platform to Setup Mode (using KeyTool or other Secure Boot key management utilities).
Improve reporting, and add a big red notice in case of error.

Add a workaround for platforms (HP ProDesk, most likely other ones) that report Security Violation when installing any of the DBX, DB, KEK and PK. (#17)

Add a workaround for an AMI UEFI firmware bug that affects older ASUS, Dell, Lenovo, MSI and potentially other systems, where it is not possible to append to the KEK Secure Boot database. (#14)
Use the relevant EFI VendorGUIDs when adding certificates, instead of deriving one from the certificate fingerprint.
Improve processing of .esl, especially ones with multiple entries.
Improve log timestamps and Mosby version reporting.

Minor update to fix the IA32 and X64 DBX timestamps and the check for RW in Mosby.nsh.

Releases: pbatard/Mosby