Capsules V2 release changes by SergiiDmytruk · Pull Request #875 · Dasharo/coreboot

SergiiDmytruk · 2026-04-16T22:29:56Z

These are RC1s for MSI boards, new CI checks of defconfigs and build system updates to support provisioning of capsule root keys.

ref: dsh-1176

Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: Iedbcfcbca5c048774ae66cd4cf4566500cd615e8 Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>

If CapsuleRootKey.inc exists and CONFIG_EDK2_CAPSULES_V2 is set, copy the file to EDK. This needs to be done as part of coreboot's build process because EDK's worktree doesn't exist right after cloning coreboot and there is no way to initialize it without building coreboot. This makes it impossible to provision EDK's key before the build without coreboot knowing about it at some level. Also reset DasharoPayloadPkg/CapsuleRootKey.inf in EDK if CONFIG_EDK2_CAPSULES_V2 is enabled, like it's already done for logos. Not adding the file to .gitignore so it's more visible to the user when present. Change-Id: I8b557c4ab239d61a5cef01928fda13b8417d54cb Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>

Change-Id: Ia9462cc4997dd04a17bc43d41fd3f8a08d318341 Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>

There was one outlier in this file. Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I3334d8eccaf64c57fc37580dce3d057938795427 Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>

philipanda · 2026-04-17T04:45:10Z

+    # check that `CONFIG_EDK2_CAPSULES_V2=y` is not added to
+    # `CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y` without
+    # `CONFIG_EDK2_CAPSULES_V2_TRANSITION=y`
+    if uses_v1_capsules "$old_config" &&


Is CONFIG_DRIVERS_EFI_UPDATE_CAPSULES supposed to be disabled on full, non-transition V2 releases?
The checks don't allow CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y && CONFIG_EDK2_CAPSULES_V2=y after the transition is finished.

Not sure which combination of options you think is problematic. CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y will always be there when capsules are enabled. uses_v1_capsules() returns non-zero for a config with V2 capsules, so this condition will not be entered.

philipanda · 2026-04-17T04:45:50Z

+    new_config=$(git show "$new_tag:$config")
+    old_config=$(git show "$old_tag:$config")
+
+    # check that `CONFIG_EDK2_CAPSULES_V2=y` is not added to


Could also check if the transition is not used without CONFIG_EDK2_CAPSULES_V2.

That can't happen because

coreboot/payloads/external/edk2/Kconfig.dasharo

Lines 442 to 445 in a155c21

config EDK2_CAPSULES_V2_TRANSITION

bool "Capsules Update: transitioning from v1 to v2"

default n

depends on EDK2_CAPSULES_V2

and this script probably shouldn't validate state of Kconfig files.

filipleple · 2026-04-17T09:56:05Z

+
+old_tag=$(get_previous_release "$new_tag")
+if [ -z "$old_tag" ]; then
+    echo "warning: no previous release for '$tag', skipping checks."


I don't know if $tag is defined in this context? I think it's only defined within get_previous_release() here

should probably be new_tag

Yes, I renamed variables for consistency at some point and introduced this mistake.

https://github.com/Dasharo/coreboot/compare/9e0383799a1501f667e63a7a8904de2d5ad3ac39..e72877ebc25579a978d268ab52b829349c211a0b#diff-a4082e2c4c2e597ca86a95505489d4954d3186de19ad83c83827a22fbad1cfe3R65

…ates Check that `CONFIG_EDK2_CAPSULES_V2=y` is not added to `CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y` without `CONFIG_EDK2_CAPSULES_V2_TRANSITION=y`. Check that `CONFIG_EDK2_CAPSULES_V2_TRANSITION=y` doesn't live longer than one release cycle. Check that `CONFIG_EDK2_CAPSULES_V2_TRANSITION=y` is not added to `CONFIG_EDK2_CAPSULES_V2=y`. Check that `CONFIG_EDK2_CAPSULES_V2_TRANSITION=y` is not removed. Change-Id: I24a1fd41864983fff3f9dfa717a0e4a7505fecac Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>

SergiiDmytruk

https://github.com/Dasharo/coreboot/compare/9e0383799a1501f667e63a7a8904de2d5ad3ac39..e72877ebc25579a978d268ab52b829349c211a0b adds:

check that CONFIG_EDK2_CAPSULES_V2_TRANSITION=y is not added to a V2 config
check that CONFIG_EDK2_CAPSULES_V2=y is not removed
usage
redirection or errors and warnings to stderr

SergiiDmytruk · 2026-04-22T16:52:21Z

+
+old_tag=$(get_previous_release "$new_tag")
+if [ -z "$old_tag" ]; then
+    echo "warning: no previous release for '$tag', skipping checks."


Yes, I renamed variables for consistency at some point and introduced this mistake.

https://github.com/Dasharo/coreboot/compare/9e0383799a1501f667e63a7a8904de2d5ad3ac39..e72877ebc25579a978d268ab52b829349c211a0b#diff-a4082e2c4c2e597ca86a95505489d4954d3186de19ad83c83827a22fbad1cfe3R65

SergiiDmytruk · 2026-04-22T16:54:27Z

+    new_config=$(git show "$new_tag:$config")
+    old_config=$(git show "$old_tag:$config")
+
+    # check that `CONFIG_EDK2_CAPSULES_V2=y` is not added to


That can't happen because

coreboot/payloads/external/edk2/Kconfig.dasharo

Lines 442 to 445 in a155c21

config EDK2_CAPSULES_V2_TRANSITION

bool "Capsules Update: transitioning from v1 to v2"

default n

depends on EDK2_CAPSULES_V2

and this script probably shouldn't validate state of Kconfig files.

SergiiDmytruk · 2026-04-22T17:11:38Z

+    # check that `CONFIG_EDK2_CAPSULES_V2=y` is not added to
+    # `CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y` without
+    # `CONFIG_EDK2_CAPSULES_V2_TRANSITION=y`
+    if uses_v1_capsules "$old_config" &&


Not sure which combination of options you think is problematic. CONFIG_DRIVERS_EFI_UPDATE_CAPSULES=y will always be there when capsules are enabled. uses_v1_capsules() returns non-zero for a config with V2 capsules, so this condition will not be entered.

They will reused by upcoming changes. Change-Id: Ie81e82f402e4c171f957a9b53b1e40dc559d19a4 Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>

Takes a capsule and signing keys, unpacks the capsule, then packs it back under a (likely) different name. Two functions were borrowed from a script in OSFV. Change-Id: I23157aaeedb4e1fdcfb10c5a0235acd571aa72b4 Upstream-Status: Inappropriate [Dasharo downstream] Co-authored-by: Filip Gołaś <filip.golas@3mdeb.com> Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>

SergiiDmytruk · 2026-04-25T22:18:38Z

Added ./capsule.sh resign which we'll need for MSI release.

SergiiDmytruk added 4 commits April 12, 2026 01:08

configs/config.msi_*: bump to v1.1.7-rc1 and v0.9.5-rc1

fd795d8

Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: Iedbcfcbca5c048774ae66cd4cf4566500cd615e8 Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>

capsule.sh: remove a debug print

67595c3

Change-Id: Ia9462cc4997dd04a17bc43d41fd3f8a08d318341 Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>

.github/workflows/checks.yml: consistently use actions/checkout@v4

9f40c7b

There was one outlier in this file. Upstream-Status: Inappropriate [Dasharo downstream] Change-Id: I3334d8eccaf64c57fc37580dce3d057938795427 Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>

SergiiDmytruk changed the title ~~Capsules v2 release changes~~ Capsules V2 release changes Apr 16, 2026

philipanda reviewed Apr 17, 2026

View reviewed changes

filipleple requested changes Apr 17, 2026

View reviewed changes

filipleple reviewed Apr 17, 2026

View reviewed changes

Comment thread .github/scripts/capsule-versioning-check.sh

philipanda reviewed Apr 17, 2026

View reviewed changes

Comment thread .github/workflows/tag-check.yml

SergiiDmytruk force-pushed the capsules-v2-release-changes branch from 9e03837 to e72877e Compare April 22, 2026 17:22

SergiiDmytruk commented Apr 22, 2026

View reviewed changes

SergiiDmytruk and others added 2 commits April 25, 2026 20:14

capsule.sh: extract 3 helpers

20fea37

They will reused by upcoming changes. Change-Id: Ie81e82f402e4c171f957a9b53b1e40dc559d19a4 Upstream-Status: Inappropriate [Dasharo downstream] Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>

	config EDK2_CAPSULES_V2_TRANSITION
	bool "Capsules Update: transitioning from v1 to v2"
	default n
	depends on EDK2_CAPSULES_V2

Uh oh!

Conversation

SergiiDmytruk commented Apr 16, 2026

Uh oh!

philipanda Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

SergiiDmytruk left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

SergiiDmytruk commented Apr 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

philipanda Apr 17, 2026 •

edited

Loading