[Good News] Lenovo Thinkpad Yoga L13 AMD Gen 2 does not brick when removing vendor+ms keys.

[schichtnudelauflauf]

If somewhere in this niche is a list of devices that definitely brick or not brick. Feel free to add this.

Setup, Bootmenu and Diagnostics still work after removing everything but a fresh PK and KEK that never signed anything except pk->kek. DB completely empty.

Machine Type Model 21AES01900
Vendor Firmware R1QET34W (1.20). (Not latest, will try again on latest.)

Also MSI Gamerboards seem to not brick. But also smell a lot like bypassable secboot issues.

[afontenot]

Thanks for providing this info, I've been curious about this and have a similar system here.

Could you provide the output of sbctl status and sbctl list-enrolled-keys? I'm curious about what a correctly set up configuration without the vendor keys looks like.

[afontenot]

For the record I did end up trying this and am not seeing issues at present, although I did whitelist two individual keys from the TPM eventlog. Machine is a ThinkPad E14 Gen 4 AMD.

$ sbctl status
Installed:      ✓ sbctl is installed
Owner GUID:     [UUID]
Setup Mode:     ✓ Disabled
Secure Boot:    ✓ Enabled
Vendor Keys:    tpm-eventlog

$ sbctl list-enrolled-keys
PK:
  Platform Key
KEK:
  Key Exchange Key
DB:
  Database Key

Maybe successes / failures could be recorded in a wiki somewhere?

[IPlayZed]

If we track platforms I can provide at least 3 configurations where I validated that clearing vendor keys does not cause any problems.

Besides going into the firmware setting and clearing the vendor keys, have you done any specific thing?

[schichtnudelauflauf]

I deleted all keys, then created keys with a fresh sbctl config and enrolled them using it. I added the microsoft 3rd party ca and 3 boot services hashes from the tpm eventlog.
Then I tested each boot with one element removed.
First one removed was microsoft 3rd party ca.
After that shim wasnt booting anymore as intended.
Then I removed the hashes from tpm eventlog in decreasing numerical order. Inbetween each I rebooted and powercycled and checked if I can still access the bios config menu.
It still worked after all hashes were gone.

I have never signed any boot file with the generated key so nothing after firmware would execute without ms 3rd party because its faster to check with a denied shellx64.efi and the firmware menus than actually booting anything bigger.

The MSI boards aside was more in line of not giving a damn. The only thing that wouldn't work is an nvidia oprom from an addon gpu

[0x09AF]

I successfully enrolled my own keys (without Microsoft ones) on my Lenovo ThinkPad E14 Gen 4 (Intel). I did:

sbctl create-keys
sbctl enroll-keys -t
sbctl sign -s /boot/EFI/<all_present_bootloaders>

then enabled Secure Boot in UEFI settings, rebooted and all works
I have the same exact output as @afontenot in the comment above