Re: [libvirt] [qemu RFC v2] qapi: add "firmware.json"

Hmmm, I'm not sure I agree. One use case is that you want a domain config in which well-known OS-es, signed by the MS UEFI certs, just boot with SB enabled. (Some of our internal folks really want this.) Another use case is that you want a domain in which SB *can* be enabled, but your installer is signed with a different certificate chain (or it is unsigned), and with *just* the MS certs enrolled, it wouldn't boot at all. So you want the SB *feature*, but definitely not the initial enrollment / SB *operational mode*.

For me to understand you better, are you suggesting merely that I: - rename @secure-boot-enrolled-keys to @enrolled-keys, and - drop the reference to @secure-boot from the end of the @enrolled-keys documentation paragraph? (Namely, "@secure-boot-enrolled-keys is only valid if the firmware also supports @secure-boot").