content: # @file
  # Template Name: Secure Desktop – Microsoft Only
  # Description:
  #  [#!IMPORTANT] This template is not yet recommended for production systems. While this would be more secure than including the UEFI CA,
  #  currently, the Option ROM CA (e.g. Graphics cards) has not saturated the ecosystem enough to be recommended for production systems.
  #
  # Copyright (C) Microsoft Corporation
  # SPDX-License-Identifier: BSD-2-Clause-Patent
  #
  ##
  ################################
  # Default PK File Entry #
  ################################
  
  [PK]
  help = "Contains the Microsoft PK to enable signature database updates and binary execution."
  
  [[PK.files]]
  path = "PreSignedObjects/PK/Certificate/WindowsOEMDevicesPK.der"
  sha1 = 0x3D8660C0CB2D57B189C3D7995572A552F75E48B5
  signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
  description = "Platform Key (owner) who may authorize changes to the KEK Variable"
  
  ###################################
  # Default Kek File Entries #
  ###################################
  [KEK]
  help = "Contains the Microsoft KEKs to enable signature database updates and binary execution."
  
  [[KEK.files]]
  path = "PreSignedObjects/KEK/Certificates/microsoft corporation kek 2k ca 2023.der"
  url = "https://go.microsoft.com/fwlink/?linkid=2239775"
  sha1 = 0x459ab6fb5e284d272d5e3e6abc8ed663829d632b
  signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
  description = "2023+ Microsoft Authorizes Signature Database Updates"
  
  ##################################
  # Default Db File Entries #
  ##################################
  [DB]
  help = "Contains only Microsoft certificates to verify binaries before execution. More than Default3PDb."
  
  [[DB.files]]
  path = "PreSignedObjects/DB/Certificates/windows uefi ca 2023.der"
  url = "https://go.microsoft.com/fwlink/?linkid=2239776"
  sha1 = 0x45a0fa32604773c82433c3b7d59e7466b3ac0c67
  signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
  description = "2023+ signed Windows Boot Media (e.g. 2023 signed Windows)"
  
  [[DB.files]]
  path = "PreSignedObjects/DB/Certificates/microsoft option rom uefi ca 2023.der"
  url = "http://www.microsoft.com/pkiops/certs/microsoft%20option%20rom%20uefi%20ca%202023.crt"
  sha1 = 0x3FB39E2B8BD183BF9E4594E72183CA60AFCD4277
  signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
  description = "2023+ signed UEFI Third-Party Option ROMs (e.g. Graphics/Storage/Networking Drivers)"
  
  ############################
  # Default Dbx File Entries #
  ############################
  [DBX]
  help = "Contains a list of revoked certificates that will not execute on this system. Filtered per Architecture (ARM, Intel)."
  
  [[DBX.files]]
  #
  # New recommendation is to allow the OS to manage the dbx and not ship a DefaultDbx with the firmware.
  # A valid configuration is to ship an unset DBX variable.
  #
  path = "PreSignedObjects/DBX/dbx.empty"
  sha1 = 0xF8D326CCD9233747A29E2F67AFEB77C25787BD39
  signature_owner = "77fa9abd-0359-4d32-bd60-28f4e78f784b"
  description =  "Special file to create an empty signature database."