tis-verif-secureboot-uefi-ca-2023

package           : tis-verif-secureboot-uefi-ca-2023
version           : 11-1
architecture      : all
section           : base
priority          : optional
name              : tis-verif-secureboot-uefi-ca-2023
categories        : 
maintainer        : Simon Fonteneau, Kevin Cherel
description       : Ce script permet de contrôler que le démarrage sécurisé est activé et que le certificat Windows UEFI CA 2023 est bien présent dans la base UEFI.
depends           : 
conflicts         : 
maturity          : PROD
locale            : 
target_os         : windows
min_wapt_version  : 
sources           : 
installed_size    : 
impacted_process  : 
description_fr    : 
description_pl    : Ten skrypt sprawdza, czy funkcja Secure Boot jest włączona oraz czy certyfikat Windows UEFI CA 2023 jest obecny w bazie UEFI.
description_de    : Dieses Skript überprüft, ob Secure Boot aktiviert ist und ob das Zertifikat Windows UEFI CA 2023 in der UEFI-Datenbank vorhanden ist.
description_es    : Este script verifica que Secure Boot esté habilitado y que el certificado Windows UEFI CA 2023 esté presente en la base de datos UEFI.
description_pt    : Este script verifica se o Secure Boot está ativado e se o certificado Windows UEFI CA 2023 está presente na base de dados UEFI.
description_it    : Questo script verifica che Secure Boot sia abilitato e che il certificato Windows UEFI CA 2023 sia presente nel database UEFI.
description_nl    : Dit script controleert of Secure Boot is ingeschakeld en of het certificaat Windows UEFI CA 2023 aanwezig is in de UEFI-database.
description_ru    : Этот скрипт проверяет, включена ли функция Secure Boot и присутствует ли сертификат Windows UEFI CA 2023 в базе данных UEFI.
audit_schedule    : 
editor            : 
keywords          : 
licence           : ©
homepage          : 
package_uuid      : 6d6a2cb0-57c3-403e-b316-462cf46d2908
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
min_os_version    : 
max_os_version    : 
icon_sha256sum    : 03c0491e556f63f98f6ca32ec6beb1894fac54fb804d53e6086e4a26c0ac7491
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature_date    : 2026-02-27T10:04:40.000000
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,min_os_version,max_os_version,icon_sha256sum,signer,signer_fingerprint,signature_date,signed_attributes
signature         : exnDWcfCF3Orl69AepG/aswboTBx0xEeElnILI6OA7ao8g33XDJyHCxMqztPaRi6Cx/FDsU1QyavWdBPv83qS4z96TaSHj+nnXlCjCzGJNFhKKXd0v5hErflefDh0wLs+8hAMV3xD+AsfQNQF4l+vJzYRibaziqgKYAsWNlG4ZqacE15h5fGdQM9o+g6qcl/+JIFgo8q0VAk5HFpwn2JaJx3MUKBMbrj/md6Y+/Uq9rb2MwryY0MpQTz06Utl1Uug9944PuhVvq7KWhhI3HEge/GXjOQ0upcSmeWvjtvmvVHDieExpkTnyeg7sY2iTckPu2zdNm4+ww5lZQM23lOWA==

# -*- coding: utf-8 -*-
from setuphelpers import *

def install():
    registry_set(HKEY_LOCAL_MACHINE,r'SYSTEM\CurrentControlSet\Control\SecureBoot','AvailableUpdates',64)
    #registry_set(HKEY_LOCAL_MACHINE,r'SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing','WindowsUEFICA2023Capable', 1, type=REG_DWORD)
    run_task(r'\Microsoft\Windows\PI\Secure-Boot-Update')

def audit():

    result={}
    result['SecureBootUEFI'] = run_powershell('Confirm-SecureBootUEFI')
    list_key = ["UEFICA2023Status","WindowsUEFICA2023Capable","UEFICA2023Error","ConfidenceLevel","AvailableUpdates"]

    for u in list_key :
        result[u] =  registry_readstring(HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing", u)

    WAPT.write_audit_data_if_changed("verif-secureboot-uefi-ca-2023", "verif-secureboot-uefi-ca-2023", result)

    if registry_readstring(HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing", "WindowsUEFICA2023Capable") == '2':
        print("The certificate is present and the PC is already booting with the new 2023-signed boot manager.")
        return "OK"

    elif registry_readstring(HKEY_LOCAL_MACHINE, r"SYSTEM\CurrentControlSet\Control\SecureBoot\Servicing", "WindowsUEFICA2023Capable") == '1':
        print("The certificate is present in the Secure Boot database.")
        return "WARNING"

    else:
        print("The registry key is missing or incorrect.")
        return "ERROR"

38d056ab130f7bf7c481c12636a4e9959de36561d3dfcbe54c6e3571bc0c1dc3 : WAPT/certificate.crt
dee287dddbae70add8310beac6fed42c7c34a23046ee79c6532200b5b63bab07 : WAPT/control
03c0491e556f63f98f6ca32ec6beb1894fac54fb804d53e6086e4a26c0ac7491 : WAPT/icon.png
60d50e56a938d6f0ec106a6edd5ceb8d5fe5ee7283936d3942d537efa47dcad7 : luti.json
8278c17f5eefa5c04c86dfcbd0203395d5f4c6cf7297d6a12903dcd9da6f55ba : setup.py