Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Do not attempt to modify SecureBootTemplate on a VM with a vTPM initialized #137

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

bdonaldson77
Copy link

When running the hyperv-vmcx builder, the plugin will always attempt to set the -SecureBootTemplate parameter if it is detected as available. However, when the source .vmcx template has a vTPM initialized (e.g. if it is a Windows 11 HyperV VM) then this operation will always fail:

2024-11-18T15:02:25-08:00: Build 'hyperv-vmcx' errored after 41 seconds 321 milliseconds: Error setting secure boot: PowerShell error: Hyper-V\Set-VMFirmware : 'win11_24H2-master-bdonaldson-TEST' failed to modify settings.
Cannot modify the secure boot template ID property.
'win11_24H2-master-bdonaldson-TEST' failed to modify settings. (Virtual machine ID
4DCCACA2-2DB5-465D-86E4-680373C80102)
Cannot modify the secure boot template ID property after the virtual TPM is initialized.
At C:\Users\bdonaldson\AppData\Local\Temp\2\Powershell1356268187.ps1:6 char:2
+     Hyper-V\Set-VMFirmware -VMName $vmName -EnableSecureBoot $enableS ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Set-VMFirmware], VirtualizationException
    + FullyQualifiedErrorId : OperationFailed,Microsoft.HyperV.PowerShell.Commands.SetVMFirmware

This change makes it so that Packer will only attempt to reconfigure the SecureBootTemplate if there is no initialized vTPM. If there is a vTPM, it will simply skip attempting to set the SecureBootTemplate, but continue to configure SecureBoot as desired.

Closes #49

@bdonaldson77 bdonaldson77 requested a review from a team as a code owner November 18, 2024 23:18
Copy link

CLA assistant check

Thank you for your submission! We require that all contributors sign our Contributor License Agreement ("CLA") before we can accept the contribution. Read and sign the agreement

Learn more about why HashiCorp requires a CLA and what the CLA includes


Donaldson, Ben seems not to be a GitHub user.
You need a GitHub account to be able to sign the CLA.
If you have already a GitHub account, please add the email address used for this commit to your account.

Have you signed the CLA already but the status is still pending? Recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Hyper-V\Set-VMFirmware fails for hyperv-vmcx
1 participant