Clarification Re High Confidence Bucket CSV's

[algymc]

Hi,

Can anybody explain what exactly the contents of the CSV files represents? Is each entry an indvidual PC that has been sucessfully updated to the latest Secure Boot certification? And how was the data collected?

Any insight appreciated.

Thanks,

A

[garlin-cant-code]

This file provides the technical overview.
https://github.com/microsoft/secureboot_objects/blob/main/HighConfidenceBuckets/README.md

Please note at this time, MS has not released any confidence data that matches the individual buckets. Right now, browsing the CSV's just means you're staring at about 1.5 million unique sets of motherboard model/revision & firmware versions found on systems that have forwarded telemetry data.

What would be helpful is to detail what quantity each bucket needs to grow in size, and for what duration in days, before a confidence index is determined. I see many users online posting their TPM-WMI event messages and most of their buckets are ranked "Need more information".

[algymc]

Thanks for your reply.

I'd already read the README you linked but wasn't much wiser for it.

found on systems that have forwarded telemetry data

So the data is collected by, and made available from MS, correct?...

MS has not released any confidence data that matches the individual buckets

...but what does this mean?

would be helpful is to detail what quantity each bucket needs to grow in `size

Does this comment reflect my initial thinking (before I actually saw the CSV data) that a Bucket defines a group of devices (rather than single), all having identical (hardware) specifications? My limited work with the CSV data (I was trying to find matches to my own devices) found no duplicate Bucket IDs, so I tentatively concluded that each CSV line entry might be for a single device - your ref to "bucket...size" suggests otherwise?

[garlin-cant-code]

Correct, each bucket is a pool of devices with identical HW specifications. The assumption is if the update process works successfully for some devices in the bucket, it should work equally as well for all other devices in the bucket.

Most of the data is contributed by larger enterprises with varied fleets of identical PC's in service. But if you own a PC that is under represented by the device census, then it may not show up in the CSV data. Particularly, older PC's which largely retired from support, or individual models which are rare.

Having an explanation of the minimum thresholds to reach a point where your device appears in a bucket is useful. It might be your environment is supporting some legacy PC's, and you need to make contingency plans now instead of waiting an indeterminate amount of time before giving up hope that your machine eventually falls into a supported bucket.

[algymc]

Most of the data is contributed by larger enterprises with varied fleets of identical PC's in service

Of course - harvesting from that (obvious) source of data hadn't occurred to me.

if you own a PC that is under represented by the device census, then it may not show up in the CSV data

I went thru the entire CSV data, filtering against various matches against my own devices. The results were disappointing and none of my Bucket IDs were found within the entire data pool. I doubt that situation will change any time soon, unless MS release a far more extensive data set - the size of which would likely prevent a sensible way of doing that in the first place.

My goal at the outset was to understand the Confidence status of my devices (as visible in the SecureBoot registry key) so that I might monitor/anticipate any imminent MS updates to fully secured, CA2023 certified systems. But I guess now that that's unlikely to be possible, for my systems at any rate. And if the updates don't happen from MS, by some arbitary deadline (?), I'll have to take a punt/risk and decide when to try forcing them myself.

To date, I have deliberately held off the final stage of manual revocation of expired certifcates. In theory, all my systems are compatible for latest SB updates, but I may not know that for sure until achieving a successful, (forced?), update...

A

[hughsie]

none of my Bucket IDs were found within the entire data pool.

Out of morbid curiosity, what devices are those?

[kevindavisinsyde]

I would be interested to know which platforms don’t work.

[algymc]

Out of morbid curiosity, what devices are those?

Registry data, from newest to oldest devices:

Lenovo Thinkpad E14 Gen 3
"BucketHash"="061bf05d5fd4d8b38df7be435361f66b9cbbb3b09c3dffddd78b142d34b82ea7"
"ConfidenceLevel"="No Data Observed - Action Required"

Lenovo Thinkpad X1 Carbon 6th Gen
"BucketHash"="d6433ebd949554468a165671fc9fb8e70dc90e989bae75bf3c9b5767e26fbfae"
"ConfidenceLevel"="Under Observation - More Data Needed"

Micro-Star International MAG B460M BAZOOKA (MS-7C83)
No BucketHash or ConfidenceLevel data available, although I did find several instances of this hardware in the CSV data.

The E14's "NoData Observed" is a bit of a surprise, as this is a current device and still being supported by Lenovo, with very recent BIOS.

The X1's "Under Observation" is a bit baffling as I expected to find some instances of it in the CSV data, but didn't.

[cjee21]

My self-built PC that Windows has automatically deployed the 2023 certs successfully is still "No Data Observed - Action Required" as of today. The UEFI was updated after the auto deployment though.

Looks like only the older UEFI versions are in the dataset. The new UEFI version already has all the new certs anyway. Also noticed that shop-built versions using the same board but with customized OEM info (with shop name for example) are separate entries.

The E14's "NoData Observed" is a bit of a surprise, as this is a current device and still being supported by Lenovo, with very recent BIOS.

Maybe BIOS is too recent.

[algymc]

My self-built PC that Windows has automatically deployed the 2023 certs successfully is still "No Data Observed - Action Required" as of today.

Now that is very good news, especially with regard to my Micro-Star device, which is also self-built, and same status.

Looks like only the older UEFI versions are in the dataset.

Same for me with my self-build. In fact I don't really understand how these samples made it into the data set because the BIOS versions are too old to support latest SB certificates migration. Even with the last official BIOS, I still had to request support from MSI, who ended up giving a custom BIOS that did migrate to CA2023 certificate.

The UEFI was updated after the auto deployment though.

Can you please clarify what this step was/involved (manual/forced revocation)?

Thanks,

A

[cjee21]

I checked 2 PCs.

UEFI mentioned below will refer to UEFI firmware (BIOS).

The very old one with 2018 UEFI version is High Confidence as at now and has auto deployed 2023 certs successfully some time ago.

The newer one auto deployed 2023 certs successfully while it has 2025 UEFI version. I did not check the confidence level at that time. This year I updated the UEFI to a version from February 2026. Now it is No data observed. I guess regardless of what it was before, it changed to No data since the new UEFI is too new and it also does not need any updates as all 2023 certs are already included (even if not, most systems would likely have updated while on previous UEFI version).

[algymc]

Thanks for this interesting detail, although I'm not sure where that leaves my devices.

Perhaps the X1, with 2025 UEFI BIOS, and at Under Observation, might auto-enrole first...

Perhaps you're guess is correct that the E14 is on hold due to its too recent 2026 UEFI BIOS...

Perhaps I should desist from updating BIOS's for a while!!

But my preference remains that I'd rather the devices automatically update, so I guess a bit more waiting is required, and not rely on the Confidence Status too much.

[Flickdm]

Thanks for this interesting detail, although I'm not sure where that leaves my devices.

Perhaps the X1, with 2025 UEFI BIOS, and at Under Observation, might auto-enrole first...

Perhaps you're guess is correct that the E14 is on hold due to its too recent 2026 UEFI BIOS...

Perhaps I should desist from updating BIOS's for a while!!

But my preference remains that I'd rather the devices automatically update, so I guess a bit more waiting is required, and not rely on the Confidence Status too much.

Out of mild curiosity- does your device that shipped with firmware from 2025 not contain the new CA's and thus doesn't need targeting?

I can't speak for your device but many OEMs have been shipping with the new keys since 2023.

[algymc]

Out of mild curiosity- does your device that shipped with firmware from 2025 not contain the new CA's and thus doesn't need targeting?

None of my devices seemed to contain CA 2023 certificates when I first started looking at Secure Boot CA 2023.

The X1 installed CA2023 only after I manually forced it, with whatever BIOS it had at that point (I've upgraded BIOS at least twice since first owning it).

At the same time, the MS-7C83 would not install CA2023 at all, even though it had the latest, official BIOS dated Aug'24. MSI eventually sent me a custom/unreleased BIOS before I finally got the manual process to work.

When I later got the E14, its BIOS was pretty recent, but it did not have CA2023 present either. BIOS has been updated since, twice, and somewhere along the line I was able to force CA2023 on it as well, but I don't remember when.

Perhaps I should have waited and seen how things played out with each device, but I didn't understand Secure Boot Certs so well then and was trying to be pro-active...

[cjee21]

does your device that shipped with firmware from 2025 not contain the new CA's and thus doesn't need targeting?

algymc from the screenshot you showed me before, your E14 with firmware version 1.24 and 1.25 is only missing Option ROM UEFI CA 2023. But since you already forced the full 2023 updates, the current UEFI DB already has the complete set of 2023 certs.

PS it appears (based on screenshots posted by others) firmwares do not update the current DB when new certs are added to the default DB in a new firmware version. So Windows would still need to apply the 2023 certs unless the user resets Secure Boot variables to default via UEFI setup.