Post Signed KEKs : duplicate files

[mbc-one]

In .../PostSignedObjects/KEK/Dell there are 4 files:
KEKUpdate_Dell_PK1.bin
KEKUpdate_Dell_PK2.bin
KEKUpdate_Dell_PK3.bin
KEKUpdate_Dell_PK4.bin
Files 3 and 4 are identical.

windows command:
fc/b KEKUpdate_Dell_PK3.bin KEKUpdate_Dell_PK4.bin
Comparing files KEKUpdate_Dell_PK3.bin and KEKUPDATE_DELL_PK4.BIN
FC: no differences encountered

Is this intentional? Mistake?

[garlin-cant-code]

In the kek_update_map.json file, there's no called references to KEKUpdate_Dell_PK3.bin:

        "KEKUpdate": "Dell/KEKUpdate_Dell_PK1.bin",
        "KEKUpdate": "Dell/KEKUpdate_Dell_PK2.bin",
        "KEKUpdate": "Dell/KEKUpdate_Dell_PK4.bin",

[Flickdm]

This is likely unintentional, but it is also not functionally significant.

The KEK update binaries were originally provided by the OEM as part of a release package, and it appears that the same payload may have been included twice. The mapping file only references KEKUpdate_Dell_PK4.bin, so KEKUpdate_Dell_PK3.bin is effectively unused. Since the two files are byte-for-byte identical, there should be no behavioral difference.

These binaries are published primarily for transparency and to enable Linux and other non-Windows environments to consume the updates.

If you'd like to remove the duplicate and update the repository, a PR would be greatly appreciated 🙂

[mbc-one]

Sorry for not being clearer at the outset.
My thought was that if Dell intended to provide MS 2023 KEK signed with 4 different platform keys, but mistakenly provided only 3, then people whose Dell computer has that "missing" platform key will not be able to install secure boot cert updates.

[Flickdm]

Ah, I see the concern now, and that's a reasonable question.

The fact that KEKUpdate_Dell_PK3.bin and KEKUpdate_Dell_PK4.bin are identical does not by itself indicate that a KEK update is missing coverage. It only tells us that the two published files contain the same payload.

I can ask internally whether this was simply a duplicated artifact (which is my suspicion) or whether a distinct update was originally intended. Since there is currently no evidence that a required KEK update is missing, I'll plan to close this issue for now. If additional information becomes available indicating that a distinct payload was omitted, we can reopen the issue.