Add LVBS prod unsigned security profile

[Praveen K Paladugu (praveen-pk)]

Description

Unsinged LVBS images need a security profile that has:

• Trusted Launch enabled
• Secure Boot Disabled
• TPM Enabled

This introduces this Security Profile.

Type of Change

• Bug fix
• [X ] New feature
• Breaking change
• Refactoring
• Documentation update

Checklist

• [ X] Description is filled in above
• [X ] No credentials, secrets, or internal details are included
• Peer review requested (if not, add required peer reviewers after raising PR)
• Tests executed and results posted below

Test Validation

Key Test Cases:

verify_lvbs_kmpp is the test case that run with this Security Profile.

Tested Azure Marketplace Images:

• Custom LVBS Image

Test Results

---

                     LvbsKmpp.verify_lvbs_kmpp: PASSED   

test result summary
TOTAL : 1
QUEUED : 0
ASSIGNED : 0
RUNNING : 0
FAILED : 0
PASSED : 1
SKIPPED : 0

[Copilot]

Copilot review overview

🟡 Changes recommended

Implicit selection can disable Secure Boot, and libvirt advertises a profile its deployment mapping cannot handle.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Preserve SecureBoot selection priority over LvbsProdUnsigned · New
• Prevent libvirt from advertising unsupported LvbsProdUnsigned profile · New

What changed in this PR

Adds an Azure security profile for unsigned LVBS images using Trusted Launch with Secure Boot disabled.

Changes:

• Registers lvbs-prod-unsigned and adds it to capability matching.
• Configures Azure deployment parameters for the new profile.
• Adds decoding, capability, and Secure Boot regression tests.

Suggested validation: run verify_lvbs_kmpp on the custom LVBS image and smoke_test on the marketplace image below.

Key Test Cases:
verify_lvbs_kmpp|smoke_test

Impacted LISA Features:
SecurityProfile

Tested Azure Marketplace Images:

• microsoftcblmariner azure-linux-3 azure-linux-3-gen2 latest

File	Description
selftests/​azure/​test_security_profile.py	Tests decoding, capabilities, and deployment settings.
lisa/​util/​constants.py	Defines the new profile identifier.
lisa/​sut_orchestrator/​azure/​features.py	Advertises SKU support and configures deployment.
lisa/​sut_orchestrator/​azure/​common.py	Adds image and VHD profile support.
lisa/​features/​security_profile.py	Extends shared profile definitions and selection priority.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[LiliDeng]

Praveen K Paladugu (@praveen-pk) I'm not sure whether this combination is meaningful. Also, this case does not have the new requirement added to it.