Check for used UEFI certificates when updating vm platform

Signed-off-by: BenjiReis <benjamin.reis@vates.fr>

Author: benjamreis

ocaml/xapi/helpers.ml

@@ -2047,3 +2047,13 @@ let unit_test ~__context : bool =
       true
   | None ->
       false
+
+let get_active_uefi_certificates ~__context ~self =
+  let custom_uefi_certs =
+    Db.Pool.get_custom_uefi_certificates ~__context ~self
+  in
+  match (!Xapi_globs.allow_custom_uefi_certs, custom_uefi_certs) with
+  | false, _ | true, "" ->
+      Db.Pool.get_uefi_certificates ~__context ~self
+  | true, _ ->
+      custom_uefi_certs

ocaml/xapi/xapi_vm.ml

@@ -290,9 +290,8 @@ let update_platform_secureboot ~__context ~self platform =
   | exception Not_found ->
       platform
   | "auto" ->
-      ( "secureboot"
-      , string_of_bool (Db.Pool.get_uefi_certificates ~__context ~self <> "")
-      )
+      let uefi_certs = Helpers.get_active_uefi_certificates ~__context ~self in
+      ("secureboot", string_of_bool (uefi_certs <> ""))
       :: List.remove_assoc "secureboot" platform
   | _ ->
       platform