Does fwupd check DB before DBX update? Is there a warning for revoked files present before DBX is applied? #8376

Can fwupd tool verify that there is no revoked binary or firmware present before applying DBX

Yup, we do that now if you use fwupdmgr or fwupdtool to deploy the dbx update. We've had that for some time. If you're using either the original dbxtool (or the fwupd-provided backwards compatibility version) you can do anything you like with no checks. e.g. google for "Blocked executable in the ESP, ensure grub and shim are up to date" to see all the real people that hit this. :)

Thanks! I think I did the fwupdtool install-blob DBXUpdate-20250114.x64.bin which bypasses these checks. It is impossible to know the PXE, HTTP and any other Network Media is up to date, perhaps a warning is best both in the XML and anybody who cares to read knows that these may be impacted.