PSA: NX support mandatory since November 30 2022

[julian-klode]

Microsoft requires NX support for signing since Nov 30.

shim 15.7 does not enable NX support, a patch is available here:

rhboot/shim#530

Alternative run post-process-pe manually with the right flag set.

Also NX support needs to be added to bootloader and kernel.

Hence please don't submit shims for review if you don't have working NX stack or at least prepped the shim for NX (I mean you can continue working on the rest in the meantime).

[jackpot51]

I have a question about the preferred way of applying this patch: #313 (comment)

Also, I would like to request that a new release of Shim be made such that NX is enabled by default, if it is always going to be a requirement.

[julian-klode]

I've heard rumors some firmware actually discovers that the flag is set and turns on NX enforcement, causing later stages to fail. You can't sign without one of course, but the rest of the boot stack isn't ready for NX yet so muhaha as we say.