OvmfPkg: require self-signed PK when secure boot is enabled

[mirror_edk2.git] / OvmfPkg / IntelTdx / IntelTdxX64.dsc

diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
index 41de2e9428171f662db63e0ac6813a85485d4e6f..95b9594ddce038f9f12400d30935571f3b71c65c 100644 (file)
--- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
@@ -390,6 +390,9 @@
 !ifdef $(CSM_ENABLE)\r
   gUefiOvmfPkgTokenSpaceGuid.PcdCsmEnable|TRUE\r
 !endif\r
+!if $(SECURE_BOOT_ENABLE) == TRUE\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE\r
+!endif\r
 \r
 [PcdsFixedAtBuild]\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|1\r