New UEFI CA memory mitigation requirements for signing

Hello Ken_Taylor590,

At this time, our suggested solution for setting the NXCOMPAT flag is to use the image validation tool that was mentioned in the article (and an updated link provided by nicholasbishop). This is due to the fact that the tool will allow the developer to perform a limited validation that the image meets the NX Compat requirements before setting the NXCOMPAT flag. This validation only verifies settings in the image header, not that the code itself meets the requirements, so the developer must perform their own attestation for that. There is an effort to add functionality to the EDK build system base tools to verify the NXCOMPAT requirements, and set the flag appropriately, but this has not been added as of 9/15/2023.

The steps below are current as of 9/15/2023; the tool interface may change in the future, so please refer to the documentation for the most up-to-date interface: PE/COFF Image Validation Tool - Tianocore Edk2 Pytool Extensions (edk2toolext).

The tool comes bundled with edk2-pytool-extensions, installed via pip. From there you can use the tool to validate that the image meets the requirements, and then to set the NXCOMPAT flag.

pip install --update --force edk2-pytool-extensions
validate_image_tool -i path/to/file
validate_image_tool -i path/to/file --set-nx-compat

 
There are also workarounds for having this set by the linker, but again, the preferred course of action is to verify the image with the above-mentioned tool.