From 75ea215310cdc88554d22de6430ac4988dbc5156 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Thu, 2 Apr 2026 15:25:23 +0200
Subject: [PATCH] OvmfPkg/EnrollDefaultKeys: do not check VendorKeys

AuthVariableLib behavior wrt VendorKeys changes depending on
PcdRequireSelfSignedPk state.  Given this is not security critical
just skip the VendorKeys check in EnrollDefaultKeys

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
index 586bbacc7b..1c06d4698a 100644
--- a/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
+++ b/OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
@@ -851,8 +851,7 @@ ShellAppMain (
   PrintSettings (&Settings);
 
   if ((Settings.SetupMode != 0) || (Settings.SecureBoot != 1) ||
-      (Settings.SecureBootEnable != 1) || (Settings.CustomMode != 0) ||
-      (Settings.VendorKeys != 0))
+      (Settings.SecureBootEnable != 1) || (Settings.CustomMode != 0))
   {
     AsciiPrint ("error: unexpected\n");
     goto FreePkKek1;