From fa1f3aec334eb17aa0283e10d2067d8e03063de4 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 28 Sep 2023 10:33:00 +0200
Subject: [PATCH 1/3] bootctl: report if have been booted with a measured UKI

Just expose the result of efi_measured_uki() to the user.
---
 src/boot/bootctl-status.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/boot/bootctl-status.c b/src/boot/bootctl-status.c
index a6520e0719..73893dee69 100644
--- a/src/boot/bootctl-status.c
+++ b/src/boot/bootctl-status.c
@@ -420,6 +420,16 @@ int verb_status(int argc, char *argv[], void *userdata) {
                        (s & TPM2_SUPPORT_DRIVER) ? "driver only, firmware unavailable" : "no",
                        ansi_normal());
 
+                k = efi_measured_uki(LOG_DEBUG);
+                if (k > 0)
+                        printf("  Measured UKI: %syes%s\n", ansi_highlight_green(), ansi_normal());
+                else if (k == 0)
+                        printf("  Measured UKI: no\n");
+                else {
+                        errno = -k;
+                        printf("  Measured UKI: %sfailed%s (%m)\n", ansi_highlight_red(), ansi_normal());
+                }
+
                 k = efi_get_reboot_to_firmware();
                 if (k > 0)
                         printf("  Boot into FW: %sactive%s\n", ansi_highlight_yellow(), ansi_normal());

From a730a8f608a3a8dbef4ce1a6e939ced47c63063c Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 28 Sep 2023 10:45:39 +0200
Subject: [PATCH 2/3] bootctl: if we can't access the ESP, show this in regular
 status output

---
 src/boot/bootctl-status.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/boot/bootctl-status.c b/src/boot/bootctl-status.c
index 73893dee69..00bc0a91c2 100644
--- a/src/boot/bootctl-status.c
+++ b/src/boot/bootctl-status.c
@@ -273,15 +273,13 @@ static int status_binaries(const char *esp_path, sd_id128_t partition) {
         printf("\n");
 
         r = enumerate_binaries(esp_path, "EFI/systemd", NULL, &last, &is_first);
-        if (r < 0) {
-                printf("\n");
-                return r;
-        }
+        if (r < 0)
+                goto fail;
 
         k = enumerate_binaries(esp_path, "EFI/BOOT", "boot", &last, &is_first);
         if (k < 0) {
-                printf("\n");
-                return k;
+                r = k;
+                goto fail;
         }
 
         if (last) /* let's output the last entry now, since now we know that there will be no more, and can draw the tree glyph properly */
@@ -296,6 +294,11 @@ static int status_binaries(const char *esp_path, sd_id128_t partition) {
 
         printf("\n");
         return 0;
+
+fail:
+        errno = -r;
+        printf("         File: (can't access %s: %m)\n\n", esp_path);
+        return r;
 }
 
 static void read_efi_var(const char *variable, char **ret) {

From 4ed9e2619c630679b2fac1fc0eb4ab4b55f02871 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 28 Sep 2023 10:45:49 +0200
Subject: [PATCH 3/3] bootctl: highlight SecureBoot enabled state in green

---
 src/basic/string-util.h   |  4 ++++
 src/boot/bootctl-status.c | 12 +++++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/basic/string-util.h b/src/basic/string-util.h
index 72f791f6cc..6b6a5746fe 100644
--- a/src/basic/string-util.h
+++ b/src/basic/string-util.h
@@ -68,6 +68,10 @@ static inline const char* enable_disable(bool b) {
         return b ? "enable" : "disable";
 }
 
+static inline const char* enabled_disabled(bool b) {
+        return b ? "enabled" : "disabled";
+}
+
 /* This macro's return pointer will have the "const" qualifier set or unset the same way as the input
  * pointer. */
 #define empty_to_null(p)                                \
diff --git a/src/boot/bootctl-status.c b/src/boot/bootctl-status.c
index 00bc0a91c2..033abb0566 100644
--- a/src/boot/bootctl-status.c
+++ b/src/boot/bootctl-status.c
@@ -410,9 +410,15 @@ int verb_status(int argc, char *argv[], void *userdata) {
                 printf("%sSystem:%s\n", ansi_underline(), ansi_normal());
                 printf("      Firmware: %s%s (%s)%s\n", ansi_highlight(), strna(fw_type), strna(fw_info), ansi_normal());
                 printf(" Firmware Arch: %s\n", get_efi_arch());
-                printf("   Secure Boot: %sd (%s)\n",
-                       enable_disable(IN_SET(secure, SECURE_BOOT_USER, SECURE_BOOT_DEPLOYED)),
-                       secure_boot_mode_to_string(secure));
+                printf("   Secure Boot: %s%s%s",
+                       IN_SET(secure, SECURE_BOOT_USER, SECURE_BOOT_DEPLOYED) ? ansi_highlight_green() : ansi_normal(),
+                       enabled_disabled(IN_SET(secure, SECURE_BOOT_USER, SECURE_BOOT_DEPLOYED)),
+                       ansi_normal());
+
+                if (secure != SECURE_BOOT_DISABLED)
+                        printf(" (%s)\n", secure_boot_mode_to_string(secure));
+                else
+                        printf("\n");
 
                 s = tpm2_support();
                 printf("  TPM2 Support: %s%s%s\n",