I checked the latest M1V307 firmware for the N150 12Gb version of the ME Mini which still holds the pkfail compromised secure boot certificates. I run Ubuntu Server on this device (which I’m very happy with) which gave me this message in the morning:
3 devices have a firmware upgrade available.
Run `fwupdmgr get-upgrades` for more information.
Last login: Wed Sep 24 18:32:08 2025 from 192.168.0.xxx
root@beelink:~# fwupdmgr get-upgrades
WARNING: UEFI capsule updates not available or enabled in firmware setup
See https://github.com/fwupd/fwupd/wiki/PluginFlag:capsules-unsupported for more information.
Devices with no available firmware updates:
~ KINGSTON xxx
~ Lexar SSD xxx
~ Lexar SSD xxx
~ Lexar SSD xxx
~ Windows Production PCA
AZW ME mini
tqKEK CA:
Device ID: b7a1d3d90faa1f6275d9a98da4fb3be7118e61c7
Current version: 2011
Vendor: Microsoft (UEFI:Microsoft)
GUIDs: 814e950f-1449-566a-a190-42c9d3a3a2df ? UEFI\VENDOR_Microsoft&NAME_Microsoft-KEK-CA
dfa66406-6568-5bdf-bb8e-b53ddb4be4cf ? UEFI\CRT_9F402B1CC0243CBEDC58A525789816CCCA7687A9
Device Flags: ~ Internal device
~ Updatable
~ Supported on remote server
~ Needs a reboot after installation
~ Device is usable for the duration of the update
~ Signed Payload
~ Can tag for emulation
tqSecure Boot KEK Configuration Update:
New version: 2023
Remote ID: lvfs
Release ID: 113893
Summary: UEFI Secure Boot Key Exchange Key
Variant: AMI
License: Proprietary
Size: 2.8 kB
Created: 2025-04-29
Urgency: High
Vendor: Linux Foundation
Release Flags: ~ Trusted metadata
~ Is upgrade
Description:
This updates the UEFI Signature Database (the "KEK") to the latest release from Microsoft, signed by DO NOT TRUST - AMI Test PK.
Checksum: 103ebd21a803540296daff93fa7e1595bf323b4db78fbc6287aed945ab5965fb
The “DO NOT TRUST - AMI Test PK” is a known compromised firmware (see for instance https://www.binarly.io/blog/pkfail-untrusted-platform-keys-undermine-secure-boot-on-uefi-ecosystem for detailed info).
The M1V305 firmware seemed to suggest this was fixed given the name of the firmware zip file, but also that firmware has the compromised parts in it.
Is Beelink aware? Are you working on getting this structurally fixed?
