Automatically replacing versions of a key database for secure boots

A non-transitory machine-readable storage medium to store instructions that, when executed by a machine, cause the machine to:

• in a secure boot of the machine, load first data representing a key corresponding to a plurality of option component drivers in a key database;
• determine whether driver code stored on an option component of the machine is trusted based on the first data and a hash of the driver code;
• based on whether the driver code is determined to be trusted, execute the driver code;
• in the secure boot, erase the first data from the key database and load second data in the key database, wherein the second data represents a public key corresponding to an operating system bootloader code;
• determine whether operating system bootloader code is trusted based on the second data;
• and
• based on whether the operating system bootloader code is determined to be trusted, execute the operating system bootloader code.

An appliance comprising:

• an expansion component connector;
• a processor;
• a secure boot key database;
• and
• a non-volatile memory to store instructions that, when executed by the processor during boot of the appliance, cause the processor to:
• in a first phase of the boot, access the secure boot key database to determine whether driver code contained in an expansion component connected to the appliance via the expansion component connector is trusted;
• in preparation for a second phase of the boot proceeding the first phase, erase the secure boot key database and store a key in the secure boot key database corresponding to an operating system bootloader;
• in the second phase of the boot, access the secure boot key database to determine whether operating system bootloader code is trusted based on the key stored in the secure boot key database;
• and
• execute the operating system bootloader code based on the determination whether the operating system bootloader code is trusted.