fix: avoid sending empty ShieldedInstanceInitialState on image create

CreateShieldedVMStateConfig has been returning a non-nil pointer to a
zero-value compute.InitialStateConfig{} whenever no signature inputs
(image_platform_key, image_key_exchange_key, image_signatures_db,
image_forbidden_signatures_db) were configured. Because Go's omitempty
tag only drops nil pointers (not pointers to empty structs), the image
insert request body included:

    "shieldedInstanceInitialState": {}

GCP treats an explicit (even empty) shieldedInstanceInitialState as
*the* initial state for the new image and therefore replaces the
PK / KEKs / db / dbx that would otherwise be inherited from the source
disk. With no signature databases, UEFI Secure Boot has nothing to
validate the bootloader against, and any VM launched from such an
image with shielded-vm secure boot enabled fails to boot:

    BdsDxe: failed to load Boot0001 "UEFI Google PersistentDisk"
    ... Status: Security Violation.

This regression was introduced in #318 (released in v1.2.5). Subsequent
work in #333 removed the UEFI_COMPATIBLE gate but kept the empty-struct
return path, so v1.2.6 is still affected.

Fix: return nil from CreateShieldedVMStateConfig when no signature
inputs are configured, so the caller leaves
compute.Image.ShieldedInstanceInitialState unset and GCP inherits the
initial state from the source disk.

Adds:
- Unit tests for CreateShieldedVMStateConfig covering both the
  no-inputs (nil return) and inputs-provided (non-nil return) paths.
- Step-level regression test asserting that the image insert spec has
  no ShieldedInstanceInitialState when no signature inputs are
  configured.

Author: andyroyle

builder/googlecompute/step_create_image_test.go

@@ -94,6 +94,36 @@ func TestStepCreateImage_setsDeprecationFields(t *testing.T) {
 	assert.Contains(t, []string{"DEPRECATED", "ACTIVE"}, d.DeprecatedImageStatus.State, "State should be DEPRECATED or ACTIVE")
 }
 
+// Regression test: when no Secure Boot signature inputs are configured, the
+// image insert request must not include a shieldedInstanceInitialState field.
+// Sending an explicit (even empty) InitialStateConfig replaces the
+// PK/KEKs/db/dbx that would otherwise be inherited from the source disk and
+// causes Secure Boot to fail on VMs launched from the resulting image
+// (UEFI: "Status: Security Violation").
+func TestStepCreateImage_noSignatureInputsLeavesInitialStateNil(t *testing.T) {
+	state := testState(t)
+	step := new(StepCreateImage)
+	defer step.Cleanup(state)
+
+	c := state.Get("config").(*Config)
+	d := state.Get("driver").(*common.DriverMock)
+
+	// Clear all signature inputs supplied by the default testConfig.
+	c.ImagePlatformKey = ""
+	c.ImageKeyExchangeKey = nil
+	c.ImageSignaturesDB = nil
+	c.ImageForbiddenSignaturesDB = nil
+
+	action := step.Run(context.Background(), state)
+	assert.Equal(t, multistep.ActionContinue, action, "Step did not pass.")
+
+	assert.Nil(
+		t,
+		d.CreateImageSpec.ShieldedInstanceInitialState,
+		"shieldedInstanceInitialState must be nil so the source disk's initial state is inherited",
+	)
+}
+
 func TestStepCreateImageNonUEFI_image(t *testing.T) {
 	state := testState(t)
 	step := new(StepCreateImage)

lib/common/shielded_vms.go

@@ -34,6 +34,16 @@ func FillFileContentBuffer(certOrKeyFile string) (*compute.FileContentBuffer, er
 }
 
 func CreateShieldedVMStateConfig(imagePlatformKey string, imageKeyExchangeKey []string, imageSignaturesDB []string, imageForbiddenSignaturesDB []string) (*compute.InitialStateConfig, error) {
+	// When no Secure Boot signature inputs are configured, return nil so the
+	// caller leaves ShieldedInstanceInitialState unset on the image payload.
+	// Sending an explicit (even empty) InitialStateConfig replaces the
+	// PK/KEKs/db/dbx that would otherwise be inherited from the source disk,
+	// which causes Secure Boot to fail on VMs launched from the resulting
+	// image (UEFI: "Status: Security Violation").
+	if imagePlatformKey == "" && len(imageKeyExchangeKey) == 0 && len(imageSignaturesDB) == 0 && len(imageForbiddenSignaturesDB) == 0 {
+		return nil, nil
+	}
+
 	shieldedVMStateConfig := &compute.InitialStateConfig{}
 	if imagePlatformKey != "" {
 		shieldedData, err := FillFileContentBuffer(imagePlatformKey)

lib/common/shielded_vms_test.go

@@ -0,0 +1,56 @@
+// Copyright IBM Corp. 2013, 2025
+// SPDX-License-Identifier: MPL-2.0
+
+package common
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+// When no Secure Boot signature inputs are configured, the helper must return
+// a nil *InitialStateConfig so the caller does not attach an empty
+// shieldedInstanceInitialState to the image insert request. Attaching an
+// empty value overrides the PK/KEKs/db/dbx that would otherwise be inherited
+// from the source disk and breaks Secure Boot on the resulting image.
+func TestCreateShieldedVMStateConfig_NoInputsReturnsNil(t *testing.T) {
+	cfg, err := CreateShieldedVMStateConfig("", nil, nil, nil)
+	assert.NoError(t, err)
+	assert.Nil(t, cfg, "expected nil config when no signature inputs are configured")
+
+	cfg, err = CreateShieldedVMStateConfig("", []string{}, []string{}, []string{})
+	assert.NoError(t, err)
+	assert.Nil(t, cfg, "expected nil config when signature inputs are empty slices")
+}
+
+func TestCreateShieldedVMStateConfig_PopulatesFieldsWhenInputsProvided(t *testing.T) {
+	dir := t.TempDir()
+	keyPath := filepath.Join(dir, "fake-key")
+	if err := os.WriteFile(keyPath, []byte("fake key data"), 0600); err != nil {
+		t.Fatalf("failed to write fake key: %v", err)
+	}
+
+	tests := []struct {
+		name string
+		pk   string
+		keks []string
+		dbs  []string
+		dbxs []string
+	}{
+		{name: "platform key only", pk: keyPath},
+		{name: "kek only", keks: []string{keyPath}},
+		{name: "db only", dbs: []string{keyPath}},
+		{name: "dbx only", dbxs: []string{keyPath}},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg, err := CreateShieldedVMStateConfig(tc.pk, tc.keks, tc.dbs, tc.dbxs)
+			assert.NoError(t, err)
+			assert.NotNil(t, cfg, "expected non-nil config when at least one signature input is provided")
+		})
+	}
+}