Enrolling / exporting / importing signatures. about sbctl HOT 1 CLOSED

It should be possible to enroll a signed empty file, signed by PK and get us into setup mode. I have tried writing code for this with goefi but haven't been able to reproduce this functionality inside qemu with tianocore.

Some export functionality makes sense, as the actual files would probably disappear, and created on-demand, when we move from sbsigntools to goefi.

Finally, what do you think of moving keys across devices? Should it be a supported thing, or should users just manually copy the /usr/share/secureboot folder?

Not sure. If we want better secured keys, say we add yubikey support, I wonder if it's better to have sbctl.conf and allow people to point at keystores at will. Then sbctl can just do it's due diligence and ensure we know we have the enrolled keys in the keystore.

from sbctl.