Add Secure Boot

[hanthor]

No description provided.

[hanthor]

Stream 10 does have a shim but it seems out of date. https://issues.redhat.com/browse/RHEL-69544

If we ever enable kernel modules we will have to sign our own kernel

If we want to enable secure boot right now
we also need to sign the kernel with our MOK key:

# Sign the kernel with the MOK
sbsign --key MOK.key --cert MOK.crt /boot/vmlinuz-$(uname -r) --output /boot/vmlinuz-$(uname -r).signed

Ok so ublue currently does this signing in the kernel-cache CI. We can do something similar, but it would be nice to avoid making another repo just for handling kernels.

Not sure what other alternatives there are, short of using a ctx or some other kind of container to mount the filesystem of the image and sign from there. It would be nice if this was part of bib

[tulilirockz]

Needs to get fixed on main, too