Morten Linderud

Read `PK` and check for the Microsoft Signature List. Error and tell people to reset and/or clear Secure Boot keys if they are present. A PK version of this function...

Use efivarfs to store sbctl settings/configurations

4

A neat trick would be to use `efivarfs` to store sbctl configuration/information and make it persistent across installations or operating systems. Probably future goal, but an issue to track potential...

Better error messages when keys are already present with `enroll-keys`

1

Currently when enrolling-keys we dont check if there is no keys on the system. We just blindly `sbkeysync` and assume it's fine. We should preferably do a check on the...

sbctl bundle splash image should detect if it's a valid bitmap file

13

Currently we accept any file and it's not clear why the image isn't displayed. We should probably inspect the file and ensure it's valid before we include it. Some details...

Integration tests

2

Look into https://github.com/anatol/vmtest for integration tests. I'm a bit unsure if unit-testing works well as we are relying on firmware stuff.

Exit codes

3

Stolen from `makepkg(8)`. But this could maybe work as an outline? ``` ERRORS On exit, makepkg will return one of the following error codes. 0 Normal exit condition. 1 Not...

With the recent boothole stuff I think it would be neat to track the signatures done so we can revoke them retroactively. We should probably also sport a revocation API...

General issue for any UX issues people experience with sbctl.

Supporting the kernel.org transparency log

5

kernel.org maintains a transparency log in the form of a git repository and I was wondering how one should go about supporting this for the omnifeeder? Currently creating proofs is...

Signed-off-by: Morten Linderud