Bug 2310759

mkosi uses sbvarsign to sign PK, KEK and db signature lists for use with systemd-boot secure boot auto-enrollment. sbsigntools, when built against gnu-efi 3.18.0 produces a signed PK signature list that results in a security violation when systemd-boot tries to enroll it within a UEFI OVMF virtual machine. If I install sbsigntools-0.9.5-1.fc38.x86_64.rpm from Fedora 38 the signed PK signature list is accepted again by the OVMF secure boot firmware.

If I build sbsigntools from Fedora Rawhide against gnu-efi 3.11.0, the PK signature list is also accepted as expected. This leads me to believe that gnu-efi 3.18.0 is what's causing this breakage.

Reproducible: Always

Steps to Reproduce:
On a Fedora 40 or rawhide system, run the following:
- git clone https://github.com/systemd/mkosi
- ln -s $PWD/mkosi/bin/mkosi /usr/local/bin/mkosi
- mkdir tmp
- cd tmp
- mkosi genkey
- mkosi -d fedora -r rawhide -p kernel-core -p systemd -p udev -p systemd-boot --secure-boot --secure-boot-auto-enroll=yes -i -f qemu

Actual Results:  
Enrolling secure boot keys from directory: \loader\keys\auto
Failed to write PK secure boot variable: Security violation


Expected Results:  
Enrolling secure boot keys from directory: \loader\keys\auto
Custom Secure Boot keys successfully enrolled, rebooting the system now!