reports
keys
# Throwaway USBGuard mass-storage test image (see the USBGuard verify steps)
/usbguard-test.img

# Secure Boot enrollment material baked into the image. The *.auth are PUBLIC but
# environment-specific, so keep the repo neutral: supply via CI secrets
# (SB_*_AUTH_B64) or `git add -f` if you choose to commit them. Keep README/.gitkeep.
/files/secureboot/keys/*.auth
/files/secureboot/keys/*.esl
/files/secureboot/keys/*.crt

# iPXE network bootloader binaries for the PXE fallback (serving/tftp). Binary,
# and the signed one is db-derived/environment-specific — supply per environment.
#/serving/tftp/*.efi
/serving/tftp/*.kpxe

# Audit-collector syslog-TLS server cert/key (issued per-environment from the
# fleet step-ca by serving/audit-collector/issue-cert.sh). Key material — never
# commit it.
/serving/audit-collector/tls/

# Out-of-VM CI-built host binaries (staged into the image by the Packer file
# provisioner; built by the "Build host Go binaries" CI step).
files/enrol/bin/
files/hostapi/bin/
files/agent/bin/
files/ssh-hostcert/bin/
