adding ssh host signing

.gitea/workflows/ipxe-image.yaml

@@ -22,9 +22,10 @@
 #
 # Runs only when the iPXE inputs change (path filter) or on demand.
 #
-# Required Gitea repo secrets: PACKAGE_USER, PACKAGE_TOKEN (registry creds).
-# Optional: SB_KEY, SB_CERT (db PRIVATE key + cert, PEM). Unset => UNSIGNED lab
-#   image (loud warning; Secure-Boot-enforcing hosts will reject it). PK/KEK
+# Required Gitea repo secrets: PACKAGE_USER, PACKAGE_TOKEN (registry creds),
+#   SB_KEY, SB_CERT (db PRIVATE key + cert, PEM). SB_KEY/SB_CERT are REQUIRED —
+#   a "Production build gate" fails the run if either is unset (no unsigned
+#   fallback; POA&M P-03). Enforcing hosts reject an unsigned snponly.efi. PK/KEK
 #   never come near CI — only `db` signs (docs/secure-boot-keys.md).
 #
 
@@ -104,12 +105,31 @@ jobs:
           echo "push_latest=$push_latest" >> "$GITHUB_OUTPUT"
           echo "Using snponly.efi=$SNP  tag=$VER (ipxe pkg $RAW, latest=$push_latest)"
 
+      -
+        name: Production build gate (fail closed on missing signing material)
+        # POA&M P-03 (poam-hardening): the signed iPXE bootloader is a production
+        # Secure-Boot artifact — an unsigned snponly.efi is rejected by enforcing
+        # hosts and defeats the chain of trust. SB_KEY/SB_CERT MUST be set; there
+        # is no unsigned fallback. (FLEET_CA is N/A — iPXE carries no fleet CA.)
+        env:
+          SB_KEY:  ${{ secrets.SB_KEY }}
+          SB_CERT: ${{ secrets.SB_CERT }}
+        run: |
+          miss=0
+          for v in SB_KEY SB_CERT; do
+            if [ -z "${!v}" ]; then
+              echo "::error::required secret ${v} is empty — the fleet-ipxe bootloader must be signed (no unsigned fallback). Set it in the Gitea repo secrets."
+              miss=1
+            fi
+          done
+          [ "$miss" = 0 ] || exit 1
+          echo "Production gate passed: SB_KEY, SB_CERT present."
+
       -
         name: Materialize Secure Boot signing material
         # Same db key that signs the UKI; written to a runner-temp file and passed
-        # to build-ipxe-oci.sh as a path. If SB_KEY is unset this no-ops and the
-        # build produces an UNSIGNED (lab) image with its loud warning.
-        if: ${{ secrets.SB_KEY != '' }}
+        # to build-ipxe-oci.sh as a path. Presence is guaranteed by the Production
+        # build gate above (fail-closed) — there is no unsigned fallback.
         env:
           SB_KEY:  ${{ secrets.SB_KEY }}
           SB_CERT: ${{ secrets.SB_CERT }}
@@ -140,8 +160,8 @@ jobs:
             "${{ steps.src.outputs.snponly }}" \
             "${IPXE_IMAGE}" \
             "$VER" \
-            "${SB_KEY_FILE:-}" \
-            "${SB_CERT_FILE:-}" \
+            "${SB_KEY_FILE}" \
+            "${SB_CERT_FILE}" \
             true
           # main / release tags also move :latest; dev branches never clobber it.
           if [ "${{ steps.src.outputs.push_latest }}" = "true" ]; then