Fixed the secure boot enrollment script

files/secureboot/fleet-sb-enroll

@@ -28,8 +28,12 @@ EFIVARS=/sys/firmware/efi/efivars
 GUID_GLOBAL=8be4df61-93ca-11d2-aa0d-00e098032b8c   # PK, KEK, SetupMode
 GUID_DB=d719b2cb-3d3a-4596-a3bc-dad00e67656f       # db, dbx
 # EFI var attributes: NON_VOLATILE|BOOTSERVICE_ACCESS|RUNTIME_ACCESS|
-# TIME_BASED_AUTHENTICATED_WRITE_ACCESS = 0x27, little-endian 4 bytes.
-ATTR=$'\x27\x00\x00\x00'
+# TIME_BASED_AUTHENTICATED_WRITE_ACCESS = 0x27, written as a 4-byte little-endian
+# u32 prefixed to the .auth payload. These 4 bytes contain NULs, so they are
+# emitted with printf at WRITE TIME, never stored in a variable: a bash string
+# can't hold a NUL (it truncates at the first one), which would leave only the
+# 0x27 byte, corrupt the 4-byte attribute field efivarfs reads, and make the
+# kernel reject the write with EINVAL ("dd: Invalid argument").
 
 die() { echo "fleet-sb-enroll: $*" >&2; exit 1; }
 
@@ -57,7 +61,7 @@ enrol_one() {  # $1=var name  $2=guid  $3=.auth path
   local f="$EFIVARS/$1-$2" tmp
   [ -f "$3" ] || die "missing $3"
   tmp=$(mktemp)
-  printf '%s' "$ATTR" > "$tmp"
+  printf '\x27\x00\x00\x00' > "$tmp"   # 4-byte LE attribute prefix (see note above)
   cat "$3" >> "$tmp"
   # Existing EFI vars carry the immutable flag; clear it before overwriting.
   [ -e "$f" ] && chattr -i "$f" 2>/dev/null || true