Add secure boot helper

.gitea/workflows/gitea-main-ci.yaml

@@ -203,6 +203,26 @@ jobs:
           echo "SB_CERT_FILE=$d/db.crt" >> "$GITHUB_ENV"
           echo "Secure Boot signing material staged (signed UKI build)."
 
+      -
+        name: Materialize Secure Boot enrollment certs
+        # PUBLIC PK/KEK/db .auth files baked into the image for fleet-sb-enroll.
+        # They're binary, so stored base64 in repo secrets; decode into
+        # files/secureboot/keys/ (gitignored) before the build picks them up. If
+        # the secrets are unset this no-ops and the helper ships without keys
+        # (reports "no baked keys" until supplied). NOT signing keys — see
+        # docs/secure-boot-keys.md; PK/KEK private keys never come near CI.
+        if: ${{ secrets.SB_DB_AUTH_B64 != '' }}
+        env:
+          SB_PK_AUTH_B64:  ${{ secrets.SB_PK_AUTH_B64 }}
+          SB_KEK_AUTH_B64: ${{ secrets.SB_KEK_AUTH_B64 }}
+          SB_DB_AUTH_B64:  ${{ secrets.SB_DB_AUTH_B64 }}
+        run: |
+          d=files/secureboot/keys; mkdir -p "$d"
+          printf '%s' "$SB_PK_AUTH_B64"  | base64 -d > "$d/PK.auth"
+          printf '%s' "$SB_KEK_AUTH_B64" | base64 -d > "$d/KEK.auth"
+          printf '%s' "$SB_DB_AUTH_B64"  | base64 -d > "$d/db.auth"
+          echo "Staged PK/KEK/db .auth for in-image enrollment:"; ls -l "$d"/*.auth
+
       -
         name: packer build (UKI + OCI release image)
         # Signed when SB_KEY/SB_CERT secrets are set (paths exported above);