Add secure boot helper

diskless.pkr.hcl

@@ -65,8 +65,8 @@ variable "artifact_dir" {
 
 variable "nic_drivers" {
   type        = string
-  description = "Kernel modules for the fleet's real NICs (build VM only has virtio!)"
-  default     = "igb igc ixgbe i40e ice mlx5_core"
+  description = "Kernel modules for the fleet's real NICs (build VM only has virtio!). e1000e covers Intel I21x onboard NICs (e.g. EliteBook 820 G4 = I219-LM) for laptop/desktop bench hosts; igb/igc/ixgbe/i40e/ice/mlx5_core cover server NICs. Firmware uses its own driver to PXE/HTTP boot, but the initramfs needs the matching module here to bring the link up in-OS for 802.1X/DHCP/NVMe."
+  default     = "e1000e igb igc ixgbe i40e ice mlx5_core"
 }
 
 variable "build_password" {
@@ -240,6 +240,16 @@ build {
     destination = "/tmp/"
   }
 
+  # Secure Boot enrollment helper + PUBLIC PK/KEK/db .auth files. Staged to
+  # /tmp/secureboot; installed in the package step. The helper (fleet-sb-enroll)
+  # enrolls the keys into firmware via efivarfs over SSH (EL9 has no efitools).
+  # keys/ may be empty (the *.auth are gitignored / CI-materialized); the helper
+  # then reports "no baked keys" until they're supplied. See docs/secure-boot-keys.md.
+  provisioner "file" {
+    source      = "files/secureboot"
+    destination = "/tmp/"
+  }
+
   # --- 2. Packages, configs, diskless adaptations --------------------------
   provisioner "shell" {
     inline = [
@@ -256,19 +266,30 @@ build {
       # dracut warns and silently falls back to gzip (a larger initramfs).
       "dnf -y install wpa_supplicant tpm2-tools tpm2-tss nvme-cli cryptsetup dracut-network NetworkManager zstd openssl",
 
-      # EFI / Secure Boot management tools, for MANUAL key enrollment over SSH on
-      # a workstation in Setup Mode: efitools (efi-updatevar, efi-readvar,
-      # cert-to-efi-sig-list, sign-efi-sig-list, KeyTool) + efivar/mokutil/
-      # efibootmgr companions. See docs/secure-boot-keys.md ("Manual enrollment");
-      # auto-enroll is TODO #10. They write to efivarfs
-      # (/sys/firmware/efi/efivars), NOT the read-only root, so they work at
-      # runtime; RPM-installed => already fapolicyd-trusted (no STIG trust edit).
-      # efitools is EPEL-only on el9: enable EPEL just to pull it, then drop the
-      # repo so a non-kiosk image's repo set is unchanged (kiosk builds re-add it).
-      "dnf -y install efivar mokutil efibootmgr",
-      "rpm -q efitools >/dev/null 2>&1 || { dnf -y install epel-release && dnf -y install efitools && EFITOOLS_EPEL=1; } || true",
-      "rpm -q efitools >/dev/null 2>&1 && echo '==> EFI Secure Boot tools installed (efitools + efivar/mokutil/efibootmgr)' || echo 'WARNING: efitools not installed (EPEL unavailable?) — manual SB enrollment tooling missing' >&2",
-      "[ \"$${EFITOOLS_EPEL:-0}\" = 1 ] && dnf -y remove epel-release >/dev/null 2>&1 || true",
+      # EFI / Secure Boot management tools (efivar, mokutil, efibootmgr — all base
+      # repos). Used over SSH on a workstation: `mokutil --sb-state/--pk/--kek/--db`
+      # reads Secure Boot state + the enrolled PK/KEK/db; efibootmgr manages boot
+      # entries. They act on efivarfs (/sys/firmware/efi/efivars), NOT the
+      # read-only root, so they work at runtime; RPM-installed => fapolicyd-trusted.
+      # NOTE: efitools (efi-updatevar/efi-readvar/KeyTool) is NOT packaged for EL9
+      # (confirmed 2026-06-20), so OS-side *enrollment* of custom PK/KEK/db isn't
+      # available on the image — enroll via the firmware setup UI (load-from-file)
+      # instead. See docs/secure-boot-keys.md; the auto-enroll path (TODO #10)
+      # can't rely on KeyTool here and would need it built/sourced separately.
+      # e2fsprogs gives `chattr`, which fleet-sb-enroll uses to clear the immutable
+      # flag on existing EFI vars before overwriting them via efivarfs.
+      "dnf -y install efivar mokutil efibootmgr e2fsprogs",
+
+      # Secure Boot enrollment helper + PUBLIC PK/KEK/db .auth files. The helper
+      # (fleet-sb-enroll) enrolls the keys into firmware via efivarfs over SSH on a
+      # Setup-Mode workstation (EL9-native, no efitools). Non-RPM exec => add to
+      # fapolicyd trust in 2c-STIG-postfix (like kiosk-session). keys/ may have no
+      # .auth (gitignored / CI-materialized) — then the helper reports no baked keys.
+      "install -D -m0755 /tmp/secureboot/fleet-sb-enroll /usr/local/bin/fleet-sb-enroll",
+      "install -d -m0755 /usr/share/fleet-secureboot",
+      "for f in /tmp/secureboot/keys/*.auth; do [ -e \"$f\" ] && install -m0644 \"$f\" /usr/share/fleet-secureboot/ || echo 'NOTE: no Secure Boot .auth baked (supply via files/secureboot/keys/ or CI secrets)'; done",
+      "restorecon -R /usr/local/bin/fleet-sb-enroll /usr/share/fleet-secureboot 2>/dev/null || true",
+      "rm -rf /tmp/secureboot",
 
       # Plymouth boot splash. The custom scripted 'fleet' theme renders the
       # security-handshake checklist driven by the dracut hooks
@@ -670,9 +691,9 @@ build {
       # custom kiosk files: add them to fapolicyd's trust DB and rebuild it. weston
       # /chromium are RPM-installed so already trusted. (See docs/stig-deviations.md.)
       "if command -v fapolicyd-cli >/dev/null 2>&1; then",
-      "  for f in /usr/local/bin/kiosk-session; do { [ -f \"$f\" ] && fapolicyd-cli --file add \"$f\"; } || true; done",
+      "  for f in /usr/local/bin/kiosk-session /usr/local/bin/fleet-sb-enroll; do { [ -f \"$f\" ] && fapolicyd-cli --file add \"$f\"; } || true; done",
       "  fapolicyd-cli --update 2>/dev/null || true",
-      "  echo '==> fapolicyd: trusted custom kiosk binaries + rebuilt trust db'",
+      "  echo '==> fapolicyd: trusted custom binaries (kiosk-session, fleet-sb-enroll) + rebuilt trust db'",
       "fi",
     ]
   }