Initial Secure boot setup

.gitea/workflows/gitea-main-ci.yaml

@@ -8,16 +8,19 @@
 # shell-local post-processors extract artifacts, build the UKI (ukify), and
 # build+push the OCI release image.
 #
-# This is an UNSIGNED (lab) build: sb_key/sb_cert are intentionally NOT passed,
-# so build-oci.sh emits its loud unsigned-UKI warning. A production fleet must
-# sign in CI/HSM -- see the "TODO: wire SB_KEY/SB_CERT" step below.
+# Signed when the SB_KEY/SB_CERT secrets are set; otherwise an UNSIGNED (lab)
+# build where build-oci.sh emits its loud unsigned-UKI warning. Signing runs
+# shell-local on the runner (not in the build VM); the key is staged to
+# RUNNER_TEMP and shredded after. See docs/secure-boot-keys.md.
 #
 # Required Gitea repo secrets:
 #   REGISTRY_USERNAME  - registry user for `oci_image` (oci_push=true)
 #   REGISTRY_TOKEN     - registry password/token
 #   SSH_AUTHORIZED_KEY - public key for the sudo admin user; empty => no admin
 #                        user + root left unlocked (lab). Set it to lock root.
-#   # SB_KEY, SB_CERT  - (future) Secure Boot signing key + cert for signed UKIs
+#   SB_KEY, SB_CERT    - Secure Boot signing: the `db` PRIVATE key (PEM) + its
+#                        cert (PEM). Empty => unsigned lab build. PK/KEK are NOT
+#                        here (offline/HSM). Generate per docs/secure-boot-keys.md.
 #
 # Runner: needs KVM (qemu accelerator=kvm) and the build-host tooling installed
 # below (libguestfs, erofs-utils, cryptsetup, jq, ukify, buildah).
@@ -176,11 +179,32 @@ jobs:
             --password "${{ secrets.PACKAGE_TOKEN }}" \
             git.bitasylum.org
 
+      -
+        name: Materialize Secure Boot signing material
+        # sb_key/sb_cert are consumed by ukify as FILE PATHS (not values), and the
+        # signing post-processor runs shell-local on THIS runner (not in the build
+        # VM), so write the secrets to runner-temp files and pass their paths. The
+        # `db` PRIVATE key is the only signing key here; PK/KEK stay offline (see
+        # docs/secure-boot-keys.md). If SB_KEY is unset, this no-ops and the build
+        # falls back to an UNSIGNED lab UKI (the loud warning stays).
+        if: ${{ secrets.SB_KEY != '' }}
+        env:
+          SB_KEY:  ${{ secrets.SB_KEY }}    # db private key (PEM) — secret
+          SB_CERT: ${{ secrets.SB_CERT }}   # db cert (PEM) — public, kept as a secret for convenience
+        run: |
+          umask 077
+          d="$RUNNER_TEMP/sb"; mkdir -p "$d"
+          printf '%s\n' "$SB_KEY"  > "$d/db.key"
+          printf '%s\n' "$SB_CERT" > "$d/db.crt"
+          echo "SB_KEY_FILE=$d/db.key"  >> "$GITHUB_ENV"
+          echo "SB_CERT_FILE=$d/db.crt" >> "$GITHUB_ENV"
+          echo "Secure Boot signing material staged (signed UKI build)."
+
       -
         name: packer build (UKI + OCI release image)
-        # UNSIGNED lab build: sb_key/sb_cert deliberately omitted.
-        # TODO: wire SB_KEY/SB_CERT secrets for a signed UKI:
-        #   -var sb_key=${{ secrets.SB_KEY }} -var sb_cert=${{ secrets.SB_CERT }}
+        # Signed when SB_KEY/SB_CERT secrets are set (paths exported above);
+        # UNSIGNED lab build (loud warning) when they're empty. sb_key/sb_cert are
+        # PATHS, never values — see the materialize step and docs/secure-boot-keys.md.
         run: |
           packer build -color=false -on-error=abort \
             -var image_version="${{ steps.vars.outputs.image_version }}" \
@@ -190,11 +214,20 @@ jobs:
             -var disable_dot1x=${{ env.DISABLE_DOT1X }} \
             -var nvmet_traddr="${{ env.NVMET_TRADDR }}" \
             -var ssh_authorized_key="${{ secrets.SSH_AUTHORIZED_KEY }}" \
+            -var sb_key="${SB_KEY_FILE:-}" \
+            -var sb_cert="${SB_CERT_FILE:-}" \
             -var kiosk_url="${{ env.KIOSK_URL }}" \
             -var boot_splash=${{ env.BOOT_SPLASH }} \
             -var enable_stig=${{ env.ENABLE_STIG }} \
             .
 
+      -
+        name: Shred Secure Boot signing key
+        # Remove the private key from the runner FS even if the build failed.
+        # (RUNNER_TEMP is also wiped per-job on ephemeral runners — belt + braces.)
+        if: always()
+        run: shred -u "$RUNNER_TEMP/sb/db.key" 2>/dev/null || rm -f "$RUNNER_TEMP/sb/db.key" 2>/dev/null || true
+
       -
         name: STIG deviations report (report-only)
         # The build downloaded the post-remediation scan (stig-arf.xml +