Initial Secure boot setup

docs/TODO.md

@@ -624,6 +624,8 @@ smoke test.
   by the serving dnsmasq — drop the hardcoded `192.168.50.10`.
 - **Signing:** wire `sb_key`/`sb_cert` (CI/HSM secrets) for a signed UKI; enable
   Secure Boot on targets. Until then the loud unsigned warning must stay.
+  **Key generation + enrolment procedure: [secure-boot-keys.md](secure-boot-keys.md)**
+  (the PK/KEK/db trio; `db` = `sb_key`/`sb_cert`, PK/KEK stay offline).
 - **Bench-verify on the secure path** (swtpm + hostapd + FreeRADIUS,
   `disable_dot1x=false`) — the items deferred this session:
   - NM port secure path: `en*` UNMANAGED + `macsec0` MANAGED/renewing, MKA
@@ -687,3 +689,58 @@ Tips the balance toward "do it" only if: we start managing the **serving hosts**
 roles to amortise — currently they're docker-compose), provisioning grows much
 more branchy, or we want molecule-tested hardening roles validated without a
 full ~17-min Packer build.
+
+## [ ] 10. (OPTIONAL) Secure Boot cert auto-enrollment for provisioning
+
+Speed up bringing up new workstations: bake the **public** PK/KEK/db certs into an
+image, detect Secure Boot **Setup Mode** at boot, and auto-enroll them with
+efitools (`efi-updatevar`/`KeyTool`) so a fresh/reset box adopts the fleet trust
+root without a manual firmware-setup visit. Pairs with #8 (signing) +
+[secure-boot-keys.md](secure-boot-keys.md).
+
+**What's safe:** the certs are public (no key material — only the **db** private
+key signs, and it stays in CI/HSM, invariant #7); Setup Mode accepts
+*unauthenticated* writes to PK/KEK/db, so public certs (ESL) are sufficient. It's
+fleet-generic (no per-host state, invariant #1) and deterministic (reproducible
+verity hash).
+
+**The real risk — provisioning-time TOFU (trust-on-first-use):** in Setup Mode
+Secure Boot isn't enforcing, so the enroller runs as *unverified* code, and the
+fleet's UEFI **HTTP boot is unauthenticated** in that state. An on-path attacker
+during provisioning can serve a malicious image that enrolls **their** PK/KEK/db —
+the box then "has Secure Boot" but trusts the attacker. Auto-enroll is only as
+trustworthy as the provisioning channel, and it removes the physical-presence
+approval gate. So treat it as a controlled-environment provisioning step, not an
+always-on behaviour.
+
+**Optional separate provisioning UKI (preferred shape):** build a dedicated
+**provisioning UKI** that carries the certs + the enroll logic, instead of arming
+the enroller in the production image. Keeps the standing footgun out of the normal
+image (a factory reset + tampered image can't silently re-root trust), and lets
+the enroller be a one-shot, attended/isolated step. The production UKI never
+enrolls.
+  - Build it as a separate Packer target / flag (e.g. `provisioning=true`) →
+    its own small UKI; signed or unsigned (it runs in Setup Mode anyway, but sign
+    it so it *also* boots once keys are enrolled / for re-runs).
+  - Or a tiny standalone EFI tool (KeyTool-style) served alongside, not a full OS.
+
+**Mitigations (do these regardless of UKI vs separate UKI):**
+  - Run provisioning on a **trusted, isolated VLAN** (or a physically controlled
+    bench) — the integrity Setup Mode can't give must come from the environment.
+  - **Gate** enrollment behind an explicit provisioning mode / one-shot token;
+    never arm it on every boot of the production image.
+  - **Read-back verify before declaring success:** `efi-readvar` the enrolled
+    PK/KEK/db and compare fingerprints to the values baked in; mismatch = fail
+    loudly (turns silent TOFU into tamper-evidence).
+  - **Audit** the enrollment event + read-back fingerprints to the collector.
+  - **Keep the Microsoft UEFI CA in `db`** (or enroll your db alongside it) unless
+    every NIC/GPU option ROM is covered by your keys — clearing MS db can break
+    signed **option ROMs** (NIC PXE/HTTP-boot, GPU init), bricking the boot path.
+  - **PCR 7 check:** enrollment changes the Secure Boot measurement in PCR 7;
+    confirm nothing the fleet seals to the TPM (the EAP-TLS key at `0x81010001`,
+    NV cert) is PCR-7-policy-bound before relying on this.
+
+**Decision before building:** auto-enroll trades assurance for convenience and is
+reasonable for a controlled fleet; the highest-assurance path is attended/firmware
+or manufacturer pre-provisioning. Default recommendation: **separate provisioning
+UKI + isolated VLAN + read-back verify.**