reports
keys
# Throwaway USBGuard mass-storage test image (see the USBGuard verify steps)
/usbguard-test.img

# Secure Boot enrollment material baked into the image. The *.auth are PUBLIC but
# environment-specific, so keep the repo neutral: supply via CI secrets
# (SB_*_AUTH_B64) or `git add -f` if you choose to commit them. Keep README/.gitkeep.
/files/secureboot/keys/*.auth
/files/secureboot/keys/*.esl
/files/secureboot/keys/*.crt

# iPXE network bootloader binaries for the PXE fallback (serving/tftp). Binary,
# and the signed one is db-derived/environment-specific — supply per environment.
#/serving/tftp/*.efi
/serving/tftp/*.kpxe