Some manufacturer implementations of secure boot only look at the first signature on an EFI payload, which can cause a binary that was already signed, before sbctl signed it a second time, to still fail secure boot validation. I feel it would be worth at least throwing a warning or error during file enrollment into sbctl's list of signed files, if a file already has an existing secure boot signature.
Maybe even include an option to strip any existing secure boot signatures from an efi payload before sbctl signs/re-signs it?
Some manufacturer implementations of secure boot only look at the first signature on an EFI payload, which can cause a binary that was already signed, before sbctl signed it a second time, to still fail secure boot validation. I feel it would be worth at least throwing a warning or error during file enrollment into sbctl's list of signed files, if a file already has an existing secure boot signature.
Maybe even include an option to strip any existing secure boot signatures from an efi payload before sbctl signs/re-signs it?