Verification does not use input PK/KEK

[Legrandin]

The current verification step downloads the Fedora 27 kernel and checks if it executes when Secure Boot is on.
Such kernel is signed with a Red Hat KEK (CN = "Fedora Secure Boot Signer").

Instead, the test should check that a kernel signed with the input key (whose certificate is passed with --oem-string) runs, because the purpose of EnrollDefaultKeys.efi is to set PK and the first KEK with the user's key.

As a matter of fact, I am a bit surprised that the Fedora 27 kernel (signed by Red Hat) boots at all.
That should not be happening, right? For the record, I am using EnrollDefaultKeys.efi from Fedora 33.

[Legrandin]

To be clear, the EnrollDefaultKeys.efi I am using does expect the user PK/KEK cert in SMBIOS. If you don't pass it, it fails with:

OUT: b'error: OEM String with app prefix 4E32566D-8E9E-4F52-81D3-5BB9715F9727 not found: Not Found\r\n'

[nlgranger]

@Legrandin did you find a workaround for this?

[Legrandin]

No, I did not.
I recall I gave up on qemu-ovmf-secureboot.

[nlgranger]

Too bad but thanks for letting me know.