From 1754636c3f493bd951d62614846b938b07d79c23 Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Thu, 14 May 2026 17:26:39 -0400 Subject: [PATCH] Add sample material for nodeconsole automation for MOK manipulation --- misc/secureboot/deletemok.nca | 13 +++++++++++++ misc/secureboot/enrollmok.nca | 13 +++++++++++++ misc/secureboot/purgemok.sh | 12 ++++++++++++ misc/secureboot/pushmok.sh | 12 ++++++++++++ 4 files changed, 50 insertions(+) create mode 100644 misc/secureboot/deletemok.nca create mode 100644 misc/secureboot/enrollmok.nca create mode 100755 misc/secureboot/purgemok.sh create mode 100755 misc/secureboot/pushmok.sh diff --git a/misc/secureboot/deletemok.nca b/misc/secureboot/deletemok.nca new file mode 100644 index 00000000..6c0a8be1 --- /dev/null +++ b/misc/secureboot/deletemok.nca @@ -0,0 +1,13 @@ +expect Press any key to perform MOK management +send a +expect Delete MOK +send +expect Continue +send +expect Yes +send +expect Password: +send +expect Reboot +send +exit diff --git a/misc/secureboot/enrollmok.nca b/misc/secureboot/enrollmok.nca new file mode 100644 index 00000000..e834c7cb --- /dev/null +++ b/misc/secureboot/enrollmok.nca @@ -0,0 +1,13 @@ +expect Press any key to perform MOK management +send a +expect Enroll MOK +send +expect Continue +send +expect Yes +send +expect Password: +send +expect Reboot +send +exit diff --git a/misc/secureboot/purgemok.sh b/misc/secureboot/purgemok.sh new file mode 100755 index 00000000..cd657850 --- /dev/null +++ b/misc/secureboot/purgemok.sh @@ -0,0 +1,12 @@ +#!/bin/bash +if [ -z "$MOKPASS" ]; then + echo "MOKPASS must be set to proceed" + exit 1 +fi +set -euo pipefail +node=$2 +file=$1 +nodersync $file $node:/tmp/ +ssh $node mokutil --delete /tmp/$file --root-pw +ssh $node reboot +nodeconsole $node -ea deletemok.nca diff --git a/misc/secureboot/pushmok.sh b/misc/secureboot/pushmok.sh new file mode 100755 index 00000000..d8708ae5 --- /dev/null +++ b/misc/secureboot/pushmok.sh @@ -0,0 +1,12 @@ +#!/bin/bash +if [ -z "$MOKPASS" ]; then + echo "MOKPASS must be set to proceed" + exit 1 +fi +set -euo pipefail +node=$2 +file=$1 +nodersync $file $node:/tmp/ +ssh $node mokutil --import /tmp/$file --root-pw +ssh $node reboot +nodeconsole $node -ea enrollmok.nca