Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »
© Red Hat, Inc. and others.
This introduces a sub-handler for sign_pe that uses keys via PKCS11 in order to support HSMs (a requirement, it seems, for keys embedded in shim for SecureBoot).
The database migration adds the PKCS11 key type to the enumeration, and there's a script to add new keys to the database that are in the PKCS11 token. Key creation is left as an exercise to the reader, but an example using softhsm can be found at https://github.com/fedora-infra/siguldry/blob/sigul-pesign-bridge-0.3.1/devel/setup_hsm.sh