At the moment I need to disable secure boot, enroll the key with mokutil and then reenable secure boot. I was wondering if there was a way to make the installer call mokutil with the key in the image. Of course this does not prevent a user from forgetting to do this and needing to disable secure boot.

message has been deleted

This is with the iso generation from bluebuild specifically

There are some args on the

generate-iso

subcommand that should allow you to specify the key and enrollment password to use. They are

--secure-boot-url

and

--enrollment-password

. They currently default to use the ublue key and password. This is a legacy hold-over and hasn't been updated. I've got some new ISO changes in the works that will be changing how that works, but it might be a bit before they make it to a release