I add repo with anbox module to my system. I create my own certificate, add key to efi, but must sign kernel module every time of updating anbox modules or kernel. I do not want to perform any security risk, so signing automatically is not the case.
Ideally would be install maintainer (rpm) certificate to efi and that’s all. What could I do?
PS: I use sign-file script with path to key, module, etc. given as parameters. I must copy certificate from my Plasma Vault before doing anything and remove duplicated files outside my Vault after entire operation done. It is quite complicated.