* Package name     : qemu-ovmf-secureboot
  Version          : 1
  Upstream Authors : Patrick Uiterwijk, Kashyap Chamarthy
* URL              : https://github.com/puiterwijk/qemu-ovmf-secureboot/
* License          : MIT
  Description      : Tool to enroll UEFI keys for Secure Boot

QOSB (QEMU OVMF Secure Boot) is a small Python tool which can enroll
default UEFI keys into an OVMF variables ("VARS") file, to enforce
Secure Boot.

The package consists of two files:

(1) The tool itself:
    <https://github.com/puiterwijk/qemu-ovmf-secureboot/blob/master/ovmf-vars-generator>

(2) And a README:
    <https://github.com/puiterwijk/qemu-ovmf-secureboot/blob/master/README.md>

    - - -

Additional Info: On Fedora, 'qemu-ovmf-secureboot' is packaged as a
sub-RPM (called: "edk2-qosb") of "edk2".

This script is currently shipped in the edk2 source package in Ubuntu,
where it is used to pre-gen VARS images w/ Microsoft's keys pre-baked.
I plan to merge this delta into Debian soon after buster releases.
However, that will still not make it available to end users who may
want to generate images with their own keys pre-baked. Adding a new
deb to the distro isn't free, so I'd be interested in knowing if
there's a significant number of people who have that need and would
use this package to fulfill it.

Now, assuming we do have the users, what would be the best way to package it?

To make it apt-installable, I think we'd end up needing a new binary
package. Since presumably it could be useful for users of any of the
existing binary packages, we wouldn't want to just e.g. ship it in
ovmf. We could make edk2 build that new package, but I personally
don't like the idea of bundling out of tree source that is not tightly
coupled. If we take the hit and create a new deb, I'd lean towards
also keeping it in its own source package, and replace edk2's
(soon-to-be) bundled version w/ a build-dep on the new binary.

Hi Adrian,

Dann is looking into this in #927414 - let'c sontinue the discussion
there maybe?

fyi, we are now distributing qemu-ovmf-secureboot as a supplementary
orig tarball for edk2 so that we can use it to build secureboot ovmf
images. It is still not provided in a binary package though.

  -dann