nx_efivars_enrol.nx

nx_efivars_enrol.nx -- F103e RUNG 11b: enrol OUR key into a UEFI variable store. The last software rung. Builds an EFI_SIGNATURE_LIST around our self-signed cert and writes PK, KEK and db into a varstore derived from the EMPTY (setup-mode) OVMF varstore. Booting secboot firmware against it should put the machine in USER MODE with OUR key as the authority -- so the decisive test is a PAIR: our SIGNED image accepted, an UNSIGNED image refused. Either alone proves nothing (a varstore that failed to load would accept both; a broken one would refuse both). ★★★★★★EVERY CONSTANT IS TAKEN FROM THE ARTIFACT, NOT FROM MEMORY. `OVMF_VARS_4M.ms.fd` has PK/KEK/db already enrolled, so the vendor GUIDs, the attribute word, and even EFI_CERT_X509_GUID (which is literally the first 16 bytes of the real `db` data) are READ OUT OF IT. Writing a UEFI GUID from recall is a fabricated constant, and a wrong one here fails in a way that looks like "Secure Boot just doesn't like us". EFI_SIGNATURE_LIST: SignatureType[16] | SignatureListSize[4] | SignatureHeaderSize[4] | SignatureSize[4] | (header) | { SignatureOwner[16] | SignatureData[] }... Usage: nx_efivars_enrol build <empty_vars.fd> <ms_vars.fd> <out_vars.fd> nx_efivars_enrol selftest <empty_vars.fd> <ms_vars.fd> Exit: 0 GREEN | 1 RED | 3 UNPROVEN. license_tier: ORIGINAL