Should /var/lib/sbctl be used in place of /etc/secureboot ?

[matdibu]

I got this warning while using sbctl on a system with lanzaboote

old configuration detected. Please use `sbctl setup --migrate`

and while trying to migrate, I borked it

I found this while trying to understand what it means:

• https://github.com/Foxboron/sbctl/blob/cd6dd1c6a02f5b4b3b93669e78671b656ddcfe67/docs/sbctl.8.txt#L281
• https://github.com/Foxboron/sbctl/blob/cd6dd1c6a02f5b4b3b93669e78671b656ddcfe67/cmd/sbctl/setup.go#L155

[RaitoBezarius]

Yes, since the newest version of sbctl, we should release a new version of lanzaboote that makes use of the newer directory and migrate the users.

[matdibu]

so simply setting

boot.lanzaboote.pkiBundle = "/var/lib/sbctl";

isn't enough?

[matdibu]

I messed up some unrelated things while changing the config, but in the end it seems to work fine with that pkiBundle path

[matdibu]

as a note: I'm pretty sure the migration failed because I am using impermanence, so /etc/secureboot was a mount, so it couldn't unlink it

[Arbel-arad]

so simply setting

boot.lanzaboote.pkiBundle = "/var/lib/sbctl";

isn't enough?

this worked for me with a normal filesystem.
migration worked fine as well.

after looking at it, maybe backing up the pkiBundle is a good idea......