Only run systemd-keyutil if secure boot key and cert exist

diff --git a/mkosi/__init__.py b/mkosi/__init__.py
index 56cb876ed8eea5698d94136f0bbc01b8a3d0ba47..83d1355decaad30827c00aa3617474829e167362 100644 (file)
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -4265,7 +4265,12 @@ def validate_certificates_and_keys(config: Config) -> None:
             stdout=subprocess.DEVNULL,
         )
 
-    if config.bootable != ConfigFeature.disabled and config.secure_boot:
+    if (
+        config.bootable != ConfigFeature.disabled
+        and config.secure_boot
+        and config.secure_boot_certificate
+        and config.secure_boot_key
+    ):
         run_systemd_sign_tool(
             config,
             cmdline=[keyutil, "validate"],