Fix condition to also check the certificate source type

diff --git a/mkosi/bootloader.py b/mkosi/bootloader.py
index a11e3aeb432ab7324174049bfea165df2d773e6f..76dc6ecc219573fc685a9f9330813c2db0be7615 100644 (file)
--- a/mkosi/bootloader.py
+++ b/mkosi/bootloader.py
@@ -500,7 +500,11 @@ def run_systemd_sign_tool(
         sandbox=config.sandbox(
             binary=cmd[0],
             options=opt,
-            devices=devices or key_source.type != KeySourceType.file,
+            devices=(
+                devices
+                or key_source.type != KeySourceType.file
+                or certificate_source.type != CertificateSourceType.file
+            ),
         ),
     )