Security violation for <generation>.efi file

[m1dugh]

After having followed the quickstart process, and having supposedly enrolled keys, when I reboot, I have an error message saying that
/boot/EFI/Linux/nixos-generation-108-uugqqsnypolsg3gy35ecpb2dj6yo4wjpl35blxuikshjzfpalc6q.efi is not signed.

Here is the output of sbctl verify

Verifying file database and EFI images in /boot...
✓ /boot/EFI/Linux/nixos-generation-108-uugqqsnypolsg3gy35ecpb2dj6yo4wjpl35blxuikshjzfpalc6q.efi is signed
✓ /boot/EFI/nixos/kernel-6.12.33-z26kwwculspjifhefltdqj4tfagvijytoijr2cslgtitxiergqfa.efi is signed
✓ /boot/EFI/BOOT/BOOTX64.EFI is signed
✓ /boot/EFI/Linux/nixos-generation-100-5b52j6z3avrlmewqecbzkcwp4qz2zohj4wma66vencl2vi7zvefq.efi is signed
✓ /boot/EFI/Linux/nixos-generation-101-uswo3xxj6d7mqkw6goyybhaiiqxmhkfhdk46e6uai4ranonbd2na.efi is signed
✓ /boot/EFI/Linux/nixos-generation-102-k23rxlem4jqxgn6xnclizbazphdephew3xapfji6lu6pqym3b76q.efi is signed
✓ /boot/EFI/Linux/nixos-generation-103-tbm5x4yggj3bx4ghbghyu73eepfyvccmkueqzyvogssij5te5oja.efi is signed
✓ /boot/EFI/Linux/nixos-generation-104-d2dfkxhjovscjegic3n66qlzqfurroe3e6szipjzujkmbfmid5ya.efi is signed
✓ /boot/EFI/Linux/nixos-generation-105-vqa4kktal75mneb57ka3ucdewsl3wvihbm376le6tguthjzd6mmq.efi is signed
✓ /boot/EFI/Linux/nixos-generation-106-uugqqsnypolsg3gy35ecpb2dj6yo4wjpl35blxuikshjzfpalc6q.efi is signed
✓ /boot/EFI/Linux/nixos-generation-107-lczgk2g2ajjkvurve3qrfwuyjbzuickz6dxfwi74jesitsq5vqfq.efi is signed
✓ /boot/EFI/Linux/nixos-generation-97-ukbuyufabrgdxjkjge2hztrikivikdv5kbrfruljx4g5mdjoahla.efi is signed
✓ /boot/EFI/Linux/nixos-generation-98-o5hkpvhvmttssatzzmryryqihba2lkfqrqyxpqgxb6jpyaar75pa.efi is signed
✓ /boot/EFI/Linux/nixos-generation-99-ub2dadahftkk5siyod4ev3wu6654r22r75ah73kvighpipn6ngeq.efi is signed
failed to verify file /boot/EFI/nixos/initrd-6.12.33-5p77qk2td3gpczsjqtpbvlmvpq7bilh7tcri2r445nnh6hciuvaa.efi: /boot/EFI/nixos/initrd-6.12.33-5p77qk2td3gpczsjqtpbvlmvpq7bilh7tcri2r445nnh6hciuvaa.efi: invalid pe header
failed to verify file /boot/EFI/nixos/initrd-6.12.33-de5jqzmosmmrgonvkgs4agxpxd7qqjyac5ahqbiqghlidpbld2ba.efi: /boot/EFI/nixos/initrd-6.12.33-de5jqzmosmmrgonvkgs4agxpxd7qqjyac5ahqbiqghlidpbld2ba.efi: invalid pe header
✓ /boot/EFI/systemd/systemd-bootx64.efi is signed
failed to verify file /boot/loader/entries/nixos-generation-100.conf: /boot/loader/entries/nixos-generation-100.conf: invalid pe header
failed to verify file /boot/loader/entries/nixos-generation-101.conf: /boot/loader/entries/nixos-generation-101.conf: invalid pe header
failed to verify file /boot/loader/entries/nixos-generation-102.conf: /boot/loader/entries/nixos-generation-102.conf: invalid pe header
failed to verify file /boot/loader/entries/nixos-generation-103.conf: /boot/loader/entries/nixos-generation-103.conf: invalid pe header
failed to verify file /boot/loader/entries/nixos-generation-104.conf: /boot/loader/entries/nixos-generation-104.conf: invalid pe header
failed to verify file /boot/loader/entries/nixos-generation-97.conf: /boot/loader/entries/nixos-generation-97.conf: invalid pe header
failed to verify file /boot/loader/entries/nixos-generation-98.conf: /boot/loader/entries/nixos-generation-98.conf: invalid pe header
failed to verify file /boot/loader/entries/nixos-generation-99.conf: /boot/loader/entries/nixos-generation-99.conf: invalid pe header
failed to verify file /boot/loader/entries.srel: /boot/loader/entries.srel: invalid pe header
failed to verify file /boot/loader/loader.conf: /boot/loader/loader.conf: invalid pe header
failed to verify file /boot/loader/random-seed: /boot/loader/random-seed: invalid pe header

And if I try to manually sign the generation-108 file, I get the following result :

File has already been signed /boot/EFI/Linux/nixos-generation-108-uugqqsnypolsg3gy35ecpb2dj6yo4wjpl35blxuikshjzfpalc6q.efi

I am running MSI Laptop GS65 stealth 9SF.

Thanks for any help !

[m1dugh]

I am not sure however that my enroll-keys operation worked correctly.

Here is the output of sbctl status

Installed:	✓ sbctl is installed
Owner GUID:	bf6c4ce3-236f-407d-98b9-46bec17fcf88
Setup Mode:	✓ Disabled
Secure Boot:	✗ Disabled
Vendor Keys:	microsoft

The Vendor Keys: microsoft looks like it is missing something

[blitz]

Hey! Yes, this sounds like your keys might not be properly enrolled. How did you do it? The only thing that should be specific to your laptop is how to enter Setup Mode. There is this documentation, but things might look a bit different for you:

https://github.com/nix-community/lanzaboote/blob/master/docs/QUICK_START.md#entering-secure-boot-setup-mode

[m1dugh]

To enroll keys, I entered setup mode which is working fine, and then run sudo sbctl enroll-keys --microsoft, but it shows vendor keys: microsoft only and not local indexed-db.

[m1dugh]

As a precision, I load an out-of-tree kernel module, this might come into play.