Add Vendor Keys

[YouROK]

Good afternoon, I have an armv8 board, where I can build and flash edk2. I need to add keys when building, but I do not understand how this can be done. If I add keys through the uefi menu, then everything works, but I need the keys to be already included in the build. How to do it?

[YouROK]

I am build Enroll Default Keys efi app. When I run it show:
info: SetupMode=1 SecureBoot=0 SecureBootEnable=0 CustomMode=1 VendorKeys=1
error: OEM String with app prefix 4E32566D-8E9E-4F52-81D3-5BB9715F9727 not found: Not Found

edk2 in sdk board is too old, I view in last edk2 EnrollFromDefaultKeysApp. I transfer some lib from new edk2 to my sdk and make little app with enroll my keys

#include <Guid/AuthenticatedVariableFormat.h>    // gEfiCustomModeEnableGuid
#include <Guid/GlobalVariable.h>                 // EFI_SETUP_MODE_NAME
#include <Guid/ImageAuthentication.h>            // EFI_IMAGE_SECURITY_DATABASE
#include <Library/BaseLib.h>                     // GUID_STRING_LENGTH
#include <Library/BaseMemoryLib.h>               // CopyGuid()
#include <Library/DebugLib.h>                    // ASSERT()
#include <Library/MemoryAllocationLib.h>         // FreePool()
#include <Library/PrintLib.h>                    // AsciiSPrint()
#include <Library/UefiBootServicesTableLib.h>    // gBS
#include <Library/UefiLib.h>                     // AsciiPrint()
#include <Library/UefiRuntimeServicesTableLib.h> // gRT
#include <Uefi/UefiMultiPhase.h>
#include <UefiSecureBoot.h>
#include <Library/SecureBootVariableLib.h>
#include <Library/SecureBootVariableProvisionLib.h>

#include "EnrollMyKeys.h"

EFI_STATUS
EFIAPI
EnrollMyKeys (
  IN EFI_HANDLE        ImageHandle,
  IN EFI_SYSTEM_TABLE  *SystemTable
  )
{
  EFI_STATUS                Status;
  VOID        *Data;
  UINTN       DataSize;
  
  DEBUG ((DEBUG_ERROR, "%a - Start enroll my keys!\n", __FUNCTION__));

  if (IsSecureBootEnabled ()) {
    DEBUG ((DEBUG_ERROR, "%a - Cannot set default keys while SecureBoot is enabled!\n", __FUNCTION__));
    AsciiPrint ("Cannot set default keys while SecureBoot is enabled!");
    return EFI_ABORTED;
  }

  Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
  if (EFI_ERROR (Status)) {
    AsciiPrint ("Cannot set SetSecureBootMode CUSTOM_SECURE_BOOT_MODE");
  }

  Data     = (VOID *)ISK_crt;
  DataSize = ISK_crt_len;
  Status   = EnrollFromInput (
                EFI_IMAGE_SECURITY_DATABASE,
                &gEfiImageSecurityDatabaseGuid,
                DataSize,
                Data
                );
  if (EFI_ERROR (Status)) {
    DEBUG ((DEBUG_ERROR, "%a - Failed to enroll DB %r!\n", __FUNCTION__, Status));
    AsciiPrint ("Failed to enroll DB: %r!\n",Status);
  }

  if (!EFI_ERROR (Status)) {
    Data     = (UINT8 *)KEK_crt;
    DataSize = KEK_crt_len;
    Status   = EnrollFromInput (
                 EFI_KEY_EXCHANGE_KEY_NAME,
                 &gEfiGlobalVariableGuid,
                 DataSize,
                 Data
                 );
    if (EFI_ERROR (Status)) {
      DEBUG ((DEBUG_ERROR, "%a - Failed to enroll KEK %r!\n", __FUNCTION__, Status));
      AsciiPrint ("Failed to enroll KEK: %r!\n",Status);
    }
  }

  if (!EFI_ERROR (Status)) {
    Data     = (UINT8 *)PK_crt;
    DataSize = PK_crt_len;
    Status   = EnrollFromInput (
                 EFI_PLATFORM_KEY_NAME,
                 &gEfiGlobalVariableGuid,
                 DataSize,
                 Data
                 );

    if (EFI_ERROR (Status)) {
      DEBUG ((DEBUG_ERROR, "%a - Failed to update the PK! - %r\n", __FUNCTION__, Status));
      AsciiPrint ("Failed to enroll PK: %r!\n",Status);
      Status = EFI_SECURITY_VIOLATION;
    }
  }

  return Status;
}

And this show error: Failed to init DB: Invalid Parameter!