sbattach

sbattach --attach <sigfile> <efi-boot-image>
sbattach --detach <sigfile> [--remove] <efi-boot-image>
sbattach --remove <efi-boot-image>

Attach or detach a signature file to/from a boot image

--attach <sigfile>

set <sigfile> as the boot image's signature table

--detach <sigfile>

copy the boot image's signature table to <sigfile>

--remove

remove the boot image's signature table from the original file

--signum

signature to operate on (defaults to first)