#!/usr/bin/env bash

signfile(){
if ! sbverify --cert "/boot/key/MOK.crt" "$1" &>/dev/null; then
sbsign --key "/boot/key/MOK.key" --cert "/boot/key/MOK.crt" --output "$1" "$1"
}

find /boot -type d | while read -r dir; do
    signfile "$dir"
done