(In reply to Guillaume GARDET from comment #8) > As only ARM and x86* have CONFIG_EFI_STUB=y, ppc64 and s390x will not be > signed anyway. Do you need explicit %ifarch to disable signing for ppc64 and > s390x? Or CONFIG_EFI_STUB=y condition is enough? CONFIG_EFI_STUB=y condition should be fine