Comment # 20 on bug 1201066 from Joey Lee

How about change the kernel scripts? To avoid the "255" return value to expose:

suse-module-tools/kernel-scriptlets/cert-script
...
        # XXX: Only call mokutil if UEFI and shim are used
        for cert in $certs; do
            cert="/etc/uefi/certs/${cert}.crt"
            run_mokutil --import "$cert" --root-pw ${MOK_ARGS}
            rc=$?
            if [ $rc != 0 ] ; then
                script_rc=$rc                 # hide 255 here?
                echo "Failed to import $cert" >&2
            fi
        done