class roles::signing {
	package { 'expect': ensure => installed, }
	package { 'pesign': ensure => installed, }
	package { 'linux-kbuild-4.9': ensure => installed, }
	package { 'libengine-pkcs11-openssl': ensure => installed, }

	file { '/usr/local/bin/pesign-wrap':
		ensure => absent,
	}

	file { '/usr/local/bin/secure-boot-code-sign':
		ensure => absent,
	}
}