kernel-6.12.0-257.el10 pulled in RHEL-169468, which replaced the static
%define pesign_name_0 blocks with the runtime get_pesign_name() helper.
The auto-fix in 4e06176 dropped the two AlmaLinux replace rules that
targeted those blocks without adding a replacement, so pesign_name_0 is
now resolved at build time.
That resolution cannot work on AlmaLinux: get_pesign_name() looks for a
distro-named cert with matching content next to the generic
secureboot-*.cer files (CentOS ships centossecureboot801.cer), and
almalinux-sb-certs installs only the generic names. It therefore falls
back to "secureboot-kernel-<arch>", which the sign node does not know,
and rpm-sign exits non-zero in %build.
Pin the key name again at the new call sites, for both the kernel image
and the UKI. Fixes SecureBoot signing on x86_64, x86_64_v2, aarch64,
ppc64le and s390x (build 75517, build 74402).
dccff92d14