So, after compiling and running mokutil from upstream source and running it, the Fedora RPM command also oddly started working. I did not
sudo make install and
rpm -V mokutil returns empty. I also removed the two build deps I installed (efivar-devel keyutils-libs-devel) and it still works.
In order to rule out a random fluke on my laptop, I ran
sudo mokutil --bs-state on another f36 laptop and it returned the original error and usage instead of the secureboot status. It working after compiling it locally as a non-root user without make install makes no sense to me, but I can reproduce it on multiple f36 machines of different brands.
I'm guessing it's related to the recent usage patch. Seems to work fine compiled from scratch against upstream.
src]$ sudo ./mokutil --sb-state
src]$ sudo ./mokutil -s
mokutil OPTIONS [ARGS...]
--help Show help
--list-enrolled List the enrolled keys
$ sudo mokutil -s Aborted
$ sudo mokutil --sb-state mokutil: unrecognized option '--sb-state' Usage: mokutil OPTIONS [ARGS...] ...
$ rpm -q mokutil mokutil-0.6.0-2.fc36.x86_64
Applied to my Nextcloud server and verified that it all seems to basically be working including http/2 and a mod_proxy service.