...
$ sbsign --key DB.key --cert DB.crt --output EmptyApplication-Riscv.efi.signed EmptyApplication-Riscv.efi
This will have Invalid PE header magic issue if use the default sbsign in ubuntu 22.04, need rebuild the sbsigntools, refer the Step 3 to solve this issue ! If no Invalid PE header magic then skip Step 3.
Step 3 (Optional): Download and rebuild the latest sbsigntools
...
$ git clone https://github.com/rustyrussell/ccan.git lib/ccan.git
$ git submodule init
$ git submodule update
$ sudo apt-get install binutils-dev gnu-efi help2man
$ ./autogen.sh
$ ./configure
$ make
Step 4: Sign the EFI applicaiton by using private key, and copy the public key to the fat disk$ cd ../
$ ./sbsigntools/src/sbsign --key DB.key --cert DB.crt --output EmptyApplication-Riscv.efi.signed EmptyApplication-Riscv.efi
Step 4: Sign the EFI applicaiton by using private key, and copy the public key to the fat disk
$ cp EmptyApplication.efi.signed ~/src/fat/
...