environment/bin/recipes/edk2/notes.md

That error means your WORKSPACE points to a different edk2 tree:

/Users/artur/.dat/bin/recipes/edk2/edk2

so build is looking for ShellPkg/.../KeyTool.inf there, not in ~/projs/edk2.

Fix by resetting your env and sourcing edksetup.sh from the repo you actually want to build.

Do this exactly

# 0) Go to the edk2 you want to use
cd ~/projs/edk2
git rev-parse --show-toplevel   # should print /Users/artur/projs/edk2

# 1) Clear any stale EDK2 env from previous shells
unset WORKSPACE EDK_TOOLS_PATH PACKAGES_PATH

# 2) Rebuild BaseTools (with your LLVM/lld PATH still set like earlier)
make -C BaseTools -j

# 3) Reset Conf inside THIS tree and re-source
rm -f Conf/target.txt Conf/tools_def.txt
source ./edksetup.sh

# Sanity checks — these must point into ~/projs/edk2
echo "WORKSPACE=$WORKSPACE"
echo "EDK_TOOLS_PATH=$EDK_TOOLS_PATH"
test -f "$WORKSPACE/ShellPkg/Application/KeyTools/KeyTool/KeyTool.inf" && echo "KeyTool found"

# 4) Build KeyTool for AArch64 with clang/lld
build -a AARCH64 -t CLANGDWARF \
      -p ShellPkg/ShellPkg.dsc \
      -m ShellPkg/Application/KeyTools/KeyTool/KeyTool.inf \
      -b RELEASE

If you still see it picking the wrong path

You probably have these variables exported in your shell config. Force them for this shell:

export WORKSPACE="$PWD"
export EDK_TOOLS_PATH="$WORKSPACE/BaseTools"
export PACKAGES_PATH="$WORKSPACE"
source ./edksetup.sh

Then re-run the build command above.

Where the binary will land

Typical output path (adjust for your build target):

Build/Shell/RELEASE_CLANGDWARF/AARCH64/ShellPkg/Application/KeyTools/KeyTool/KeyTool/OUTPUT/KeyTool.efi

Once you’ve got KeyTool.efi, mount it along with your kek2023.cer and db2023.cer, enroll PK → KEK → db, reboot into the firmware UI, and enable Secure Boot.