sbupdate.conf

#!/hint/bash

# General settings
#
# KEY_DIR              Directory containing Secure Boot private keys
# UKI_DIR              Directory to store resulting UKIs (relative to boot partition)
# SPLASH               Splash BMP file (picture to display during boot)
# BACKUP               Whether to backup the old UKIs
# EXTRA_SIGN           An associative array of additional files to sign
# UKIFY_EXTRA          Extra arguments to pass to ukify(1)

KEY_DIR="/etc/efi-keys"
UKI_DIR="/EFI/Linux"
SPLASH="/usr/share/systemd/bootctl/splash-arch.bmp"
BACKUP=1
#EXTRA_SIGN=(["/usr/lib/systemd/boot/efi/systemd-bootx64.efi"]="/usr/lib/systemd/boot/efi/systemd-bootx64.efi.signed"
#            ["/usr/lib/fwupd/efi/fwupdx64.efi"]="/usr/lib/fwupd/efi/fwupdx64.efi.signed")
#UKIFY_EXTRA=()

# Generic kernel settings
#
# UKI_SUFFIX           Name suffix for the resulting UKI
# MICROCODES           Microcodes to bundle into UKI for early loading
# CMDLINE_DEFAULT      Default kernel command line to use if not set per-kernel
# CMDLINE_ALWAYS       Kernel command line appended unconditionally

UKI_SUFFIX="-signed.efi"
MICROCODES=(/boot/*-ucode.img)
#CMDLINE_DEFAULT="quiet"
#CMDLINE_ALWAYS="rw root= rootflags="

# Per-kernel settings
#
# KERNELS              Kernel image names to generate UKI for ("vmlinuz-" can be omitted)
#
# Note that '-' needs to be replaced by '_' for kernel[*] settings
#
# kernel[cmdline]      Kernel command line to use for the specific kernel
# kernel[uki]          Name for the resulting UKI (overrides UKI_SUFFIX)
# kernel[uki-fallback] Name for the resulting fallback UKI (unset/empty to disable)
#
# Example config
#
#KERNELS=("linux" "linux-zen" "linux-pf")
#
#linux_pf=([cmdline]="quiet loglevel=3"
#          [uki]="linux-pf-test.efi")
#linux=([uki]="linux.efi"
#       [uki-fallback]="linux-fallback.efi")