sbupdate.conf

# Configuration file for sbupdate
#
# Commented-out variables show default values.

# Common settings
#
# KEY_DIR          Directory with the custom Secure Boot keys
# ESP_DIR          EFI System Partition location
# OUT_DIR          Relative path on ESP for signed kernel images
# SPLASH           Splash image file. Use "/dev/null" to disable splash.
# BACKUP           Whether to back up old signed kernel images
# EXTRA_SIGN       An array of additional files to sign
# CMDLINE_DEFAULT  Default kernel command line (REQUIRED)

KEY_DIR="/crypt/sb"
ESP_DIR="/efi"
OUT_DIR="EFI/_distroname_"
SPLASH="/dev/null"
BACKUP=0
EXTRA_SIGN=("/efi/EFI/_distroname_/grubx64.efi" "/efi/EFI/_distroname_/KeyTool.efi")
CMDLINE_DEFAULT="_cmdline_"

# Per-kernel configuration
#
# For each kernel <NAME> the following optional settings may be added:
#
#   CMDLINE[<NAME>]="..."  # Alternative kernel command line
#                          # Default value: ${CMDLINE_DEFAULT}
#   INITRD[<NAME>]="..."   # Alternative initramfs file
#                          # Default value: /boot/initramfs-<NAME>.img
#
# Each kernel can be mapped to multiple configs using the CONFIGS
# variable, in which case CMDLINE and INITRD are set per config.
#
# Examples:
#   CMDLINE["linux-lts"]="custom command line"
#   INITRD["linux-lts"]="/boot/initramfs-linux-custom.img"
#
#   # Generates variants with default and fallback initramfs
#   CONFIGS["linux"]="linux linux-fallback"
#
# Note: Intel and AMD microcode updates are handled automatically and
# do not need to be specified in INITRD.