sbupdate.conf

# Configuration file for sbupdate
#
# Commented-out variables show default values.

# Common settings
#
# KEY_DIR          Directory with the custom Secure Boot keys
# ESP_DIR          EFI System Partition location
# OUT_DIR          Relative path on ESP for signed kernel images
# SPLASH           Splash image file. Use an empty string to disable splash.
# ENCRYPTED        Whether files in KEY_DIR are encrypted with EncFS
# BACKUP           Whether to back up old signed kernel images
# EXTRA_SIGN       An array of additional files to sign
# CMDLINE_DEFAULT  Default kernel command line. Read from /etc/kernel/cmdline
#                  if not set in the configuration file.

#KEY_DIR="/etc/efi-keys"
#ESP_DIR="/boot"
#OUT_DIR="EFI/Arch"
#SPLASH="/usr/share/systemd/bootctl/splash-arch.bmp"
#ENCRYPTED=0
#BACKUP=1
#EXTRA_SIGN=()
#CMDLINE_DEFAULT=""

# Per-kernel configuration
#
# For each kernel <NAME> the following optional settings may be added:
#
#   CMDLINE[<NAME>]="..."  # Alternative kernel command line
#                          # Default value: ${CMDLINE_DEFAULT}
#   INITRD[<NAME>]="..."   # Alternative initramfs file
#                          # Default value: /boot/initramfs-<NAME>.img
#   OUTPUT[<NAME>]="..."   # Alternative output file name
#                          # Default value: ${OUT_DIR}/<NAME>-signed.efi
#
# Each kernel can be mapped to multiple configs using the CONFIGS
# variable, in which case CMDLINE, INITRD and OUTPUT are set per config.
#
# Examples:
#   CMDLINE["linux-lts"]="custom command line"
#   INITRD["linux-lts"]="/boot/initramfs-linux-custom.img"
#
#   # Generates variants with default and fallback initramfs
#   CONFIGS["linux"]="linux linux-fallback"
#
# Note: Intel and AMD microcode updates are handled automatically and
# do not need to be specified in INITRD.