debian-uki/build-uki.sh

#!/usr/bin/env bash

run_directory=$(dirname $(readlink -f "$0"))
source "$run_directory/variables.conf"
user=$(whoami)

if [[ $user != 'root' ]]; then
  sudo="sudo"
else
  sudo=""
fi

# Build UKI
$sudo objcopy \
  --add-section .osrel=/etc/os-release --change-section-vma .osrel=0x20000 \
  --add-section .cmdline="/etc/kernel/cmdline" --change-section-vma .cmdline=0x30000 \
  --add-section .linux="$path_to_vmlinuz_link/vmlinuz" --change-section-vma .linux=0x40000 \
  --add-section .initrd="$path_to_vmlinuz_link/initrd.img" --change-section-vma .initrd=0x3000000 \
  /usr/lib/systemd/boot/efi/linuxx64.efi.stub $path_to_uki

# Sign UKI
$sudo sbsign --key /etc/secureboot/full/db.key --cert /etc/secureboot/full/db.crt --output $path_to_uki $path_to_uki

# if needed, copy UKI to EFI default boot path
if [[ -v $set_efi_default_image ]] && [[ $set_efi_default_image = "yes" ]]; then
  $sudo cp $path_to_uki /efi/EFI/BOOT/BOOTX64.EFI
fi

exit 0