debian-uki/build-uki.sh

#!/usr/bin/env bash

run_directory=$(dirname $(readlink -f "$0"))
source "$run_directory/variables.conf"

if [[ $user != 'root' ]]; then
  sudo="sudo"
else
  sudo=""
fi

# Build UKI
$sudo objcopy \
  --add-section .osrel=/etc/os-release --change-section-vma .osrel=0x20000 \
  --add-section .cmdline="/etc/kernel/cmdline" --change-section-vma .cmdline=0x30000 \
  --add-section .linux="$path_to_vmlinuz_link/vmlinuz" --change-section-vma .linux=0x40000 \
  --add-section .initrd="$path_to_vmlinuz_link/initrd.img" --change-section-vma .initrd=0x3000000 \
  /usr/lib/systemd/boot/efi/linuxx64.efi.stub $path_to_uki

# Sign UKI
$sudo sbsign --key /etc/secureboot/keys/db/db.key --cert /etc/secureboot/keys/db/db.crt --output $path_to_uki \
  $path_to_uki

exit 0