EFI Unified Kernel Image Maker

efi-mkuki is a simple script for creating an EFI Unified Kernel Image ^[1] — a single EFI PE executable combining an EFI stub loader, a kernel image (vmlinuz), the kernel command line, and optionally an initramfs image, CPU microcode update, and a splash image.

Unified Kernel Image is basically an EFI application with all the components necessary for booting Linux directly from UEFI instead of relying on a bootloader. This image can be easily signed for Secure Boot.

To learn more about Secure Boot and why signing just a kernel image (when you use initramfs) is not sufficient, I recomend reading Secure Boot on Arch Linux Wiki.

Requirements

• POSIX-sh compatible shell (e.g. Busybox ash, dash, ZSH, bash, …)

• cat, grep, sed, tr (BSD, Busybox or GNU)

• objcopy from GNU binutils

• EFI stub for your machine architecture from gummiboot ^[2] or systemd

Installation

On Alpine Linux

Install package efi-mkuki on Alpine Linux v3.15 or later:

apk add efi-mkuki

On Arch Linux

Install package efi-mkuki from AUR:

yay -S efi-mkuki

Or use another AUR helper.

Please note that I’m not maintainer of this package.

From Tarball

wget https://github.com/jirutka/efi-mkuki/archive/v0.1.0/efi-mkuki-0.1.0.tar.gz
tar -xzf efi-mkuki-0.1.0.tar.gz
cd efi-mkuki-0.1.0
make install DESTDIR=/ prefix=/usr/local

…​or just download the efi-mkuki script directly.

NOTE: efi-mkuki expects EFI stubs in /usr/lib/gummiboot. This can be rewritten to another path via EFISTUB_DIR variable passed to make install. If /usr/lib/systemd/boot/efi/ directory exists, make install will use it automatically.

Usage

See the help section in efi-mkuki (or run efi-mkuki -h).

Resources

• Unified Extensible Firmware Interface/Secure Boot on Arch Linux Wiki

• Sakaki’s EFI Install Guide/Configuring Secure Boot on Gentoo Wiki

License

This project is licensed under MIT License. For the full text of the license, see the LICENSE file.

---

1. It has been specified by the systemd (read as SystemDisaster) project, but you don’t have to use systemd-boot or any other systemd component to get the benefits of Unified Kernel Image.

2. Gummiboot is referred to as obsolete because it was absorbed by systemd. Gummiboot EFI stubs are still useful though. You can download source tarball gummiboot-48.1.tar.gz (ff9a1632a82b1bef3434718e2aadca8783943f59) from Alpine Linux Archive.