Dracut UEFI Unified Kernel Image with Secure Boot Signing

create-uefi-unified-image.sh

esp=/efi
distro=archlinux
mkdir -p $esp/EFI/$distro
# Generate UEFI Unified Image
dracut --force --verbose --kver $(uname -r) $esp/EFI/$distro/linux+initramfs.efi.signed

# Create UEFI boot manager entry
efibootmgr --quiet --create --disk /dev/disk/by-label/EFI --label 'Arch Linux' --loader /EFI/$distro/linux+initramfs.efi.signed

dracut-defaults.conf

# /etc/dracut.conf.d/dracut-defaults.conf
hostonly=yes
hostonly_cmdline=no
use_fstab=yes
compress=lz4
show_modules=yes
add_drivers+='lz4 lz4_compress'

uefi=yes
early_microcode=yes
uefi_splash_image=/usr/share/systemd/bootctl/splash-arch.bmp
uefi_stub=/usr/lib/systemd/boot/efi/linuxx64.efi.stub
uefi_secureboot_cert=/etc/efi-keys/db.crt
uefi_secureboot_key=/etc/efi-keys/db.key
CMDLINE=(
	rw
	rd.luks.timeout=60
	rd.luks.crypttab=no
	rd.luks.name=$(cryptsetup luksUUID /dev/disk/by-partlabel/cryptsystem)=system
	root=LABEL=system
	rootflags=subvol=@
	zswap.enabled=1
	zswap.compressor=lz4
	zswap.zpool=z3fold
)
kernel_cmdline="${CMDLINE[*]}"
unset CMDLINE

uefi_splash_image currently only works with my fork.

Must use latest commit from dracut project. Important new features for secure boot signing and embedding microcode.

Please consider contributing this to the Arch wiki