You hadn't specified it at first, so I thought it might be helpful to provide a more complete example with different parts (like the initrd) and offsets, with a gummiboot stub

Having kernel and initrd separate makes things more complicated and brittle.

Also a secure boot setup is much more difficult this way.

I for my part love the UKI. Never had a simpler boot setup!

> a secure boot setup is much more difficult this way.

Is it? Don't you just sign the bootable kernel image that already has the initrd and command-line built in?

Oh, I guess if you're using Microsoft as a CA I can see why that would be tricky.

I think this is a misunderstanding. I've said secure boot is much more difficult in case kernel and initrd are separate.

In case of a UKI it's very simple of course. Just sign the boot image.

That's why I love the UKI. :-)