From 1de356e5563465b15009b399044da22eba234bd0 Mon Sep 17 00:00:00 2001
From: Jonghyun An <markajh@gmail.com>
Date: Tue, 6 Oct 2026 15:36:11 +0900
Subject: [PATCH] man: document ukify SignInitrdPCRs setting

UKI/SignInitrdPCRs was added together with --sign-initrd-pcrs, but only
that command-line option is documented. Document the configuration key
and move the entry to the [UKI] section.

Fixes #43863.

(cherry picked from commit 4f8ca5032fd0633c6b5caff4868a375ac91b5b0f)
---
 man/ukify.xml | 39 ++++++++++++++++++++-------------------
 1 file changed, 20 insertions(+), 19 deletions(-)

diff --git a/man/ukify.xml b/man/ukify.xml
index 9dfe416d57..97d49828a3 100644
--- a/man/ukify.xml
+++ b/man/ukify.xml
@@ -236,25 +236,6 @@
           <xi:include href="version-info.xml" xpointer="v258"/></listitem>
         </varlistentry>
 
-        <varlistentry>
-          <term><option>--sign-initrd-pcrs</option></term>
-          <term><option>--no-sign-initrd-pcrs</option></term>
-
-          <listitem><para>Enable or disable signing of additional PCR policies that are bound to the initrd
-          phase (after <literal>enter-initrd</literal> and before <literal>leave-initrd</literal>) and the
-          <literal>initrd</literal> policy reference. These additional signed policies are consumed by
-          <citerefentry><refentrytitle>systemd-tpm2-setup-early.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
-          to authorize the initialization of NvPCRs. They are also useful for enrolling TPM keyslots to encrypted
-          volumes that can only be unlocked from the initrd with
-          <citerefentry><refentrytitle>systemd-cryptenroll</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
-          by using the <option>--tpm2-public-key-policyref=initrd</option> option. The extra signatures reuse
-          the first <varname>PCRPrivateKey=</varname>/<option>--pcr-private-key=</option>, hence one must be
-          specified, unless <option>--policy-digest</option> is used to generate the policies for offline
-          signing. Defaults to false.</para>
-
-          <xi:include href="version-info.xml" xpointer="v262"/></listitem>
-        </varlistentry>
-
         <varlistentry>
           <term><option>--section=<replaceable>NAME</replaceable>:<replaceable>TEXT</replaceable>|<replaceable>@PATH</replaceable></option></term>
           <term><option>--section=<replaceable>NAME</replaceable>:text|binary<optional>@<replaceable>PATH</replaceable></optional></option></term>
@@ -557,6 +538,26 @@
           <xi:include href="version-info.xml" xpointer="v253"/></listitem>
         </varlistentry>
 
+        <varlistentry>
+          <term><varname>SignInitrdPCRs=<replaceable>BOOL</replaceable></varname></term>
+          <term><option>--sign-initrd-pcrs</option></term>
+          <term><option>--no-sign-initrd-pcrs</option></term>
+
+          <listitem><para>Enable or disable signing of additional PCR policies that are bound to the initrd
+          phase (after <literal>enter-initrd</literal> and before <literal>leave-initrd</literal>) and the
+          <literal>initrd</literal> policy reference. These additional signed policies are consumed by
+          <citerefentry><refentrytitle>systemd-tpm2-setup-early.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>
+          to authorize the initialization of NvPCRs. They are also useful for enrolling TPM keyslots to encrypted
+          volumes that can only be unlocked from the initrd with
+          <citerefentry><refentrytitle>systemd-cryptenroll</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
+          by using the <option>--tpm2-public-key-policyref=initrd</option> option. The extra signatures reuse
+          the first <varname>PCRPrivateKey=</varname>/<option>--pcr-private-key=</option>, hence one must be
+          specified, unless <option>--policy-digest</option> is used to generate the policies for offline
+          signing. Defaults to false.</para>
+
+          <xi:include href="version-info.xml" xpointer="v262"/></listitem>
+        </varlistentry>
+
         <varlistentry>
           <term><varname>SecureBootSigningTool=<replaceable>SIGNER</replaceable></varname></term>
           <term><option>--signtool=<replaceable>SIGNER</replaceable></option></term>