feat(image): parameter to include microcode and secureboot

pkgs/image/default.nix

@@ -1,16 +1,21 @@
 {
+  lib,
   pkgs,
   patosPkgs,
   version,
   runCommand,
-  updateUrl
+  updateUrl,
+  cpuArch ? "",
+  secureBoot ? "false"
 }:
 let
   pname = "patos-image";
 in
 runCommand pname {
-  inherit version;
-  inherit updateUrl;
+  inherit version cpuArch updateUrl secureBoot;
+
+  microcode = lib.optionalString (cpuArch == "amd") "--microcode ${pkgs.microcode-amd}/amd-ucode.img"
+      + lib.optionalString (cpuArch == "intel") "--microcode ${pkgs.microcode-intel}/intel-ucode.img";
 
   buildInputs = with pkgs; [
     erofs-utils
@@ -25,7 +30,7 @@ runCommand pname {
     SYSTEMD_REPART_MKFS_OPTIONS_EROFS = "--all-root -zlz4hc,12 -C1048576 -Efragments,dedupe,ztailpacking";
   };
 
-  kernelCmdLine = "console=ttyS0 patos.secureboot=false";
+  kernelCmdLine = "console=ttyS0 patos.secureboot=${secureBoot}";
 }
 ''
 mkdir -p $out/init.repart.d $out/final.repart.d
@@ -176,6 +181,7 @@ ln -sf patos_$version.root.raw patos_${version}_$rootUuid.root
 ${patosPkgs.systemd}/usr/bin/ukify build \
   --linux ${patosPkgs.kernel}/bzImage \
   --initrd ${patosPkgs.initrd}/initrd.xz \
+  $microcode \
   --os-release @rootfs/etc/os-release \
   --cmdline "$kernelCmdLine roothash=$roothash" \
   -o patos_${version}.efi