From: Daniel P. Berrangé on
gitlab.com
https://gitlab.com/cki-project/kernel-ark/-/merge_requests/2917#note_1805...
That said, have a separate srpm is not an inherently bad idea. For that matter
there's a potential case to be made that the UKI itself could also be in a
separate srpm, since if you have a systemd-stub CVE you might want to rebuild
& ship the UKI without rebuilding the whole kernel package. Having the UKI in
the kernel srpm is just a convenience.