OVMF_CODE32_4M.secboot.fd
  UEFI firmware for a 32-bit QEMU guest that is intended to be read-only.
  This is a Secure Boot-capable image, but it will only be enabled if
  the variable store has configured it on.

OVMF32_VARS_4M.fd
  A variable template image that is intended to be read-write, and therefore
  each guest should be given its own copy. This is an empty variable store
  template, which means it has no built-in Secure Boot keys and Secure Boot
  is disabled. You can use it with any OVMF32_CODE_4M.secboot.fd image, but
  keep in mind that if you want to boot in Secure Boot mode, you will have
  to enable it manually.

 -- dann frazier <dannf@debian.org>, Fri,  4 Feb 2022 17:07:25 -0700