Not supported OOB is correct - but it is quite easy to implement…
See this topic for instructions on setting up secure boot with Manjaro Linux
→ [root tip] [How To] Manjaro and Windows - Secure Boot - using repo only
When I look at the output - I see that you need to run sbctl with root privileges
Manjaro is using the same version as Arch Linux (drawn from Arch repository)
$ inxi -S
System:
Host: manjaro Kernel: 6.14.7-1-MANJARO arch: x86_64 bits: 64
Desktop: KDE Plasma v: 6.3.5 Distro: Manjaro Linux
$ pamac info sbctl | grep -e 'Version' -e 'Name' -e 'Packager' -e 'Build Date'
Name : sbctl
Version : 0.17-1
Packager : Morten Linderud <foxboron@archlinux.org>
Build Date : 2025-04-28T22:19:28 CEST
$ mbn info sbctl -q | grep -e 'Branch' -e 'Version' -e 'Build Date'
Branch : archlinux
Version : 0.17-1
Build Date : Mon 28 Apr 2025 22:19:28
Branch : unstable
Version : 0.17-1
Build Date : Mon 28 Apr 2025 22:19:28
Branch : testing
Version : 0.17-1
Build Date : Mon 28 Apr 2025 22:19:28
Branch : stable
Version : 0.17-1
Build Date : Mon 28 Apr 2025 22:19:28
$ sbctl verify
Verifying file database and EFI images in /efi...
failed to verify file /efi/loader/random-seed: /efi/loader/random-seed: invalid pe header
failed to verify file /efi/main.efi: open /var/lib/sbctl/keys/db/db.key: permission denied
$ sudo sbctl verify
Verifying file database and EFI images in /efi...
failed to verify file /efi/loader/random-seed: /efi/loader/random-seed: invalid pe header
✓ /efi/main.efi is signed
$ sudo sbctl list-bundles
Enrolled bundles:
/efi/main.efi
Signed: ✓ Signed
ESP Location: /efi
Output: └─/main.efi
EFI Stub Image: └─/usr/lib/systemd/boot/efi/linuxx64.efi.stub
Cmdline: ├─/etc/kernel/cmdline
OS Release: ├─/usr/lib/os-release
Kernel Image: ├─/boot/vmlinuz-6.14-x86_64
Initramfs Image: └─/boot/initramfs-6.14-x86_64.img
AMD Microcode: └─/boot/amd-ucode.img
$ sudo sbctl status
Installed: ✓ sbctl is installed
Owner GUID: xxxxxxxx-7494-4ee5-8ab3-70698073a4bb
Setup Mode: ✓ Disabled
Secure Boot: ✓ Enabled
Vendor Keys: none