On Wed, May 10, 2023 at 5:34 PM Chris Murphy <lists(a)colorremedies.com> wrote:
In this idea, the dm-verity parition/file would only be accessed from the initrd, once we have enough kernel to ability to interact with physical storage, understand partitions, initialize dm-verity, and read *a* partition, but potentially not enough to read from a bluetooth keyboard, show a graphical prompt, mount / from the network, etc.
What dm-verity provides here is a way to trust content without requiring it to be read ahead of time, checksumed, signature checked and put into ram.
We already support dm-verity for the rootfs, in both dracut and mkosi-initrd, not sure what's the issue here?
The elephant in the room is whether the "desktops in the default installation" UKI requires piles of graphics firmware. It might not be at all small in that case.
We support optional extensions with UKIs exactly for this reason.