On Mi, 27.07.22 17:35, Chris Murphy (lists@colorremedies.com) wrote:
If the additional barrier to adoption that Fedora imposes is that every distro needs to also include signed efifs ext4 in order to read $BOOT, I think it's too much.
I do not follow that logic. First of all, if they can sign grub or sd-boot they should be able to sign efifs too. Secondly, they could just embedd the relevant efifs driver in the sd-boot binary, and sign the result (see other mail). Hence, you build two binaries. Make one of them. Sign one binary.
Sure. But all the distros need to support and build efifs drivers in order to support at least common $BOOT file systems across all of Linux, if they're really truly committed to BLS, if not arbitrary file systems.
There's at least ext4, XFS, Btrfs widely used as $BOOT by default these days. But more when looking at what distro installers allow /boot to be: f2fs, ZFS, LUKS, LVM...
Well, if distributions choose to put boot loader spec drop-ins onto such weird file systems they either didn't understand that the spec is about defining a *shared*, *common* resource, because that way they made it inaccessible to everyone else. Or they did understand it, but simply didn't care.
Whether sd-boot is used to read it, or grub doesn't really matter at that point...
Lennart
-- Lennart Poettering, Berlin