On Wed, Aug 31, 2022 at 06:12:19AM -0700, stan via kernel wrote:
On Wed, 31 Aug 2022 14:46:15 +0200
Gerd Hoffmann <kraxel(a)redhat.com> wrote:
> Here is a little patch series to kick off a discussion on
> pre-generated initrd images and unified kernels. Lets start with a
> description of the patches:
>
> Patch #1 adds a dracut config file, targeting virtual machines.
> Given that most physical machines have either sata or nvme disks
> these days it probably boots most physical systems too.
>
> Patch #2 adds a sub-package with an initrd image.
>
> Patch #3 adds a sub-package with an unified kernel.
>
> The goal is to move away from initrd images being generated on the
> installed machine. They are generated while building the kernel
> package instead. Main motivation for this move is to make the distro
> more robust and more secure.
A worthy goal.
> Comments? Reviews? Suggestions?
How will this impact people who build a custom kernel locally? Will
it still be possible?
Wouldn't be different than local builds today, unified kernels are not
special and the signing process will work the same way it works for
non-unified kernels.
Essentially you have the options to either sign your custom kernel with
your own keys (and add them to the uefi/shim key database) or turn off
secure boot.
take care,
Gerd