5 ms·

you can merge the initrd + kernel into one signed binary pretty easily with systemd-boot add luks root, then it's not that bad

• Nextgrid 8mo ago
  Yes, you can. I really don't want to be in the business of building OSes. If these guys make it so that getting reasonable boot security is a simple toggle, I'd be grateful.
  • NekkoDroid 8mo ago
    On arch it isn't particularly difficult to create UKIs other than changing like 2 lines in `mkinitcpio`'s config. Then there is also `ukify` by systemd which also can create UKIs, which then can be installed with `kernel-install`, but that is a bit more work to set up than for `mkinitcpio`. The main part is the signing, which I usually have `sbctl` handle.