3 ms·

> Which vendors already support this? One implementation I've seen in the wild is: https://docs.nvidia.com/jetson/archives/r36.4/DeveloperGuide/SD/Bootloader/U

by my123 7mo ago

> Which vendors already support this? One implementation I've seen in the wild is: https://docs.nvidia.com/jetson/archives/r36.4/DeveloperGuide/SD/Bootloader/UEFI.html#miniuefi-support https://docs.nvidia.com/jetson/archives/r36.4/DeveloperGuide... Secure Boot is still supported in that configuration, but with PK/db/dbx being part of the firmware configuration and updating them requiring a UEFI capsule update.

westurner 7mo ago
Looks like UKI include the initrd in what EFI checks the signature of. Add signature checking for grub.cfg (instead of just the EFI shim) but that requires enrolling a local key Add initrd signatures to grub.cfg