jejb

3 ms·

1. 1.▲
   by jejb 6y ago

   the encryption of the image isn't just about protecting secrets, it's also about making sure the host owner can't tamper with the image. If the kernel isn't part of the encrypted image, it can be substituted by the host
2. 2.▲
   by jejb 6y ago

   you need something that can decrypt the kernel from the encrypted image and then load it. OVMF + the efi stub can't do that whereas grub can read the luks format.
3. 3.▲
   by jejb 8y ago

   since it's my article, I'll strengthen the case for "yes". I won't get into contract vs licence because that's also highly controversial, but I can argue without settling that. The question you're asking