For reference, secure boot is pretty easy if you have a kernel with a combined initramfs, command line, and efi stub loader. You just sign the kernel with your EFI key, and you’re good to go.
You don’t even need to build your own kernel to do this. You can use your distro’s kernel and patch it with objcopy.
Re:Invisible Arch Linux
by Smithalicious on Wednesday December 25, 2019 @12:42PM
(#21879534)
Isn't 30 seconds still not much? I wouldn't start worrying enough about boot times to take steps to improve them until they ran 5+ minutes.
Re:Invisible Arch Linux
by Johnnynator on Wednesday December 25, 2019 @01:37PM
(#21879818)
It is a lot, especially since it also takes the 30sec until you know if you had a typo in your password or not.
Yes, GRUB can technically decrypt a LUKS1 partition, but since the kernel isn't running yet, it has to use a standalone (slow) implementation. Takes my laptop 30 seconds to decrypt the boot partition using GRUB, and 2 seconds to decrypt the root partition once the kernel has started (same number of iterations).
I'm planning on replacing this mess with a systemd-boot EFI image and secure boot using my own PK.