Linux and Secure Boot certificate expiration

Re:Linux and Secure Boot certificate expiration by ChocolateGod on Friday July 18, 2025 @04:11AM (#44602396)

[delayed]

[ Parent | on HN ]

Re:Linux and Secure Boot certificate expiration by the8472 on Friday July 18, 2025 @05:55AM (#44602912)

With a UKI the initramfs gets signed too, doesn't it?

[ Parent | on HN ]

Re:Linux and Secure Boot certificate expiration by vbezhenar on Friday July 18, 2025 @06:25AM (#44603086)

There are ways to solve that issue. But I think that you're correct, pinpointing the core issue with popular Linux distributions. It doesn't have to be this way, though.

1. You can sign and verify initramfs, it's supported by bootloaders.

2. You can merge kernel and initramfs into UKI and sign the whole image.

I don't know why that's not implemented.

[ Parent | on HN ]

Re:Linux and Secure Boot certificate expiration by ChocolateGod on Sunday July 20, 2025 @05:45AM (#44623428)

For UKI I imagine a big hurdle is the size of the images (given /boot/efi is usually only big enough for bootloaders, not kernels and initram) and custom kernel modules (e.g. Nvidia).

There was some systemd work on a spec for a boot partition to extend the efi partition for storing kernel images and initramfs, but I don't think any distro currently defaults to it on.

I think hibernation is currently also broken, since the hibernation file is stored unencrypted by default and thus can't be used with secure boot.

[ Parent | on HN ]