> On Wed, May 10, 2023 at 5:34 PM Chris Murphy <lists(a)colorremedies.com> > wrote: > > > In this idea, the dm-verity parition/file would only be accessed from the > initrd, once we have enough kernel to ability to interact with physical > storage, understand partitions, initialize dm-verity, and read *a* > partition, but potentially not enough to read from a bluetooth keyboard, > show a graphical prompt, mount / from the network, etc. > > What dm-verity provides here is a way to trust content without requiring it > to be read ahead of time, checksumed, signature checked and put into ram.
We already support dm-verity for the rootfs, in both dracut and mkosi-initrd, not sure what's the issue here? > The elephant in the room is whether the "desktops in the default > installation" UKI requires piles of graphics firmware. It might not be at > all small in that case. We support optional extensions with UKIs exactly for this reason. _______________________________________________ devel mailing list -- devel@lists.fedoraproject.org To unsubscribe send an email to devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
