On Wed, Jun 24, 2026 at 06:48:23AM -0400, Neal Gompa wrote:
> On Wed, Jun 24, 2026 at 6:44 AM Timothée Ravier via devel
> <[email protected]> wrote:

> > This contradicts the main goal behind this package which is to
> > include as few modules as possible to reduce the attack surface and
> > thus the need for updates. When using UKIs, we only need support for
> > the FAT filesystem that is used to store them in the ESP.

> But we don't *have* to store UKIs on the ESP, and we would prefer
> *not* doing that.

Who is "we" and why do you *prefer* not doing that?

There are a few cases where you have little choice, specifically if you
have to work with an existing ESP which is too small to hold kernel
images.

Pretty much any cloud use case (be it confidential or not) is not
affected by size constrains because you generate disk images and can
decide how big you make the ESP.  In my book that leaves no good reason
to store the kernels elsewhere, other than backward compatibility to
current practice.

UKIs are standalone EFI binaries which can be booted by the firmware
without any help from any boot loader, via BootNNNN entries, or from EFI
shell, so it IMHO is an advantage to have them stored in a place where
the firmware can access them.

take care,
  Gerd

-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: 
https://forge.fedoraproject.org/infra/tickets/issues/new

Reply via email to