On Wed, Jun 24, 2026 at 06:48:23AM -0400, Neal Gompa wrote: > On Wed, Jun 24, 2026 at 6:44 AM Timothée Ravier via devel > <[email protected]> wrote:
> > This contradicts the main goal behind this package which is to > > include as few modules as possible to reduce the attack surface and > > thus the need for updates. When using UKIs, we only need support for > > the FAT filesystem that is used to store them in the ESP. > But we don't *have* to store UKIs on the ESP, and we would prefer > *not* doing that. Who is "we" and why do you *prefer* not doing that? There are a few cases where you have little choice, specifically if you have to work with an existing ESP which is too small to hold kernel images. Pretty much any cloud use case (be it confidential or not) is not affected by size constrains because you generate disk images and can decide how big you make the ESP. In my book that leaves no good reason to store the kernels elsewhere, other than backward compatibility to current practice. UKIs are standalone EFI binaries which can be booted by the firmware without any help from any boot loader, via BootNNNN entries, or from EFI shell, so it IMHO is an advantage to have them stored in a place where the firmware can access them. take care, Gerd -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
