On Wed, Jun 24, 2026, at 9:40 AM, Neal Gompa wrote: > On Wed, Jun 24, 2026 at 7:29 AM Gerd Hoffmann <[email protected]> wrote: >> >> On Wed, Jun 24, 2026 at 06:48:23AM -0400, Neal Gompa wrote: >> > On Wed, Jun 24, 2026 at 6:44 AM Timothée Ravier via devel >> > <[email protected]> wrote: >> >> > > This contradicts the main goal behind this package which is to >> > > include as few modules as possible to reduce the attack surface and >> > > thus the need for updates. When using UKIs, we only need support for >> > > the FAT filesystem that is used to store them in the ESP. >> >> > But we don't *have* to store UKIs on the ESP, and we would prefer >> > *not* doing that. >> >> Who is "we" and why do you *prefer* not doing that? >> > > I already said this upthread, David and I in Fedora Cloud. I'm not > going to say again why I don't want to.
I feel obligated to chime in here and say that I (also in Fedora Cloud) very much do want UKIs, I do want them on the ESP and I do _not_ want the bootloader to have to care about more filesystems. > >> There are a few cases where you have little choice, specifically if you >> have to work with an existing ESP which is too small to hold kernel >> images. >> >> Pretty much any cloud use case (be it confidential or not) is not >> affected by size constrains because you generate disk images and can >> decide how big you make the ESP. In my book that leaves no good reason >> to store the kernels elsewhere, other than backward compatibility to >> current practice. >> > > I wish you were right, but you are not. Cloud environments are > affected by buggy UEFI code just like everything else. These days AWS > isn't as problematic, but when we first experimented with it, AWS > instances booting UEFI couldn't even read FAT32 (it was required to be > FAT16) and they used to freak out over the protective MBR data. We > have encountered other virtualized environments that have similar problems > to real PC environments with ESP size, disk layout, binary names, and > so on. If bugs are found we'll fix them. Bugs exist in all software and yet we persist. - Jeremy -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
