On Mi, 24.06.26 06:48, Neal Gompa ([email protected]) wrote:

> On Wed, Jun 24, 2026 at 6:44 AM Timothée Ravier via devel
> <[email protected]> wrote:
> >
> > Neal Gompa wrote:
> > > From the Fedora Cloud point of view, I am generally supportive of
> > > this. I would like to see other common filesystem modules re-added
> > > though (particularly btrfs, but it also probably makes sense to re-add
> > > xfs and ext4).
> >
> > This contradicts the main goal behind this package which is to include as 
> > few modules as possible to reduce the attack surface and thus the need for 
> > updates. When using UKIs, we only need support for the FAT filesystem that 
> > is used to store them in the ESP.
>
> But we don't *have* to store UKIs on the ESP, and we would prefer
> *not* doing that. And aside from that, those three modules are by far
> the most used and well-maintained modules. It's not like I'm asking
> for HFS+ support to be enabled on grub-cc.

That's a terrible idea. Modern file systems are complex beasts, and
the file system implementations in Grub are not well maintained
compared to the kernel ones. Write support is a mess. Moreover the
kernel developers don#t want to support alternative implementations
anyway, and expressly tell you so.

Given that the UEFI's trust/security architecture during boot focuses
on authenticating individual binaries (rather than authenticating file
systems as a whole) it is essential that file systems accessed during
boot loader runtime are as simple as possible. i.e. FAT is simply the
best option, because comparatively simple.

Hence sorry, but what you are suggesting never made any sense. Not
from a maintenance perspective, not from a qualitify perspective and
definitely not from a security perspective. Get this out of your head.

Lennart

--
Lennart Poettering, Berlin
-- 
_______________________________________________
devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct: 
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: 
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it: 
https://forge.fedoraproject.org/infra/tickets/issues/new

Reply via email to