Hacker News Reader

you can merge the initrd + kernel into one signed binary pretty easily with systemd-boot

add luks root, then it's not that bad

Yes, you can. I really don't want to be in the business of building OSes. If these guys make it so that getting reasonable boot security is a simple toggle, I'd be grateful.

On arch it isn't particularly difficult to create UKIs other than changing like 2 lines in `mkinitcpio`'s config.

Then there is also `ukify` by systemd which also can create UKIs, which then can be installed with `kernel-install`, but that is a bit more work to set up than for `mkinitcpio`.

The main part is the signing, which I usually have `sbctl` handle.

Reply on news.ycombinator.com