Hacker News Reader

> the kernel will verify anything beneath it

Yes that's the case - my argument is that Linux currently doesn't have anything standardized to do that.

Your best bet for now is to use a read-only dm-verity-protected volume as the root partition, encode its hash in the initrd, combine kernel + initrd into a UKI and sign that.

I would welcome a standardized approach.

View on HN

Standardizing that approach is one thing that the systemd project has been working on. They've built various components to help with that, including writing specifications (via the UAPI group) on how that should all fit together.

ParticleOS[0] gives a look at how this can all fit together, in case you want to see some of it in action.

[0] https://github.com/systemd/particleos

Reply on news.ycombinator.com