Comment by exceptione

7 days ago

  > Dm-verity protected EROFS images

First time I hear about it. Playing the devils advocate: how does it improve over checksums + tarballs?

checksums + tarballs don't help with runtime integrity verification. You'll need additional technologies for that like dm-verity or fs-verity; see composefs.