Comment by my123
8 days ago
> Which vendors already support this?
One implementation I've seen in the wild is: https://docs.nvidia.com/jetson/archives/r36.4/DeveloperGuide...
Secure Boot is still supported in that configuration, but with PK/db/dbx being part of the firmware configuration and updating them requiring a UEFI capsule update.
Looks like UKI include the initrd in what EFI checks the signature of.
Add signature checking for grub.cfg (instead of just the EFI shim) but that requires enrolling a local key
Add initrd signatures to grub.cfg