Lennart Poettering on Nostr: You might know the UKI concept we introduced a couple of years ago, i.e. the unified ...

You might know the UKI concept we introduced a couple of years ago, i.e. the unified kernel image. You glue kernel, initrd and some other metadata into one UEFI PE binary, so that it can be secureboot authenticated as one, and be measured as one.

It has many benefits to do things that way, but it also comes at one drawback: you bake in a single kernel cmdline, and in sb mode there's no way to use any other (well unless you use cmdline addon files, but that involves signing stuff separately, …