Post #1496663
2026-02-05 08:29 UTC
@T_X @ffhl @cuechan – but that of course requires that there's agreement that settings can be signed with that key and that the OS accepts exactly that key. Which is difficult to bootstrap everywhere where owner of the OS and owner of the config are different people. Option 3) is hence probably the most relevant for many "tinkerer" situations: we intend to add a switch to systemd that says that during first boot (and only during first boot) we'll import certain systemd credentials even without…
Replies (1)
-
@pid_eins@mastodon.social 2026-02-05 08:32
@T_X @ffhl @cuechan … authentication. That's kind of a TOFU situation then. Regardless which way this works, for us this would boil down to placing a "sidecar" file (i.e. either credential file or confext file) next to the UKI in the ESP, so that systemd-stub picks it up in UEFI mode still, and the initrd then can just make use of it. That makes things very simple to provision for many cases, you could even do it from Windows or whatever, because it just means dropping in a…