Gerd Hoffmann wrote: > > Create BLS entries in that directory for each UKI. Specify the path > > to the UKI using the `efi` keyword, as you normally would use `linux` > > for the kernel. A minimal BLS file only needs to have a title and the > > path to the UKI: > > <pre> > > # cat /boot/efi/loader/entries/7.0.10-200-UKI.fc45.x86_64.conf > > title Fedora 45 UKI (7.0.10-200.fc45.x86_64) > > efi /EFI/Linux/7.0.10-200.fc45.x86_64.efi > > </pre> > This should not be needed. According to the boot loader spec a snippet > is optional for UKIs. The boot loader should pick up all UKI images in > EFI/Linux without config entries. It is allowed to add a snippet if > needed, for example to add command line arguments.
Note that the testing instructions in the change are just for testing and do not fully correspond to the logic for sealed bootable container images that we are working on in bootc, which triggered this change request. In this case however, we explicitly use Type 1 BLS configs pointing to a Type 2 UKI to be able to fully control the oder in which the boot entries are listed, and notably to control the default entry. We need that to be able to rollback the system to a previous entry that may not sort first. Thus the embedded GRUB config uses the `blscfg` command: https://src.fedoraproject.org/rpms/grub2/blob/rawhide/f/grub-cc.cfg#_2 If someone also want this to also support booting standalone UKIs then they would have to add the `uki` command to the config: https://www.gnu.org/software/grub/manual/grub/grub.html#index-uki > With CoreOS this is probably a bit different because it expects to get > the ostree root hash (which is not fixed) passed on the kernel command > line. So CoreOS probably has to actually do the addon signing dance, or > find some alternative way such as systemd credentials to configure this. This is being worked on for the composefs backend in bootc for sealed bootable container images and the composefs hash will be part of the UKI itself so there is no need for an addon. -- _______________________________________________ devel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
