Unified Kernel Images

[LyingCak3]

Is it possible for ZBM to boot to a unified kernel image instead of a separate kernel and initramfs image? Note: I am not talking about booting into ZBM, instead I am talking about what ZBM selects to boot.

[zdykstra]

No, the boot environment evaluator requires both a kernel and an intramfs to be present, as does kexec. Is there a particular reason that a UKI is preferable to a discrete kernel/initramfs pair?

[LyingCak3]

There are benefits from a secure boot stand point as it is usually easier to sign and maintain unified kernel images instead of having to sign all the individual components as detailed in the Arch Linux documentation.

This also simplifies the logic of selecting a kernel, initramfs, command line parameters, etc... as that is all contained within the UKI.

[classabbyamp]

If your bootenv is encrypted (where the kernel/initramfs reside) and the ZBM UKI is signed with secureboot, there's no need to have secureboot anywhere past zbm

[LyingCak3]

While that might be true from the secure boot perspective, that does that does not alleviate the fact that a UKI provides a significantly more rich configuration environment than ZBM does. By supporting booting to a UKI, ZBM would be able make use of all those advantages without having to implement them on its own.

[classabbyamp]

zbm supports selecting a kernel version and has a simple interface for setting commandline parameters, what's missing?