F45 Change Proposal: Grub EFI For Confidential Computing (self-contained)

[mks-h (Maksym Hazevych)]

I find the points against systemd-boot to not be very convincing.

@lsandova

• While the systemd team can support sd-boot in its present form, they view any additional features as a no-go

This feels contradictory to the idea of limiting GRUB features. Are there some features that you want to keep for this minimal GRUB that aren’t present in sd-boot?

@lsandova

• Although sd-boot is a light and trivial bootloader, it has not been widely tested or fuzzed, like GRUB has been

Citation needed. Also, it’s not like systemd-boot is something entirely new and unused. Trying to guess which is more secure by popularity seems like reading tea leaves.

@lsandova

• Long term maintenance of more than one bootloader would result in a lack of parity and added technical debt

This is a more convincing point, but unless the regular GRUB configuration is limited to only using features that are available to the minimal configuration, there is still a risk of feature disparity.

@lsandova

• Potential expansion to other architectures would necessitate a compatible bootloader anyway.

Could you elaborate on this? Is there some architecture candidate for support that is or surely will be supported by GRUB but not sd-boot?