@kraxel I did not want to pollute your change proposal with an unrelated question but since you were the lead on Phase 1…
What is the status of supporting the bootloader specification and UKI in grub2-pc (legacy BIOS)? I see there are patches but they don’t seem to have been merged.
I thought that UKI was only necessary on secure boot to allow the whole boot chain to be verified and trusted,
Is having legacy BIOS support a so that the same tooling as secure boot chain can be used?
It’s not only a matter of tooling, however it is true it’s nice from that perspective too: distros could start to ship UKIs and just drop them at the right place. Whether you’re on Legacy BIOS or EFI, it would just work! Truly hybrid images without multiple kernel copies or special cases.
There is also a social component: transition from legacy BIOS to EFi would become as painless as it can be since it’s unified. And you don’t have to keep the kernel, its command line and initramfs in sync separately. They are bundled.
The current approach could be summarized as “Non-UKI systems ‘work’ everywhere, sure config is a pain, sure it does not compose well for measured/secure boot, but it caters to everyone, even the 1% who use x86-64 hardware that is not EFI compatible”.
With UKI and bootloader spec support (as already found here), the approach could be summarized as “dropping that file here now works everywhere”.
Not clear …
Currently the bootloader team is busy rebasing the huge stack of downstream patches to upstream grub 2.12. Once that is done we’ll go look at the UKI patches again.
Highest priority has adding support for bls type 2 (aka UKI) in uefi mode.
bios mode support maybe comes later. Main reason to do that was to allow hybrid bios/uefi cloud images using UKIs. Given that we meanwhile have a separate uefi-only cloud image (without grub) it very well might be that we’ll drop the ball on that though.