"Light" GRUB Alternative Package For Confidential Computing Approved For Fedora 45
([Fedora] 10 Minutes Ago
GRUB + Confidential Computing)
- Reference: 0001646217
- News link: https://www.phoronix.com/news/GRUB-Light-Approved-Fedora-45
- Source link:
A month ago there was a change proposal raised for [1]offering a "light" version of the GRUB2 bootloader for use in confidential computing environments. While there were some differing views on the matter for this alternative, stripped-down GRUB package as opposed to just using other bootloaders like systemd-boot, ultimately, the proposal is now approved.
The Fedora Engineering and Steering Committee (FESCo) has now approved this Fedora 45 change proposal for having a light, alternative version of GRUB2 focused on confidential computing needs. This independent package would have only UEFI support and the minimum number of built-in modules needed to help with modern confidential computing "CoCo" environments. This minimal GRUB would be able to boot unified kernel images "UKIs" using Bootloader Specification "BLS" files.
The motivation for a light version of GRUB comes down to confidential VMs depending upon remote attestation and working to provide long-term stable TPM PCR values, which are affected by any bootloader changes. Plus removing unneeded features/code is ultimately useful as well from a security perspective.
The proposal can be found on the [2]Fedora Wiki while the news this week is the change proposal is now granted. Five FESCO members approved the change with no one voting against it.
FESCo [3]this week also approved landing the LLVM 23 compiler stack in Fedora 45. That one is really not surprising at all as Fedora Linux has a tradition of always shipping the very latest LLVM and GNU toolchains in its releases.
[1] https://www.phoronix.com/news/Fedora-45-Light-GRUB-For-CoCo
[2] https://fedoraproject.org/wiki/Changes/Grub2LightForConfidentialComputing
[3] https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/JYAFGPQEIYTGVJYUYUDCXSWISKROAUX5/
The Fedora Engineering and Steering Committee (FESCo) has now approved this Fedora 45 change proposal for having a light, alternative version of GRUB2 focused on confidential computing needs. This independent package would have only UEFI support and the minimum number of built-in modules needed to help with modern confidential computing "CoCo" environments. This minimal GRUB would be able to boot unified kernel images "UKIs" using Bootloader Specification "BLS" files.
The motivation for a light version of GRUB comes down to confidential VMs depending upon remote attestation and working to provide long-term stable TPM PCR values, which are affected by any bootloader changes. Plus removing unneeded features/code is ultimately useful as well from a security perspective.
The proposal can be found on the [2]Fedora Wiki while the news this week is the change proposal is now granted. Five FESCO members approved the change with no one voting against it.
FESCo [3]this week also approved landing the LLVM 23 compiler stack in Fedora 45. That one is really not surprising at all as Fedora Linux has a tradition of always shipping the very latest LLVM and GNU toolchains in its releases.
[1] https://www.phoronix.com/news/Fedora-45-Light-GRUB-For-CoCo
[2] https://fedoraproject.org/wiki/Changes/Grub2LightForConfidentialComputing
[3] https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/JYAFGPQEIYTGVJYUYUDCXSWISKROAUX5/