I would disagree. The idea is great; eliminate preboot malware by trusting the whole boot stack. It has a place in computing and I would like to see it be something easier to work with.
Pretty much everything about how it’s currently implemented is a mistake, I’ll agree with.
UEFI doesn’t forbid you from implementing additional file systems, it just requires everyone to support UEFI-FAT.
iBoot for example supports booting from HFS volumes.
You are free to implement any filesystem driver, and either load it in your custom implementation of EFI, or from an EFI image stored on a FAT partition. The EfiFs project provides many drivers under a GPL, including exFAT, Btrfs, ext2-4, NTFS, ISO9660 (cdfs), ZFS and also HFS(+).
It is open, oddly enough. It’s just that nobody ships anything other than Microsoft’s keys. You can add your own. It’s just that it is a tedious, manual process.
Everything about secure boot is a mistake.
I would disagree. The idea is great; eliminate preboot malware by trusting the whole boot stack. It has a place in computing and I would like to see it be something easier to work with.
Pretty much everything about how it’s currently implemented is a mistake, I’ll agree with.
Microsoft has unofficial support for ext4 for their EFI partitions on their azure cloud, which in itself is a violation of their standard.
UEFI doesn’t forbid you from implementing additional file systems, it just requires everyone to support UEFI-FAT. iBoot for example supports booting from HFS volumes.
And who has that implementation?
iBoot is the bootloader on all Apple products.
But who else can use that?
You are free to implement any filesystem driver, and either load it in your custom implementation of EFI, or from an EFI image stored on a FAT partition. The EfiFs project provides many drivers under a GPL, including exFAT, Btrfs, ext2-4, NTFS, ISO9660 (cdfs), ZFS and also HFS(+).
Ooh thanks I need to explore this thing!
More like who is implementing it. Take MS out of the picture and set it as an open standard.
It is open, oddly enough. It’s just that nobody ships anything other than Microsoft’s keys. You can add your own. It’s just that it is a tedious, manual process.
Depends on the distro! I could do it in 5 minutes with my bazzite installation: https://docs.bazzite.gg/General/Installation_Guide/secure_boot/
Very happy surprise when setting up my new PC :)
Yeah, Ventoy will import its key for you too. If what you’re using doesn’t come with that utility, you’ll be manually entering in public keys. 😭