Am 21.11.2018 um 15:47 schrieb Mauricio Oliveira: >> [...] I will note that it's also possible to copy additional >> root certificates into the initrd pre-install. (At least it used to work >> before HTTPS was generally available.) > It looks like this requires rebuilding the initrd, which is some extra work > (and unfortunately it does not allow using the already > distributed/official files out there), [...]
Linux support specifying multiple files to be loaded as an initrd[1]. In that case the content is merged and you can keep reusing the distributed files, just adding your root certificates on top. Yes, it requires extra work. So does preseeding. Now maybe the argument is that there could be mirrors outside of your control that redirect you to HTTPS and the root of trust is the GPG key material embedded into the initrd. That's a fair point but I will note that you did not actually list a use case, you just reported what didn't work. I guess I don't really object to your patch and am mostly questioning the existence of the option in this day and age, which then means people are encouraged to enable that rather than setup their infrastructure correctly. But there might still be value in having that option available with some signage on how to do it right. Kind regards Philipp Kern [1] In EFI mode Linux is the one requesting the files. Otherwise the boot loader can provide them, which works fine at least with grub and iPXE.
