Hi all,
I've been following Genode/Sculpt OS and the recent discussions around Secure
Boot. I saw Johannes Lötzsch's post on the 2026 roadmap thread back in January
where he described his partial setup (TrustedGRUB/Lanzaboote for the kernel,
but the Sculpt image and GENODE* configs unsigned), and Norman's reply that the
topic "screams to be addressed in 2026."
Now that we're halfway through 2026 and Sculpt 26.04 has shipped, I wanted to
ask:
Is there any progress on a full verified boot chain? Even a rough plan or list
of blockers would be interesting to hear.
Johannes mentioned using Lanzaboote with custom keys — is that still the best
community approach today, or has anyone managed to go further (signed system
image, measured GENODE* partition, TPM integration)?
For someone who wants to contribute here — what's the smallest useful piece
that could move this forward? Is it documentation of the existing hack,
build-system work, a design discussion on how to handle the dynamic depot
model, something else?
I think Sculpt's runtime security architecture is genuinely unmatched, but
telling users to disable Secure Boot to run it is a hard sell. I'd love to see
this gap closed.
Thanks
Alex
_______________________________________________
users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Archived at
https://lists.genode.org/mailman3/hyperkitty/list/[email protected]/message/BM5BTVT4YM6Q63O7OUAASPZ3IMXRRP4Z/
