Re: [OE-core] [PATCH v3 04/11] core-image-initramfs-boot: add option to build systemd based initrd

[Mikko Rapeli <mikko.rapeli@linaro.org>]

Hi,

On Mon, Apr 07, 2025 at 10:58:12AM +0200, Koen Kooi wrote:
> 
> 
> > Op 7 apr 2025, om 08:12 heeft Mikko Rapeli <mikko.rapeli@linaro.org> het volgende geschreven:
> > 
> > Hi,
> > 
> > On Mon, Apr 07, 2025 at 08:01:41AM +0200, Koen Kooi wrote:
> >> Op 4 apr 2025, om 18:29 heeft Mikko Rapeli via lists.openembedded.org <mikko.rapeli=linaro.org@lists.openembedded.org> het volgende geschreven:
> >>> 
> >>> If "systemd-initramfs" is in DISTRO_FEATURES then convert
> >>> core-image-initramfs-boot from shell scripts to systemd.
> >>> The resulting initramfs is much bigger than shell script one but
> >>> supports much more features like disk encryption and TPM devices.
> >>> Also includes udev which can load any drivers needed to mount
> >>> rootfs.
> >> 
> >> Are packaged based kernel updates finally working with this?
> > 
> > Sorry, I don't get this question. What is package based kernel updates?
> 
> Using package management to update a kernel, e.g, 'opkg update ; opkg upgrade'.

Yocto project in general does not test binary package update paths. These
patches are still tied to the yocto build environment and don't generate
initrd on the running systemd based on files in the rootfs. That support
is currently not available in yocto, AFAIK.

These changes only enable building systemd based initrd image from the yocto
build environment.

One of the usecases which I'm testing is UEFI secure boot where
kernel and initrd are signed with keys which are not availeble
in the rootfs. The keys are only available on the yocto build
machine. The UEFI firmware (u-boot based,
https://gitlab.com/Linaro/trustedsubstrate/meta-ts ) checks
that kernel and initrd in the UKI binary are signed with
expected keys before allowing boot to continue. systemd
based initrd is then able to use TPM in more advance ways
that shell script based yocto initrd framework to e.g.
encrypt rootfs.

Cheers,

-Mikko