TrustedGRUB2 VS linux-secureboot-kit

Last time I checked, yes. There's been a few projects like TrustedGRUB2 *(which luks-tpm-boot uses) that was intended to make this work on GRUB. But in all fairness, GRUB is pretty dead to me personally as it's a lot of workarounds depending on what hardware you're working with. The only reason really we support GRUB is because it works on older hardware and on more edge cases (like USB drives etc). But if I could choose, I'd make it so everyone used EFI and we could use systemd-boot everywhere ^

AFAIK trusted boot is in limbo, the upstream project is no longer maintained and it was never very clear exactly how it should be exposed to users anyway. So yeah it has been removed from TW.

Trusted Boot in yast2 switches the bootloader to TrustedGrub2 instead of normal Grub2. It does work on both legacy bios and EFI. This adds several verification steps to the boot process but be aware the support is somewhat piecemeal. I am not an expert on the details.

What do you think about https://github.com/Rohde-Schwarz/TrustedGRUB2

u/Richard__M I am not sure how much you've dug into the architecture of Mortar, but TL;DR it bypasses grub entirely. A friend of mine developed Snawoot/linux-secureboot-kit which leverages grub's GPG capabilities to essentially daisy-chain trust and accomplish the same thing, but ran into frustrations with broken implementations of the feature with some distributions (*ahem* debian). In my opinion, chaining trust also introduces complexity which case lead to security vulnerabilities both from the software being chained, and through "oops" coding trying to get them to play nicely.