the encryption of the image isn't just about protecting secrets, it's also about making sure the host owner can't tamper with the image. If the kernel isn't part of the encrypted image, it can be substituted by the host…
you need something that can decrypt the kernel from the encrypted image and then load it. OVMF + the efi stub can't do that whereas grub can read the luks format.
since it's my article, I'll strengthen the case for "yes". I won't get into contract vs licence because that's also highly controversial, but I can argue without settling that. The question you're asking is how the…
the encryption of the image isn't just about protecting secrets, it's also about making sure the host owner can't tamper with the image. If the kernel isn't part of the encrypted image, it can be substituted by the host…
you need something that can decrypt the kernel from the encrypted image and then load it. OVMF + the efi stub can't do that whereas grub can read the luks format.
since it's my article, I'll strengthen the case for "yes". I won't get into contract vs licence because that's also highly controversial, but I can argue without settling that. The question you're asking is how the…