[$] Systemd takes steps toward a more secure boot process
The systemd project has been working for some time on promoting unified kernel images (UKIs), a format that bundles a kernel, initial disk image, kernel command line, and other associated data into a single file. The advantage of the format is the ability to authenticate the entire collection with secure boot, which makes it easier for end users to know that their operating system hasn't been tampered with. The downside is the lack of flexibility and increase in disk usage, since all of the things packaged in a UKI must be updated together. But the recent systemd 257 release (along with other changes to be covered in a future article) includes some major changes to the UKI format, and the rest of the boot process, that partially mitigate those downsides. The release also includes improvements for hardware-locked disk encryption, which may also help secure some computers.