"Light" GRUB Alternative Package For Confidential Computing Approved For Fedora 45

A month ago there was a change proposal raised for offering a "light" version of the GRUB2 bootloader for use in confidential computing environments. While there were some differing views on the matter for this alternative, stripped-down GRUB package as opposed to just using other bootloaders like systemd-boot, ultimately, the proposal is now approved.

The Fedora Engineering and Steering Committee (FESCo) has now approved this Fedora 45 change proposal for having a light, alternative version of GRUB2 focused on confidential computing needs. This independent package would have only UEFI support and the minimum number of built-in modules needed to help with modern confidential computing "CoCo" environments. This minimal GRUB would be able to boot unified kernel images "UKIs" using Bootloader Specification "BLS" files.

The motivation for a light version of GRUB comes down to confidential VMs depending upon remote attestation and working to provide long-term stable TPM PCR values, which are affected by any bootloader changes. Plus removing unneeded features/code is ultimately useful as well from a security perspective.

The proposal can be found on the Fedora Wiki while the news this week is the change proposal is now granted. Five FESCO members approved the change with no one voting against it.

FESCo this week also approved landing the LLVM 23 compiler stack in Fedora 45. That one is really not surprising at all as Fedora Linux has a tradition of always shipping the very latest LLVM and GNU toolchains in its releases.