Is your feature request related to a problem? Please describe.
Verifying signatures on individual files in /boot is error-prone and slow.
Describe the solution you'd like
Use dm-verity and multiple possible /boot partitions. This allows atomic updates of /boot by replacing the entire partition. Heads will automatically choose the newest version.
Describe alternatives you've considered
#1599
Additional context
dm-verity is used by most other verified boot schemes.
Is your feature request related to a problem? Please describe.
Verifying signatures on individual files in
/bootis error-prone and slow.Describe the solution you'd like
Use dm-verity and multiple possible
/bootpartitions. This allows atomic updates of/bootby replacing the entire partition. Heads will automatically choose the newest version.Describe alternatives you've considered
#1599
Additional context
dm-verity is used by most other verified boot schemes.