`sbctl verify` silently ignores kernels loaded from outside the ESP

[Deftera186]

I know that the verify command describes itself as "Find and check if files in the ESP are signed or not", but users rely on it to confirm their system will boot correctly and in the current state it doesn't do that.

For example in my case I had:

• ESP mounted at /efi (nvme0n1p1, vfat)
• Root filesystem on / (nvme0n1p3, xfs), with kernels at /boot/kernel-*
• GRUB on the ESP loading kernels from /boot

$ sbctl verify
Verifying file database and EFI images in /efi/...
✓ /efi/EFI/GRUB/grubx64.efi is signed

As you can see the kernels at /boot/kernel-* are not mentioned at all.

if no kernel images are detected it should at least mention that kernels may reside outside the ESP and are not being verified and prompt them to sign manually.

Somewhat related issues: #238 (more extensive verification), #24 (versioned kernels)

[Foxboron]

I don't intend to support the fact that grub reads arbiterary filesystems and partitions. /boot should be encrypted and the bootable files should only reside on the efi system partition.

[Deftera186]

I get this is out of scope and isn't really a recommended / encouraged behavior. But since sbctl is aiming to be "User-friendly", shouldn't it at least echo some warning in this case?

[Foxboron]

But since sbctl is aiming to be "User-friendly", shouldn't it at least echo some warning in this case?

I don't see how sbctl would be able to reliably detect this without starting to parse the grub.cfg file, which is code I'm not willing to maintain.