Sorry for late reply,
This sounds like just what I was hoping to learn about
To give some context, I am currently trying to learn how to make reproducible OS builds using
mkosi
One of the big advantages of the tool is that is helps get closer to the points outlined in
Fitting Everything together by Pottering in which he outlines some key goals including:
- increasing usage of the TPM to increase security
- self-signing keys so we can have operating systems that are both immutable AND hackable (no more corporate signed keys!)
- ensuring the validity of the entire stack by using secure boot, encrypted home drives, and sandboxing for user applications to make a more secure environment
All of this is with the goal of running
particleos eventually but i would settle for just a custom-rolled arch distro that I upgrade in A/B fashion. But one of the fundamental assumptions of all of this is that im self-signing keys and using them for everything from secure-boot, to my home drive if necessary but I have held off from learning these security topics until now!