Ok, the following in the config/bootloaders/grub-pc/grub.cfglinux @KERNEL_LIVE@ boot=live config nosgx quiet initrd2=@INITRD_LIVE@ kernel2=@KERNEL_LIVE@
produced the followinglinux /live/vmlinuz-6.17.9+deb14-amd64 boot=live config nosgx quiet initrd2=/live/initrd.img-6.17.9+deb14-amd64 kernel2=@/live/vmlinuz-6.17.9+deb14-amd64@
kernel2= is wrong. I can filter out the @ at the start and finish in the init but figured someone may want to know.
Because someone may ask. Im building a chain of trust boot. The initial initrd is set to securerd.img. it checks sha512 hashes and validates the gpg signature of the kernel and initrd images using a JCOP4 smart card with SmartPgpApplet on it for key storage. Then does a kexec to switch to initrd2 and kernel2.
Attachment:
0xBE355809.asc
Description: application/pgp-keys
Attachment:
signature.asc
Description: OpenPGP digital signature