Re: [PATCH v2] i386-pc: build verifiers API as module

[Michael Chang]

On Tue, Mar 23, 2021 at 05:48:01PM +0100, Daniel Kiper wrote:
> On Tue, Mar 23, 2021 at 12:16:21PM +0800, Michael Chang via Grub-devel wrote:
> > On Mon, Mar 22, 2021 at 04:20:00PM +0100, Daniel Kiper wrote:
> > > On Thu, Mar 18, 2021 at 07:30:26PM +0800, Michael Chang via Grub-devel 
> > > wrote:

[snip]

> IIRC I was looking at this patch a few weeks ago but decided to not take
> it because the changes are too intrusive for freeze stage. Though I can
> reconsider it once again if you think it is worth of it...

Yes please ... It is indeed a bit instrusive, but neverthelast it is
also worth the effort to integrate a method that will help to improve
integrity of the grub installation.

At present the procedure of module and image install is not atomic, so
the system may suffer from booting in unspecified state if the process
aborted prematurely in the halfway. A promising solution to revert the
unspecified state to the original one is therefore very much desired and
will benefit us in the log run ... 

> > Afterall, keeping existing running system to survive update (NOT new
> > install) is really an important thing as many can't afford that to
> > happen. If we can make it any better to reduce the cost please consider
> > to do it. It doesn't conflict with the purpose to stop the short mbr gap
> > support, given we all know the broken system can be avoided in the first
> > place ...
> 
> This makes sense for me and I am OK with hardening the upgrade path.
> However, I think it is post release work...

Thanks for taking the patch into consideration. Your plan also looks
good to me.

Regards,
Michael

> 
> Daniel
>