Merge pull request #477 from ddemaio/master

publish this version

Author: ddemaio

_posts/2025/2025-11-13-tw-grub2-bls.md

@@ -9,8 +9,8 @@ title: GRUB2-BLS in openSUSE Tumbleweed is now the default
 categories:
 - Announcements
 - openSUSE
-- tumbleweed
-- boot loader
+- Tumbleweed
+- MicroOS
 tags:
 - openSUSE
 - bootloader
@@ -19,51 +19,54 @@ tags:
 - YaST
 - FDE
 - Full Disk Encryption
+- boot
+- MicroOS
+- initrd
+- sdbootutil
+- FIDO2
+- LUKS2 
+- TPM2
 
 ---
 
 [openSUSE Tumbleweed](https://get.opensuse.org/tumbleweed/) recently changed the default boot loader from GRUB2 to GRUB2-BLS when installed via YaST.
 
-This follows the trend started by MicroOS of adopting boot loaders that are compatible with the [boot loader specification](https://uapi-group.org/specifications/specs/boot_loader_specification/). [MicroOS](https://get.opensuse.org/microos/) is using `systemd-boot`, a very small and fast boot loader from the `systemd` project.
-
-One of the reasons for this change is to simplify the integration of new features, like full disk encryption based on `systemd` tools, that will make use of TPM2 or FIDO2 tokens if they are available.
->>>>>>> master
+This follows the trend started by [MicroOS](https://get.opensuse.org/microos/) of adopting boot loaders that are compatible with the [boot loader specification](https://uapi-group.org/specifications/specs/boot_loader_specification/). MicroOS is using `systemd-boot`, which is a very small and fast boot loader from the `systemd` project.
 
+One of the reasons for this change is to simplify the integration of new features. Among them is full disk encryption based on `systemd` tools, which will make use of TPM2 or FIDO2 tokens if they are available.
 
 ## What is GRUB2-BLS
 
-GRUB2-BLS is just GRUB2 but with some patches on top ported from the Fedora project, that includes some compatibility for the boot loader specification for Type #1 boot entries.  Those are small text files stored in `/boot/efi/loader/entries` that the boot loader reads to present the initial menu.
-
-Each file contains a reference to the kernel, the `initrd`, and the kernel command line that will be used to boot the system, and can be edited directly by the user or managed by tools like `bootctl` and `sdbootutil`.
+GRUB2-BLS is just GRUB2 but with some patches on top ported from the Fedora project, which includes some compatibility for the boot loader specification for Type #1 boot entries.  Those are small text files stored in `/boot/efi/loader/entries` that the boot loader reads to present the initial menu.
 
-In the next version of GRUB2 (2.14) those patches will be included as part of the project itself, and the upgrade process will be transparent for the final user.
+Each file contains a reference to the kernel, the `initrd`, and the kernel command line that will be used to boot the system. It can be edited directly by the user or managed by tools like `bootctl` and `sdbootutil`.
 
-It should be noted that the way openSUSE deploys GRUB2-BLS is different from the classical GRUB2.  GRUB2-BLS is deployed as a single EFI binary installed (copied) in `/boot/efi/EFI/opensuse` that will have embedded all the resources (like the modules, configuration file, fonts, themes and graphics) that previously were placed in `/boot/grub2`.
+In the next version of GRUB2 (2.14), those patches will be included as part of the project itself, and the upgrade process will be transparent for the final user.
 
+It should be noted that the way openSUSE deploys GRUB2-BLS is different from the classical GRUB2.  GRUB2-BLS is deployed as a single EFI binary installed (copied) in `/boot/efi/EFI/opensuse` that will have embedded all the resources (like the modules, configuration file, fonts, themes and graphics), which were previously placed in `/boot/grub2`.
 
 ## Installation
 
-The good news is that with the latest version of YaST the process is automatic.  The user just needs to follow the default steps and the system will be based on GRUB2-BLS at the end.
+The good news is that with the latest version of YaST the process is automatic. The user just needs to follow the default steps and the system will be based on GRUB2-BLS at the end.
 
-The installer will first propose a large ESP partition of about 1GB. This is required because all the kernel and `initrd`s will now be placed in the FAT32 ESP partition, in `/boot/efi/opensuse-tumbleweed`.
+The installer will first propose a large ESP partition of about 1GB. This is required because all the kernel and `initrd`s will now be placed in the FAT32 ESP partition located in `/boot/efi/opensuse-tumbleweed`.
 
-Of course the user can select a different boot loader during the installation, like the classical `GRUB2` or `systemd-boot`.  This can be done in the "Installation Settings" screen presented at the end of the installation proposal.  Just select the "Booting" header link and choose your boot loader from there.
+Of course the user can select a different boot loader during the installation like the classical `GRUB2` or `systemd-boot`.  This can be done in the "Installation Settings" screen presented at the end of the installation proposal.  Just select the "Booting" header link and choose your boot loader from there.
 
 ## Full disk encryption
 
-As commented, when using a BLS boot loader we can now install the system with full disk encryption (FDE) based on `systemd`.  This can be done from the "Suggested Partitioning" screen.  Just press "Guided Setup" and in the "Partitioning Scheme" select "Enable Disk Encryption".
-
-From there you can set a LUKS2 password and, optionally, enroll a security device like a TPM2 or a FIDO2 key.  For laptops it is recommended to enroll the system with a TPM2+PIN.  The TPM2 will first assert that the system is in a healthy (known) state.  Than means that elements used during the boot process (from the firmware until the kernel) are the expected ones, and no one tampered with them.  After that the TPM2 will ask for a PIN or password, that YaST will set as the one entered for the LUKS2 key slot.
+When using a BLS boot loader, we can now install the system with full disk encryption (FDE) based on `systemd`.  This can be done from the "Suggested Partitioning" screen.  Just press "Guided Setup" and in the "Partitioning Scheme" select "Enable Disk Encryption".
 
+From there, you can set a LUKS2 password and, optionally, enroll a security device like a TPM2 or a FIDO2 key.  For laptops, it is recommended to enroll the system with a TPM2+PIN.  The TPM2 will first assert that the system is in a healthy (known) state.  Than means that elements used during the boot process (from the firmware until the kernel) are the expected ones, and no one tampered with them.  After that, the TPM2 will ask for a PIN or password, which YaST will set as the one entered for the LUKS2 key slot.
 
 ## Usage
 
-With GRUB2-BLS we will no longer have grub2 tools like `grub2-mkconfig` or `grub2-install`.  Most of them are not required anymore.  Boot entries are generated dynamically by the boot loader, so there is no longer any need to generate GRUB2 configuration files, and installation is just copying the new EFI file into the correct place.
+With GRUB2-BLS, we will no longer have grub2 tools like `grub2-mkconfig` or `grub2-install`.  Most of them are not required anymore. Boot entries are generated dynamically by the boot loader, so there is no longer any need to generate GRUB2 configuration files, and the installation is just copying the new EFI file into the correct location.
 
-The upgrade process is also done by automatically calling `sdbootutil update` from the snapper plugins or the SUSE module tools, so if btrfs is used all the management will be done transparently by this infrastructure, as was done in the traditional boot loader.
+The upgrade process is also done by automatically calling `sdbootutil update` from the snapper plugins or the SUSE module tools, so if btrfs is used, all the management will be done transparently by this infrastructure, as was done in the traditional boot loader.
 
-Updating the kernel command line can be now be done by editing the boot loader, or the `/etc/kernel/cmdline` and calling `sdbootutil update-all-entries` to propagate the change into the boot entries of the current snapshot.
+Updating the kernel command line can now be done by editing the boot loader, or the `/etc/kernel/cmdline` and calling `sdbootutil update-all-entries` to propagate the change into the boot entries of the current snapshot.
 
-To manage the FDE configuration you can learn more in the [openSUSE wiki](https://en.opensuse.org/Portal:MicroOS/FDE).
+To manage the FDE configuration, you can learn more in the [openSUSE wiki](https://en.opensuse.org/Portal:MicroOS/FDE).
 
-<meta name="openSUSE, Open Source, development, Linux, operating systems, Tumbleweed, grub2, sdbootutil, kernel, fde, full disk encryption, systemd" content="HTML,CSS,XML,JavaScript">
+<meta name="openSUSE, Open Source, development, Linux, operating systems, Tumbleweed, grub2, sdbootutil, kernel, fde, full disk encryption, systemd, LUKS2, TPM2, FIDO2, snapper" content="HTML,CSS,XML,JavaScript">