Posts tagged infrastructure

A padlock whose body holds three stacked blocks — kernel, initramfs and command line — sealed with a green check. PCR 7 is labelled against the shackle as the Secure Boot policy; PCR 11 against the body as the image's contents and boot phases.

Hardening Short.io’s bare metal nodes: from encrypted disks to verified boot

We wiped a bare metal provider's AlmaLinux installs and rebuilt them with LUKS. Then PCR 7 turned out not to stop a kernel command line edit — signed UKIs did.

Andrii Sep 11, 2026