NekkoDroid
What’s wrong with rendering?
Oh I dunno, maybe something with almost 700 comments? (HDR).
However session saving is very important for any work, especially office tasks. It’s becoming critical now when all major DEs make Wayland the default.
If apps don’t want to save their state when they close there isn’t much a window manager can do about that. The only part the window manager would be involved in is with positioning its window and that is hardly something very critical to the functionality of an app.
The kernel modules usually are signed with a different key. That key is created at build time and its private key is discarded after the build (and after the modules have been signed) and the kernel uses the public key to validate the modules IIRC. That is how Archlinux enables can somewhat support Secure Boot without the user needing to sign every kernel module or firmware file (it is also the reason why all the kernel packages aren’t reproducible).
And technically you can whitelist other certificates, too, but I have no idea how you might do that.
When you enter the UEFI somewhere there will be a Secure Boot section, there there is usually a way to either disable Secure Boot or to change it into “Setup Mode”. This “Setup Mode” allows enrolling new keys, I don’t know of any programs on Windows that can do it, but sbctl
can do it and the systemd-boot
bootloader both can enroll your own custom keys.
I did hear that one of their newer versions does use eBPF, but I haven’t even remotely looked into it.
I don’t think any of the major distros do it currently (some are working twards it tho), but there are ways (primarily/only one I know is with systemd-boot
). It invokes one of the boot binaries (usually “Unified Kernel Images”) that are marked as “good” or one that still has “tries left” (whichever is newer). A binary that has “tries left” gets that count decremented when the boot is unsuccessful and when it reaches 0 it is marked as “bad” and if it boot successfully it gets marked as “good”.
So this system is basically just requires restarting the system on an unsuccessful boot if it isn’t done already automatically.