Andrey Vihrov

Hi, What is your use case for this feature?

Hi, Thanks for the report. This is already described in the [`README`](/andreyv/sbupdate/blob/master/README.md#esp-mount-point). To prevent the attack, `sbupdate` doesn't sign extra files when running from the hook, but only when invoked...

This should now be improved in master. 785bcd1693fe35023045912c8678bc254eb84fee added support for automatic signing of systemd-boot. This happens before systemd-boot is installed on the EFI system partition. 2e4d58c6c6fccbc97abe0bb1c8d3dc4bbb33ae4f clarified in README...

Thanks for the heads-up. This `mkinitcpio` feature implements most of what `sbupdate` does, except the signing process itself. In particular, see the new `example.preset`, where the user is expected to...

Arch Linux also doesn't have `which` in a minimal installation (although `which` is in the `base-devel` group). The provided patch should be the correct solution. From POSIX [`command`](https://pubs.opengroup.org/onlinepubs/9699919799/utilities/command.html): > `-v`...

This is relevant: http://dbp-consulting.com/tutorials/StrictAliasing.html It explains the problem and lists possible solutions.

Well, if the intent is to explicitly load unaligned integers, then two possible choices are to either leave it like it is now (in practice this may "work", I see...

Thanks for the research. I'll look into this further to see if there are any benefits.

Clang bug report with reduced sample: https://github.com/llvm/llvm-project/issues/57894 A workaround is to compile with `-std=c++17` or later. Another workaround is to make the out-of-class member definitions `constexpr`.

We also encountered the same bug in the same way, someone submitted a compiled Java file. The fun part was EvaluationService trying to recompile the same submission every two minutes...