Fedora Linux 45 will introduce a separate, lightweight version of the GRUB bootloader intended for use in confidential computing environments and UEFI-based virtual machines.
Unlike the regular GRUB package that is used in standard Fedora installations, the new version will contain only a minimal number of built-in modules; its aim is to enable the quick booting of Unified Kernel Images, generally known as UKIs, via Bootloader Specification entries while at the same time keeping the bootloader itself as small and as stable as possible.
The new implementation will be developed and made available separately from Fedora’s general-purpose GRUB package. Users will have to choose to install it themselves, and as a result, regular installations and upgrades should not affect compatibility.
The reason for this change is the method by which confidential virtual machines build trust through remote attestation. Such environments check that the system has booted with the expected and trusted software configuration by means of the TPM Platform Configuration Register, or PCR, measurements.
Since updating a bootloader alters the measured values, it results in different PCR values. This can make it difficult for attestation policies that expect measurements to remain stable and predictable over long periods to function as intended.
Since the number of built-in modules is reduced, the bootloader also has a smaller potential attack surface. The final GRUB build will include only the features needed by the virtual-machine workloads for which it is intended, rather than having the full range of features that a general-purpose bootloader would require.
A further significant aspect of the design is its native support for Unified Kernel Images. A UKI bundles the Linux kernel, the initramfs, the command line, and the other boot components into a single EFI executable which can be signed as a whole for Secure Boot.
Even though the new bootloader is primarily designed with UKIs in mind, the proposal states that it can still load conventional kernels and initramfs images if they are placed in the expected locations within the EFI System Partition and accompanied by appropriate BLS configuration files.
The package is already present in Fedora Rawhide for both x86_64 and AArch64 systems, and the current builds are signed for Secure Boot using Fedora’s existing GRUB signing key, although the project anticipates that the lightweight variant will receive its own signing key in the future.
Fedora CoreOS is expected to be the main early adopter of the new package and has already begun testing the implementation. For ordinary Fedora users, the practical impact of the change should be negligible since the standard GRUB packages will continue to be used.
The new build acts as an optional, specialized bootloader for confidential VMs, sealed bootable container images, and similar situations where reliable TPM measurements and a smaller software footprint are important.
Approved by FESCo, the change is expected to debut with Fedora Linux 45, currently scheduled for October 20, 2026. For additional details, see the proposal.
