Currently, FIPS https://issues.redhat.com/browse/RHEL-56885#module performs integrity check for kernel in initramfs by basically comparing keyless sha256hmac of /boot/vmlinuz-`uname r` with /boot/.vmlinuz`uname r`.hmac and fails boot process in case of a mismatch. This is not compatible with UKIs as neither /boot/vmlinuz`uname r` nor /boot/.vmlinuz`uname -r`.hmac  are present when 'kernel-uki-virt' package is installed instead of kernel-core.

To make things work for UKIs we can follow the same approach. Create keyless HMAC for /boot/efi/EFI/Linux/<machine-id>-vmlinuz-virt.efi (.<machine-id>-vmlinuz-virt.efi.hmac) and do the comparison. The HMAC file was added to ARK:

• https://gitlab.com/cki-project/kernel-ark/-/merge_requests/3314

and virt-firmware will copy it to the ESP upon kernel install

• https://gitlab.com/kraxel/virt-firmware/-/merge_requests/17

Dracut support was implemented in the following upstream PR:

• https://github.com/dracut-ng/dracut-ng/pull/574