I'm using the default ubuntu approach with shim and grub2, combined with my own platform key (self-signing shim with sbsign) and an encrypted root partition, to secure boot my ubuntu installation. But this verifies only the grubx64.efi and the kernel, but does not protect the initrd.img and grub.cfg files on the unencrypted boot partition from malicious modifications.
So how can I verify the initrd and the grub configuration, possibly using a sha256 hash, before using them to boot ? That verification could happen in shim, in grub or in some other tool I might use in addition to or instead of shim and/or grub.
The purpose of this question is to prevent from executing the kernel with a modified environment (kernel command line and initrd) in order to prevent from leaking the root partition encryption password to anywhere.
Did not find any methods to verify the boot configuration despite several days of reading web tutorials/blogs about secure boot, including Ubuntu and the Linux Foundation's PreLoader.efi, all of which explaining how the verification of executables including kernel modules works, but none of which mentions the grub.cfg and (shell scripts and config files inside the) initrd, so it looks like I'm the first one to ever ask for verification of non-binaries in the boot process. The best sources I ever found are that of Rod Smith.
What I did not try yet is to modify the source code of shim or grub, creating a fork, or directly contributing to them. Would that be the only way to go ?