Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Installing Qubes on Heads is hard #27

Closed
osresearch opened this issue Sep 16, 2016 · 2 comments
Closed

Installing Qubes on Heads is hard #27

osresearch opened this issue Sep 16, 2016 · 2 comments
Labels
enhancement
Milestone
usability

Comments

@osresearch
Copy link
Collaborator

There should be some shell scripts in the Heads ROM initrd to make it easier.
@osresearch osresearch added this to the usability milestone Sep 16, 2016
@osresearch osresearch mentioned this issue Nov 29, 2016
Closed
@osresearch osresearch mentioned this issue Jan 23, 2017
Closed
@osresearch
Copy link
Collaborator Author

This is getting easier -- the new seal-key script handles almost all of the key management: f99944a

osresearch added a commit that referenced this issue Apr 12, 2017
@osresearch
helper to do a forcible TPM reset (issue #27)
ea9b2c0
osresearch added a commit that referenced this issue Apr 12, 2017
@osresearch
helper to install qubes from the recovery shell (issue #27)
8d2d6ad
osresearch added a commit that referenced this issue Apr 12, 2017
@osresearch
Rework /init and qubes setup scripts (issue #27, #155, #32, #29, #110)
353a0ef 
This adds support for seamless booting of Qubes with a TPM disk key,
as well as signing of qubes files in /boot with a Yubikey.

The signed hashes also includes a TPM counter, which is incremented
when new hashes are signed.  This prevents rollback attacks against
the /boot filesystem.

The TPMTOTP value is presented to the user at the time of entering
the disk encryption keys.  Hitting enter will generate a new code.

The LUKS headers are included in the TPM sealing of the disk
encryption keys.
@osresearch
Copy link
Collaborator Author

There are many scripts to make this easier and I've started documenting how to use them. There are also new scripts to help when an update is performed to sign the new files in /boot and increment the TPM counter (issue #155) to prevent rollback attacks.

tlaurion pushed a commit to tlaurion/heads that referenced this issue May 3, 2024
@tasket
check lv size.
6a94f24 
fixes issue linuxboot#27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement
Projects
None yet
Milestone
usability
Development

No branches or pull requests
1 participant
@osresearch