Add support for GnuPG2 #454

osresearch · 2018-09-18T09:41:19Z

This is based on the patches by @duncanguthrie and @tlaurion to fix #435 and #296.

gpg2 and its various libraries adds 430KB to the initrd compared to gnupg1.4.21. This might be a concern for some of the smaller flash systems.

…gpg2

modules/npth

modules/gpg2

modules/libksba

tlaurion

I've pushed things further here: #435 (comment)

modules/gpg2

tlaurion

Please review #435 (comment)

osresearch · 2018-09-19T10:26:57Z

With those library changes and enabling UNIX Domain Sockets with CONFIG_UNIX in the linux config to avoid the socket creation error, I'm able to startupgpg-agent and scdaemon. Generating keys with gpg --gen-key fails due to a missing pinentry program.

I'm trying gpg --gen-key --pinentry-mode loopback, but it is hanging forever while generating entropy, I think.

osresearch · 2018-09-19T10:58:36Z

Building pinentry-1.1.0 in tty mode works, although I'm not sure if it is currently hung waiting for entropy (on qemu) or if there is something else wrong.

tlaurion · 2018-09-19T13:32:06Z

@osresearch : pinentry complains about curses.h missing.
pinentry-curses.c:25:20: fatal error: curses.h: No such file or directory

Edit: fixed below with --disable-fallback-curses

druimalban · 2018-09-19T16:36:10Z

For the record, you don't need pinentry to be built with ncurses support. It can run in the tty on its own.

tlaurion · 2018-09-19T18:27:20Z

modules/pinentry

+	--host x86_64-linux-musl \
+	--prefix "/" \
+	--enable-pinentry-tty \
+	--disable-pinentry-curses \


--disable-pinentry-qt5 \ --disable-pinentry-fltk \ --disable-pinentry-emacs \ + --disable-fallback-curses \ --with-libgpg-error-prefix="$(INSTALL)" \ --with-libassuan-prefix="$(INSTALL)" \

tlaurion · 2018-09-27T17:27:46Z

For the record, you don't need pinentry to be built with ncurses support. It can run in the tty on its own.

@duncanguthrie It was supposed to. It was just not respected :)
the --disable-fallback-curses wasn't either, until placed at the right place.

@duncanguthrie : have insight on this?

jandryuk · 2018-10-03T02:06:20Z

You might need to start gpg-agent with option --scdaemon-program /bin/scdaemon

jandryuk · 2018-10-04T02:11:03Z

gpg-agent looks in /libexec (${libexecdir}) for scdaemon, but Heads packages scdaemon into /bin. A workaround is to pass --libexecdir=/bin to gpg2_configure. The other option is to extend the Heads Makefile to put files into /libexec, but that is more involved.

I haven't gotten to actually testing this with my Nitrokey yet...

tlaurion · 2018-10-05T01:29:46Z

@jandryuk : I've added a gpg-agent.conf that gives scdaemon's path.
gpg --card-edit now works on my Nitrokey Pro V2 :)

see #462

…lly work, tools and libs updated to latest versions

tlaurion · 2018-11-29T18:47:42Z

@jandryuk : I've used gpg2 ang gpg1 only with gpg --card-edit to generate keys, and that works.

Trying to figure out what is wrong with pseudo-random generators. I'm testing on x230, not qemu, but can see that neither works with gpg --gen-key (osresearch/master gpg1 branch and osresearch/gpg2 branch, rebased on master).

It seems that there is not enough action on the host (recovery is doing nothing. May explain it) to generate enough entropy. Haven't had any feedback yet from u-root channel for gpg --gen-key having worked yet.

gpg1: gpg --gen-key complains about a lack of entropy and never gets enough (2 hours waiting)
gpg2: gpg --gen-keystays silent but shows the same absence of keys being generated.

tlaurion · 2018-11-29T19:20:53Z

I confirm, by running gpg --debug-all --gen-key that entropy is missing and filled if typing random keys on keyboard.

Since Heads relies on smartcards to sign configs, is gpg --key-gen missing entropy a false problem?
@osresearch @flammit ?

A couple of solutions could be taken into consideration if entropy generation in Heads is really a need ( I don't think so ).

tlaurion · 2018-11-29T19:32:38Z

The only need I see would be to generate keys from Heads to keep an offline backup of master key, and insert subkeys in the smartcard for daily operations, like proposed, for example, in this guide.

So if this is required, rng-tools could be integrated inside of Heads with HW RANDOM support and a config option added. Look here for other options, out of which rng-tools is recommended.

@kyle @flammit, @osresearch: False need?

jandryuk · 2018-11-29T19:43:36Z

@tlaurion Thanks for tracking down the problem! I am okay with leaving it as-is since it's due to the lack of entropy. I was more concerned there was still something broken with the gpg2 installation causing the hang.

jandryuk · 2018-11-30T02:47:12Z

initrd/init

@@ -5,6 +5,9 @@ echo "hello world" > /dev/ttyprintk
 # Setup our path
 export PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/bin

+#export GPG_TTY STATICALLY (NEED TO FIX)
+export GPG_TTY=/dev/console


Suggested change

export GPG_TTY=/dev/console

export GPG_TTY=$(tty)

tty is installed, so it could be used here. tty returns /dev/console, so that doesn't change.

EDIT: Will redo tests.

@jandryuk : I've took that approach initially. Exiting to recovery shell consequently gives:

echo $GPG_TTY not a tty tty /dev/console

init script doesn't have an access to a TTY.
This is why gpg command verifying signatures is gpg --no-tty, because from a whiptail perspective, it doesn't have access to a shell until ash is spawned. The reason why gpg signing works is because pinentry-tty is called for which requires the tty to be set, else it also fails.

I haven't found a more elegant solution then to hardcode the tty, force the paths to binaries in config and force gpg-agent usage. If you have a better solution, please advise. :)

I'm pretty sure I used $(tty) for qemu's recovery shell and it worked. But that wasn't the whiptail stuff. Can you run the whiptail stuff under qemu?

Anyway, I don't have a better suggestion.

Oh, your call to tty was before /dev/ was mounted. Setting GPG_TTY later works for me in QEMU. Check out this commit: jandryuk@ab8046b

@jandryuk if you want to test fbwhiptail/gui-init, see this branch: https://github.com/flammit/heads/tree/qemu-gui-init. Feel free to drop by u-root.slack.com / #heads channel if you wanna chat live (invite available from slack.u-root.com)

@flammit Oh, I forgot to thank you for the gui branch. Thanks!

gpg2 needs GPG_TTY set to function properly. We set it in /init so it is inherited by all children. The call to $(tty) must be after /dev and (preferably) /dev/pts are mounted. Signed-off-by: Jason Andryuk <[email protected]>

tlaurion · 2018-12-03T17:13:20Z

@osresearch : please merge #491 here.

flammit · 2018-12-10T18:25:51Z

@osresearch once #491 is in, this LGTM. Tested on x230 and qemu and tested repro on Ubuntu 16.04, Fedora Server 29, Fedora Workstation 29.

Note: you'll need to update your key files to only include the public key of the yubikeys, so the easiest way is to cbfs -o build/x230/coreboot.rom -a "heads/initrd/.gnupg/keys/pub.key" -f {your_pub_key.file}, then do a flash.sh -c coreboot.rom in Heads (which will ignore the initrd files you previously had in the rom).

itay-grudev · 2018-12-30T11:03:25Z

Is this PR stable at the moment? I'd like to try it on the Librem 13 v3.

tlaurion · 2018-12-31T02:18:29Z

@itay-grudev : yes. You have to merge #491 on top of this one and you're good to go.

itay-grudev · 2019-01-03T12:49:08Z

I have the following problem when I attempt to update my /boot signatures after switching to the gpg2 branch.

gpg: gpg-agent is not available in this session
gpg: Sorry, no terminal at all requested - can't get input
/boot: Unable to sign kexec hashes
Failed to sign default config

It ends with a kernel panic.

itay-grudev · 2019-01-03T14:00:49Z

I also had a problem adding my GPG key. I ended up flashing to a non gpg2 ROM, adding it and then switching to gpg2. The key just wasn't being added.

itay-grudev · 2019-01-03T14:37:06Z

gpg: Sorry, no terminal at all requested - can't get input

Fixed in #505.

itay-grudev · 2019-01-03T18:56:43Z

After I switched to this branch and compiled this I noticed that gpg is still using version 1.x. And I am also the following error when I use a 4096 bit key:

gpg: BAD signature from key_id_here

Please advise.

itay-grudev · 2019-01-04T07:29:07Z

The GPG2 flag wasn't set for the Librem platforms so GPG2 wasn't built. I added that in #505. Now I have another issue. Looks like libsecret is missing as a dependency.

Making all in pinentry
make[3]: Entering directory '/home/user/Projects/heads/build/pinentry-1.1.0/pinentry'
/home/user/Projects/heads/install/bin/musl-gcc -fdebug-prefix-map=/home/user/Projects/heads=heads -gno-record-gcc-switches -D__MUSL__  -DHAVE_CONFIG_H -I. -I..  -pthread -I/home/user/Projects/heads/install/usr/include/libsecret-1 -I/home/user/Projects/heads/install/usr/include/glib-2.0 -I/home/user/Projects/heads/install/usr/lib/x86_64-linux-gnu/glib-2.0/include -I//include -I//include  -I../secmem -Wall  -g -O2 -Wall -Wno-pointer-sign -Wpointer-arith -MT password-cache.o -MD -MP -MF .deps/password-cache.Tpo -c -o password-cache.o password-cache.c
password-cache.c:30:31: fatal error: libsecret/secret.h: No such file or directory
compilation terminated.
make[3]: *** [Makefile:417: password-cache.o] Error 1
make[3]: Leaving directory '/home/user/Projects/heads/build/pinentry-1.1.0/pinentry'
make[2]: *** [Makefile:465: all-recursive] Error 1
make[2]: Leaving directory '/home/user/Projects/heads/build/pinentry-1.1.0'
make[1]: *** [Makefile:405: all] Error 2
make[1]: Leaving directory '/home/user/Projects/heads/build/pinentry-1.1.0'
make: *** [Makefile:356: /home/user/Projects/heads/build/pinentry-1.1.0/.build] Error 1

itay-grudev · 2019-01-04T07:34:30Z

Fixed in #505

itay-grudev · 2019-01-04T07:48:54Z

With #505: Compiled successfully. GPG2 works fine. Signing works fine. Verification works fine. Tested on a Librem 13 v3 with a 4096 bit RSA key.

itay-grudev · 2019-01-17T16:25:23Z

@tlaurion CONFIG_GPG is no longer required for CONFIG_GPG2 builds, right?

tlaurion · 2019-01-18T04:28:21Z

@tlaurion CONFIG_GPG is no longer required for CONFIG_GPG2 builds, right?

@itay-grudev Exact. CONFIG_GPG->CONFIG_GPG2 in board configs.

Set GPG_TTY before calling gpg in key-init

GPG2 Fixes

tlaurion · 2019-01-26T20:56:53Z

Please merge #510 instead.

druimalban and others added 5 commits January 5, 2018 21:09

Preliminary support for GnuPG2

df4438a

Merge branch 'gnupg2' of https://github.com/duncanguthrie/heads into …

d740fe4

…gpg2

copy gpg2 executables and pass in the libusb include path

df8462a

switch to gpg2 for qemu targets

aa2d3cd

use full version names on output libraries

533f18a

osresearch added enhancement initrd security labels Sep 18, 2018

tlaurion reviewed Sep 19, 2018

View reviewed changes

modules/npth Outdated Show resolved Hide resolved

tlaurion reviewed Sep 19, 2018

View reviewed changes

modules/gpg2 Outdated Show resolved Hide resolved

tlaurion reviewed Sep 19, 2018

View reviewed changes

modules/libksba Outdated Show resolved Hide resolved

tlaurion reviewed Sep 19, 2018

View reviewed changes

modules/gpg2 Outdated Show resolved Hide resolved

tlaurion requested changes Sep 19, 2018

View reviewed changes

osresearch and others added 3 commits September 19, 2018 06:32

enable Unix Domain sockets for gpg-agent

921010f

gpg2 library fixes

cb418ca

gpg2 pinentry program is required for passwords or PINs

cc062bd

typo on pinentry

8fbe910

tlaurion reviewed Sep 19, 2018

View reviewed changes

tlaurion mentioned this pull request Sep 19, 2018

Upgrade GnuPG to 2.2.9 #435

Closed

required changes to apply on top of osresearch/gpg2 for gpg2 to actua…

87c85ca

…lly work, tools and libs updated to latest versions

This was referenced Oct 5, 2018

required changes to apply on top of osresearch/gpg2 #462

Merged

Adding cryptsetup-reencrypt support. First step into getting OEM predeployed QubesOS machines #464

Merged

jandryuk reviewed Nov 30, 2018

View reviewed changes

Set GPG_TTY before calling gpg in key-init

186d211

gpg2 needs GPG_TTY set to function properly. We set it in /init so it is inherited by all children. The call to $(tty) must be after /dev and (preferably) /dev/pts are mounted. Signed-off-by: Jason Andryuk <[email protected]>

tlaurion mentioned this pull request Dec 3, 2018

Set GPG_TTY before calling gpg in key-init #491

Merged

tlaurion mentioned this pull request Dec 22, 2018

proposal: second qubes-certified laptop is Lenovo Thinkpad x220/x230 QubesOS/qubes-issues#1771

Closed

5 tasks

Removed --no-tty as it disables the card admin PIN pinentry

765bdbc

Enabled GPG2 in the Librem board config

979dc68

Disabled libsecret support in the pinentry module

2b7c3b8

Code style fix

142d601

tlaurion mentioned this pull request Jan 17, 2019

remove CONFIG_GPG=y #508

Merged

tlaurion added 2 commits January 26, 2019 11:42

Merge pull request #491 from tlaurion/gpg2_dynamic_tty

5eeb78b

Set GPG_TTY before calling gpg in key-init

Merge pull request #505 from itay-grudev/gpg2-fix

1699771

GPG2 Fixes

tlaurion closed this Feb 8, 2019

Add support for GnuPG2 #454

Add support for GnuPG2 #454

Conversation

osresearch commented Sep 18, 2018

tlaurion left a comment

Choose a reason for hiding this comment

tlaurion left a comment

Choose a reason for hiding this comment

osresearch commented Sep 19, 2018

osresearch commented Sep 19, 2018

tlaurion commented Sep 19, 2018 • edited Loading

druimalban commented Sep 19, 2018

tlaurion Sep 19, 2018 • edited Loading

Choose a reason for hiding this comment

tlaurion commented Sep 27, 2018

jandryuk commented Oct 3, 2018

jandryuk commented Oct 4, 2018

tlaurion commented Oct 5, 2018 • edited Loading

tlaurion commented Nov 29, 2018 • edited Loading

tlaurion commented Nov 29, 2018

tlaurion commented Nov 29, 2018 • edited Loading

jandryuk commented Nov 29, 2018

jandryuk Nov 30, 2018

Choose a reason for hiding this comment

tlaurion Nov 30, 2018 • edited Loading

Choose a reason for hiding this comment

tlaurion Nov 30, 2018

Choose a reason for hiding this comment

jandryuk Dec 1, 2018

Choose a reason for hiding this comment

jandryuk Dec 1, 2018

Choose a reason for hiding this comment

flammit Dec 1, 2018

Choose a reason for hiding this comment

jandryuk Dec 5, 2018

Choose a reason for hiding this comment

tlaurion commented Dec 3, 2018

flammit commented Dec 10, 2018 • edited Loading

itay-grudev commented Dec 30, 2018 • edited Loading

tlaurion commented Dec 31, 2018

itay-grudev commented Jan 3, 2019 • edited Loading

itay-grudev commented Jan 3, 2019 • edited Loading

itay-grudev commented Jan 3, 2019

itay-grudev commented Jan 3, 2019 • edited Loading

itay-grudev commented Jan 4, 2019

itay-grudev commented Jan 4, 2019

itay-grudev commented Jan 4, 2019

itay-grudev commented Jan 17, 2019

tlaurion commented Jan 18, 2019 • edited Loading

tlaurion commented Jan 26, 2019

tlaurion commented Sep 19, 2018 •

edited

Loading

tlaurion Sep 19, 2018 •

edited

Loading

tlaurion commented Oct 5, 2018 •

edited

Loading

tlaurion commented Nov 29, 2018 •

edited

Loading

tlaurion commented Nov 29, 2018 •

edited

Loading

tlaurion Nov 30, 2018 •

edited

Loading

flammit commented Dec 10, 2018 •

edited

Loading

itay-grudev commented Dec 30, 2018 •

edited

Loading

itay-grudev commented Jan 3, 2019 •

edited

Loading

itay-grudev commented Jan 3, 2019 •

edited

Loading

itay-grudev commented Jan 3, 2019 •

edited

Loading

tlaurion commented Jan 18, 2019 •

edited

Loading