Ship yay, wire up LUKS disk encryption, self-signed Secure Boot, release signing
yay (yay-bin, AUR-only like calamares/bibata) republished to [breadway] via the same PKGBUILD + Forgejo workflow pattern, so users can reach the wider AUR beyond bakery's bread ecosystem. Disk encryption: Calamares' partition module already has LUKS support enabled by default, but the checkbox led nowhere — no cryptsetup on the live/target image, no mkinitcpio encrypt hook, no GRUB cryptodisk wiring. An encrypted install would partition fine and then never boot. Added cryptsetup, pinned luksGeneration to luks1 (GRUB doesn't support LUKS2 + Argon2id), and post-install.sh now detects an encrypted root (lsblk TYPE == crypt) and conditionally adds the encrypt hook + GRUB_ENABLE_CRYPTODISK + --modules="cryptodisk luks luks2" on both grub-install passes. No effect on a normal unencrypted install. Secure Boot: self-signed via sbctl (shipped in packages.x86_64). BOS can't ship a Microsoft-signed shim without going through Microsoft's own paid UEFI CA process, so post-install.sh enrolls BOS's own keys automatically only when the firmware is already in Setup Mode (sbctl status --json), signs the kernel/bootloader, and leaves it alone otherwise — sbctl's own pacman hook re-signs on every future kernel/GRUB update, no further wiring needed. Release signing: generated a dedicated Ed25519 "BOS Release Signing" key (not reused from anything else), stored as the GPG_PRIVATE_KEY Forgejo Actions secret. release-iso.yml now generates SHA256SUMS and a detached SHA256SUMS.asc signature alongside every ISO upload; public key committed at KEYS.asc with verification instructions in the README. README updated: fixed a stale "greetd + tuigreet" line (breadgreet since round 3), documented yay/encryption/secure-boot/verification.
This commit is contained in:
Breadway
parent
489d472240
commit
5aaf71e80a
8 changed files with 282 additions and 35 deletions
|
|
@ -19,3 +19,15 @@ userSwapChoices:
|
|||
- small
|
||||
- suspend
|
||||
- file
|
||||
|
||||
# Full-disk encryption (LUKS) is enabled by default in Calamares' partition
|
||||
# module (enableLuksAutomatedPartitioning defaults to true) — the checkbox
|
||||
# already shows on the "Erase disk" page with no config needed here. Pin the
|
||||
# LUKS generation explicitly rather than relying on Calamares' own implicit
|
||||
# default: GRUB doesn't support LUKS2 + Argon2id, only PBKDF2, and using the
|
||||
# wrong KDF produces an encrypted install GRUB can't unlock at boot. luks1
|
||||
# is unconditionally safe with BOS's plain grub-install setup (no separate
|
||||
# unencrypted /boot — GRUB itself has to unlock the LUKS container to read
|
||||
# the kernel). See post-install.sh for the matching cryptsetup/mkinitcpio/
|
||||
# GRUB wiring this actually needs to be bootable.
|
||||
luksGeneration: luks1
|
||||
|
|
|
|||
|
|
@ -10,6 +10,19 @@ set -uo pipefail
|
|||
|
||||
MAIN_USER="$(getent passwd 1000 | cut -d: -f1 || true)"
|
||||
|
||||
# Whether Calamares encrypted the root partition (LUKS) — checked once here,
|
||||
# used below to conditionally wire mkinitcpio's encrypt hook and GRUB's
|
||||
# cryptodisk support. `lsblk TYPE` reports "crypt" for a cryptsetup-opened
|
||||
# mapper device regardless of what Calamares named it, so this works whether
|
||||
# the user picked automated "Erase disk" encryption or hand-encrypted a
|
||||
# partition in manual mode.
|
||||
ROOT_SRC="$(findmnt -no SOURCE / | sed 's/\[.*\]//')"
|
||||
if [[ "$(lsblk -no TYPE "$ROOT_SRC" 2>/dev/null)" == "crypt" ]]; then
|
||||
ROOT_ENCRYPTED=1
|
||||
else
|
||||
ROOT_ENCRYPTED=0
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Strip live-only bits that unpackfs copied verbatim from the live medium.
|
||||
# ---------------------------------------------------------------------------
|
||||
|
|
@ -57,6 +70,15 @@ if [[ -f /etc/mkinitcpio.conf ]]; then
|
|||
sed -i 's/^\(HOOKS=.*\budev\b\)/\1 plymouth/' /etc/mkinitcpio.conf \
|
||||
|| echo "WARN: adding plymouth hook failed"
|
||||
fi
|
||||
# encrypt — only when root is actually LUKS-encrypted (ROOT_ENCRYPTED,
|
||||
# detected above). Must sit after `block` (provides the device nodes the
|
||||
# encrypt hook opens) and before `filesystems` (mounts the now-unlocked
|
||||
# root) — both already present in stock mkinitcpio.conf's default HOOKS.
|
||||
if [[ "$ROOT_ENCRYPTED" == "1" ]] \
|
||||
&& ! grep -qE '^HOOKS=.*\bencrypt\b' /etc/mkinitcpio.conf; then
|
||||
sed -i 's/^\(HOOKS=.*\bblock\b\)/\1 encrypt/' /etc/mkinitcpio.conf \
|
||||
|| echo "WARN: adding encrypt hook failed"
|
||||
fi
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
|
|
@ -74,6 +96,17 @@ if command -v plymouth-set-default-theme &>/dev/null; then
|
|||
plymouth-set-default-theme bos || echo "WARN: plymouth-set-default-theme failed"
|
||||
fi
|
||||
|
||||
# GRUB needs to unlock LUKS itself to reach the kernel — there's no separate
|
||||
# unencrypted /boot partition (only /boot/efi is separate). GRUB_ENABLE_CRYPTODISK
|
||||
# makes grub-mkconfig emit the cryptomount commands grub.cfg needs; the
|
||||
# --modules flags below (on both grub-install calls) make sure the cryptodisk
|
||||
# and luks decoders are actually compiled into core.img, not just referenced.
|
||||
if [[ "$ROOT_ENCRYPTED" == "1" ]] && [[ -f /etc/default/grub ]] \
|
||||
&& ! grep -q '^GRUB_ENABLE_CRYPTODISK=' /etc/default/grub; then
|
||||
echo 'GRUB_ENABLE_CRYPTODISK=y' >> /etc/default/grub \
|
||||
|| echo "WARN: adding GRUB_ENABLE_CRYPTODISK failed"
|
||||
fi
|
||||
|
||||
# Rebuild every preset (default + fallback that bos-copy-kernel wrote) so the
|
||||
# microcode + plymouth HOOKS above are actually baked into the initramfs.
|
||||
mkinitcpio -P || echo "WARN: mkinitcpio -P failed"
|
||||
|
|
@ -95,18 +128,20 @@ mkinitcpio -P || echo "WARN: mkinitcpio -P failed"
|
|||
# BIOS: MBR install onto the disk hosting /.
|
||||
# ---------------------------------------------------------------------------
|
||||
if command -v grub-install &>/dev/null; then
|
||||
CRYPT_MODULES=()
|
||||
[[ "$ROOT_ENCRYPTED" == "1" ]] && CRYPT_MODULES=(--modules="cryptodisk luks luks2")
|
||||
if [[ -d /sys/firmware/efi ]]; then
|
||||
grub-install --target=x86_64-efi --efi-directory=/boot/efi \
|
||||
--bootloader-id=BOS --recheck \
|
||||
--bootloader-id=BOS --recheck "${CRYPT_MODULES[@]}" \
|
||||
|| echo "WARN: grub-install (nvram) failed"
|
||||
grub-install --target=x86_64-efi --efi-directory=/boot/efi \
|
||||
--removable --recheck \
|
||||
--removable --recheck "${CRYPT_MODULES[@]}" \
|
||||
|| echo "WARN: grub-install (removable) failed"
|
||||
else
|
||||
ROOT_DEV="$(findmnt -no SOURCE / | sed 's/\[.*\]//')"
|
||||
ROOT_DISK="$(lsblk -no pkname "$ROOT_DEV" 2>/dev/null)"
|
||||
if [[ -n "$ROOT_DISK" ]]; then
|
||||
grub-install --target=i386-pc --recheck "/dev/$ROOT_DISK" \
|
||||
grub-install --target=i386-pc --recheck "${CRYPT_MODULES[@]}" "/dev/$ROOT_DISK" \
|
||||
|| echo "WARN: grub-install (BIOS) failed"
|
||||
else
|
||||
echo "WARN: could not determine the disk hosting / (root device: ${ROOT_DEV:-unknown}) — BIOS grub-install skipped"
|
||||
|
|
@ -117,6 +152,33 @@ if command -v grub-mkconfig &>/dev/null; then
|
|||
grub-mkconfig -o /boot/grub/grub.cfg || echo "WARN: grub-mkconfig failed"
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Secure Boot: self-signed keys via sbctl, only when the firmware is already
|
||||
# in Setup Mode (no vendor PK enrolled — the state a fresh/never-used
|
||||
# machine boots in, or one where the user cleared their firmware's keys
|
||||
# before installing). BOS can't ship a Microsoft-signed shim — that requires
|
||||
# going through Microsoft's own paid UEFI CA signing process — so this is
|
||||
# the realistic path for an Arch-based distro: generate our own keys, enroll
|
||||
# them (plus Microsoft's, so a dual-booted Windows bootmgr and fwupd's
|
||||
# signed capsule updates still verify), and sign the kernel + GRUB. sbctl's
|
||||
# own package ships a pacman hook (zz-sbctl.hook) that re-signs everything
|
||||
# automatically on every future kernel/GRUB update — nothing else to wire up.
|
||||
# Best-effort and silent-skip (not a WARN) when out of Setup Mode — that's
|
||||
# the expected state on most real hardware, not a failure.
|
||||
# ---------------------------------------------------------------------------
|
||||
if [[ -d /sys/firmware/efi ]] && command -v sbctl &>/dev/null; then
|
||||
SETUP_MODE="$(sbctl status --json 2>/dev/null | python3 -c \
|
||||
'import json,sys; print(json.load(sys.stdin).get("setup_mode", False))' 2>/dev/null)"
|
||||
if [[ "$SETUP_MODE" == "True" ]]; then
|
||||
sbctl create-keys || echo "WARN: sbctl create-keys failed"
|
||||
sbctl enroll-keys --microsoft || echo "WARN: sbctl enroll-keys failed"
|
||||
sbctl sign-all -g || echo "WARN: sbctl sign-all failed"
|
||||
echo "Secure Boot: keys enrolled and boot files signed."
|
||||
else
|
||||
echo "Secure Boot: firmware not in Setup Mode — skipped (run 'sudo sbctl enroll-keys --microsoft && sudo sbctl sign-all -g' manually later if desired)."
|
||||
fi
|
||||
fi
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Create @snapshots, @log, @cache as top-level btrfs subvolumes (peers of @,
|
||||
# not nested under it — so snapshots of @ don't recursively include
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue