airgap/README.md

112 lines
2.3 KiB
Markdown
Raw Normal View History

# AirgapOS #
2020-06-15 18:04:50 +00:00
2021-06-19 19:02:17 +00:00
<https://github.com/distrust-foundation/airgap>
2020-06-15 18:04:50 +00:00
## About ##
A live buildroot based Liux distribution designed for managing secrets offline.
2020-06-15 18:04:50 +00:00
Built for those of us that want to be -really- sure our most important secrets
are managed in a clean environment with an "air gap" between us and the
internet with high integrity on the supply chain of the firmware and OS used.
2020-06-15 18:04:50 +00:00
## Uses ##
* Generate GPG keychain
* Store/Restore gpg keychain to security token such as a Yubikey or Nitrokey
* Signing cryptocurrency transactions
* Generate/backup BIP39 universal cryptocurrency wallet seed
* Store/Restore BIP39 seed to a hardware wallet such as a Trezor or Ledger
2020-06-15 18:04:50 +00:00
## Features ##
* Determinsitic iso generation for multi-party code->binary verification
* Small footprint (< 100MB)
* Immutable and Diskless: runs from initramfs
* Network support and most drivers removed to minimize exfiltration vectors
2020-06-15 18:04:50 +00:00
## Requirements ##
### Software ###
* docker 18+
### Hardware ###
* Recommended: PC running coreboot-heads
* Allows for signed builds, and verification of signed sd card payloads
* Ensure any Wifi/Disk/Bluetooth/Audio devices are disabled/removed
* Supported remote attestation key (Librem Key, Nitrokey, etc)
* Supported GPG smartcard device (Yubikey, Ledger, Trezor, Librem Key, etc)
* Blank flash drive
* Blank SD card
2020-06-15 18:04:50 +00:00
## Build ##
2022-12-26 09:22:00 +00:00
### Build a new release
```
2022-12-26 09:22:00 +00:00
make VERSION=1.0.0rc1 release
```
2022-12-26 09:22:00 +00:00
### Reproduce an existing release
```
2022-12-26 09:22:00 +00:00
make VERSION=1.0.0rc1 attest
```
2022-12-26 09:22:00 +00:00
### Sign an existing release
```
make VERSION=1.0.0rc1 sign
```
2020-06-15 18:04:50 +00:00
## Setup ##
Assumes target is running Pureboot or Coreboot/heads
1. Boot to shell: ```Options -> Recovery Shell```
2. Mount SD card
```
mount-usb
mount -o remount,rw /media
```
3. Insert chosen GPG Smartcard device
4. Initialize smartcard
```
gpg --card-status
```
5. Sign target iso
```
cd /media
gpg --armor --detach-sign airgap.iso
```
6. Unmount
```
cd
umount /media
sync
```
7. Reboot
## Usage ##
1. Insert remote attestation device
2. Power on, and verify successful remote attestation
3. Boot to airgap via: Options -> Boot Options -> USB Boot
2020-06-15 18:04:50 +00:00
## Development ##
### Build develop image
```
make
```
2020-06-15 18:04:50 +00:00
### Boot image in qemu
2020-06-15 18:04:50 +00:00
```
make vm
```
### Enter shell in build environment
```
make shell
```