public
/
airgap
5
0
Fork 1
Code Issues Pull Requests 3 Packages Projects Releases Wiki Activity

Remove broken/blocking coreboot/heads build support

This commit is contained in:
Lance Vick 2022-12-30 16:57:44 -08:00
parent 707e554b82
commit 7dfb2882a6
Signed by: lrvick
GPG Key ID: 8E47A1EC35A1551D
2 changed files with 18 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
Makefile
View File

@ -2,7 +2,6 @@ NAME := airgap
IMAGE := local/$(NAME):latest
ARCH := x86_64
TARGET := $(ARCH)
DEVICES := librem_13v4 librem_15v4
USER := $(shell id -u):$(shell id -g)
CPUS := $(shell docker run -it debian nproc)
GIT_REF := $(shell git log -1 --format=%H config)
@ -53,20 +52,13 @@ mrproper:
docker image rm -f $(IMAGE)
rm -rf $(CACHE_DIR) $(OUT_DIR)
.PHONY: build-fw
build-fw: $(CACHE_DIR)/toolchain.tar
$(call toolchain,$(USER),"build-fw")
mkdir -p $(RELEASE_DIR)
for device in $(DEVICES); do \
cp \
$(CACHE_DIR)/heads/build/$${device}/pureboot*.rom \
$(RELEASE_DIR)/$${device}.rom ; \
done
## Release Targets
.PHONY: release
release: | out/release.env out/airgap.iso out/manifest.txt
release: | \
$(OUT_DIR)/release.env \
$(OUT_DIR)/airgap.iso \
$(OUT_DIR)/manifest.txt
mkdir -p $(RELEASE_DIR)
cp out/release.env $(RELEASE_DIR)/release.env
cp out/airgap.iso $(RELEASE_DIR)/airgap.iso
@ -271,7 +263,6 @@ define toolchain
--env FAKETIME=$(FAKETIME) \
--env BR2_EXTERNAL="/$(BR2_EXTERNAL)" \
--env HEADS_EXTERNAL="/$(HEADS_EXTERNAL)" \
--env DEVICES="$(DEVICES)" \
--env UID="$(shell id -u)" \
--env GID="$(shell id -g)" \
$(IMAGE) \

38
README.md
View File

@ -4,7 +4,7 @@
## About ##
A live buildroot based distribution designed for managing secrets offline.
A live buildroot based Liux distribution designed for managing secrets offline.
Built for those of us that want to be -really- sure our most important secrets
are managed in a clean environment with an "air gap" between us and the
@ -18,19 +18,11 @@ internet with high integrity on the supply chain of the firmware and OS used.
* Store/Restore BIP39 seed to a hardware wallet such as a Trezor or Ledger
## Features ##
* Builds Coreboot-heads firmware for all supported devices for measured boot
* Determinsitic rom/iso generation for multi-party code->binary verification
* Determinsitic iso generation for multi-party code->binary verification
* Small footprint (< 100MB)
* Immutable and Diskless: runs from initramfs
* Network support and most drivers removed to minimize exfiltration vectors
## Supported Devices ##
| Device | TPM Model | TPM Version | Remote Attestation |
|-------------|:--------------:|:-----------:|:-------------------:|
| Librem13v4 | Infineon 9465 | 1.2 | HOTP via Nitrokey |
| Librem15v4 | Infineon 9456 | 1.2 | HOTP via Nitrokey |
## Requirements ##
### Software ###
@ -39,14 +31,14 @@ internet with high integrity on the supply chain of the firmware and OS used.
### Hardware ###
* Supported PC already running coreboot-heads
* Ensure any Wifi/Disk/Bluetooth/Audio devices are removed
* Recommended: PC running coreboot-heads
* Allows for signed builds, and verification of signed sd card payloads
* Ensure any Wifi/Disk/Bluetooth/Audio devices are disabled/removed
* Supported remote attestation key (Librem Key, Nitrokey, etc)
* Supported GPG smartcard device (Yubikey, Ledger, Trezor, Librem Key, etc)
* Blank flash drive
* Blank SD card
## Build ##
### Build a new release
@ -67,19 +59,15 @@ internet with high integrity on the supply chain of the firmware and OS used.
make VERSION=1.0.0rc1 sign
```
## Install ##
1. Place contents of release/$VERSION folder on SD card
2. Boot machine to Heads -> Options -> Flash/Update BIOS
3. Flash firmware via "Flash the firmware with new ROM, erase settings"
4. Insert external Remote attestation key and signing key when prompted
6. Reboot and verify successful remote attestation
7. Boot to shell: Options -> Recovery Shell
8. Mount SD card
9. Insert chosen GPG Smartcard device
10. Sign target iso ```gpg --armor --detach-sign airgap*.iso```
11. Reboot
## Setup ##
1. Insert external Remote attestation key and signing key when prompted
2. Reboot and verify successful remote attestation
3. Boot to shell: Options -> Recovery Shell
4. Mount SD card
5. Insert chosen GPG Smartcard device
6. Sign target iso ```gpg --armor --detach-sign airgap*.iso```
7. Reboot
## Usage ##