public
/
airgap
5
0
Fork 1
Code Issues 11 Pull Requests 2 Packages Projects Releases Wiki Activity

Compare commits

base: public:anton/sd-card-instructions
Branches Tags
public:main
public:anton/sd-card-instructions
public:2025.01.03
public:sam/remove-extra-console-shell
public:release/2024.10.x
public:lance/fix-determinism
public:tpm2vm
public:sam/add-user-partition
public:2024.8.1
public:ryansquared/bump-keyfork-v0.2.3
public:release/2024.03.x
public:ryan/update-buildroot
..
compare: public:main
Branches Tags
public:anton/sd-card-instructions
public:2025.01.03
public:main
public:sam/remove-extra-console-shell
public:release/2024.10.x
public:lance/fix-determinism
public:tpm2vm
public:sam/add-user-partition
public:2024.8.1
public:ryansquared/bump-keyfork-v0.2.3
public:release/2024.03.x
public:ryan/update-buildroot

No commits in common. "anton/sd-card-instructions" and "main" have entirely different histories.
anton/sd-c ... main

1 changed files with 0 additions and 35 deletions
Show Stats Expand all files Collapse all files

35
README.md
View File

@ -129,41 +129,6 @@ make vm
make shell make shell
``` ```
## Writing to SD Card ##
1. Flash `airgap.iso` to an SD Card:
* Use `lsblk` to find device name
* `dd if=out/airgap.iso of=/dev/<your_device> bs=4M status=progress conv=fsync`
2. Use the `sdtool` to lock the SD Card:
a. Get deterministically built binary of `sdtool` from StageX:
* `docker pull stagex/sdtool:latest`
b. Extracting binary:
* Run docker container: `docker create -p 4000:80 --name sdtool stagex/sdtool`
* Copy image to tar: `docker export <container_id> -o sdtool.tar`
* Extract binary from tar: `mkdir -p sdtool-dir | tar -xvf sdtool.tar -C sdtool-dir | cp sdtool-dir/usr/bin/sdtool ./sdtool`
* You can verify the container hash:
* To get container hash: `docker inspect --format='{{json .RepoDigests}}' stagex/sdtool`
* Check the [signatures dir](https://codeberg.org/stagex/stagex/src/branch/main/signatures/stagex) in stagex project for latest signed hashes
c. Permanently lock the card:
* `./sdtool /dev/mmcblk permlock`
d. Test that the card can't be written to:
* `dd if=out/airgap.iso of=/dev/sdb bs=1M status=progress conv=fsync`
3. Verify that the hash of `airgap.iso` matches what's flashed on the SD card:
* `head -c $(stat -c '%s' out/airgap.iso) /dev/<your_device> | sha256sum`
* `sha256sum out/airgap.iso`
## Hardware Compatibility ## ## Hardware Compatibility ##
### Tested Models ### Tested Models