update airgapos provisioning doc
This commit is contained in:
parent
e7e65c35c0
commit
34f8b75dd9
GPG Key ID:
44A86CFF1FDF0E85
|
|
@ -1,34 +0,0 @@
|
|||
/* ANCHOR: all */
|
||||
# Set up AirgapOS
|
||||
|
||||
Because without a Librem 14 there is no easy way to have a secure boot sequence,
|
||||
instead the AirgapOS `.iso` image is flashed to an SD card, locked using
|
||||
`sdtool` and then verified using any machine.
|
||||
|
||||
## Setup Steps
|
||||
// ANCHOR: steps
|
||||
1. Build the software according to the [readme](https://git.distrust.co/public/airgap) in the repository. Use the `make reproduce` command.
|
||||
|
||||
1. Verify the software according to [this](../../../../component-documents/verifying-signatures.md) guide
|
||||
|
||||
1. Flash `airgap.iso` to an SD Card:
|
||||
|
||||
* `dd if=out/airgap.iso of=/dev/<your_device> bs=4M status=progress conv=fsync`
|
||||
|
||||
### Use the `sdtool` to lock the SD Card:
|
||||
|
||||
{{ #include ../sdtool-instructions.md:steps }}
|
||||
|
||||
1. Label the SD card "AirgapOS [version]"
|
||||
|
||||
1. Verify that the hash of `airgap.iso` matches what's flashed on the SD card:
|
||||
|
||||
* `head -c $(stat -c '%s' out/airgap.iso) /dev/sdb | sha256sum`
|
||||
|
||||
* `sha256sum out/airgap.iso`
|
||||
|
||||
1. Commit the hash of airgap to a git repo, ensuring the commit is signed
|
||||
|
||||
// ANCHOR_END: steps
|
||||
|
||||
/* ANCHOR_END: all */
|
||||
|
|
@ -20,12 +20,12 @@
|
|||
|
||||
1. Navigate to the ceremony repository for the ceremony being executed
|
||||
|
||||
1. Create a directory called `payloads/` on the SD card
|
||||
1. Find the SD cards device name using `lsblk`
|
||||
|
||||
1. Copy all transaction workflow payloads from the appropriate dated directory found in `ceremonies/payloads/<date>` into the `payloads/` directory on the SD card
|
||||
1. Write the ceremony repo data to the SD card:
|
||||
|
||||
1. Copy the `shardfile.asc` from the ceremony repository onto the SD card
|
||||
`cp ceremonies/ /media/<device_name>`
|
||||
|
||||
1. Copy the `keyring.asc` from the ceremony repository onto the SD card
|
||||
1. Unplug the SD card
|
||||
|
||||
1. Copy any other `blockchain_metadata/` as required, for example `nonce_address.txt` for SOL transactions
|
||||
1. Turn off the computer
|
||||
|
|
@ -14,8 +14,10 @@
|
|||
|
||||
{{ #include ../../../../component-documents/hardware-procurement-and-chain-of-custody.md:steps}}
|
||||
|
||||
1. Remove packaging from each SD card, and place them into High Visibility Storage
|
||||
|
||||
1. Select 5 SD cards to be tamper proofed from High Visibility Storage
|
||||
|
||||
{{ #include ../../../../component-documents/tamper-evidence-methods.md:vsbwf-procedure-sealing }}
|
||||
|
||||
1. Label the tamper proofed package "SD Booster Pack [date]"
|
||||
1. Label the tamper proofed package "SD Card Pack [date]"
|
||||
|
|
@ -6,15 +6,62 @@
|
|||
|
||||
* Tamper proofing evidence (photographs)
|
||||
|
||||
* Fresh SD card(s)
|
||||
* [SD Card Pack(s)](../procurer/procure-sd-card-pack.md)
|
||||
|
||||
* Bring however many SD cards should be provisioned
|
||||
* High Visibility Storage
|
||||
|
||||
* 2 Computers
|
||||
|
||||
* 1 computer should be able to boot AirgapOS ([compatibility reference](https://git.distrust.co/public/airgap#tested-models))
|
||||
|
||||
## Procedure
|
||||
|
||||
{{ #include ../../../../component-documents/sd-formatting.md:steps }}
|
||||
- remove steps 5 through 8
|
||||
1. Turn on one of the computers - this one will be used for writing the SD cards
|
||||
|
||||
{{ #include ../../../../component-documents/one-time-use-airgapos.md:steps }}
|
||||
1. Build the software according to the [readme](https://git.distrust.co/public/airgap) in the repository.
|
||||
|
||||
1. Use the `make reproduce` command
|
||||
|
||||
1. Unseal the SD Card Pack
|
||||
|
||||
{{ #include ../../../../component-documents/tamper-evidence-methods.md:vsbwf-procedure-unsealing }}
|
||||
|
||||
1. Label each SD card that will be used "AirgapOS [date]"
|
||||
|
||||
1. Place all the SD cards into High Visibility Storage
|
||||
|
||||
1. Retrieve a labelled SD card from High Visibility Storage, and plug it into the computer where AirgapOS will be built
|
||||
|
||||
1. Look for your SD card in the output of the `lsblk` command. It will typically be listed as `/dev/sdX`, where X is a letter (e.g., `/dev/sdb`, `/dev/sdc`). You can identify it by its size or by checking if it has a partition (like `/dev/sdX1`)
|
||||
|
||||
1. Flash `airgap.iso` to an SD Card:
|
||||
|
||||
* `dd if=out/airgap.iso of=/dev/<device_name> bs=4M status=progress conv=fsync`
|
||||
|
||||
1. Reset the computer, and boot the SD card
|
||||
|
||||
1. Once booted, the card needs to be locked using `sdtool` which is available in `AirgapOS`:
|
||||
|
||||
* Find out the block device name using `lsblk`
|
||||
|
||||
* Note: the device will not mount as a proper block device on QubesOS so a different OS has to be used where the device appears as /dev/mmcblk<num>
|
||||
|
||||
1. `./sdtool /dev/<device_name> permlock`
|
||||
|
||||
1. Once burned, unplug the SD card
|
||||
|
||||
1. Plug the SD card into a different computer from the one that was used to write the SD card
|
||||
|
||||
1. Boot the computer
|
||||
|
||||
1. Open a terminal
|
||||
|
||||
1. Create a test file:
|
||||
|
||||
* `echo "test" > test.txt`
|
||||
|
||||
1. Verify the card can't be written to:
|
||||
|
||||
* `dd if=./test.txt of=/dev/<device_name> bs=1M conv=sync status=progress`
|
||||
|
||||
{{ #include ../../../../component-documents/tamper-evidence-methods.md:vsbwf-procedure-sealing }}
|
||||
Loading…
Reference in New Issue