# Set up AirgapOS

Because without a Librem 14 there is no easy way to have a secure boot sequence,
instead the AirgapOS `.iso` image is flashed to an SD card, locked using
`sdtool` and then verified using any machine.

## Setup Steps

* Clone the latest AirgapOS version:

    * `git clone git@distrust.co:public/airgap.git`

* Build the image:

    * `cd airgap && make`

* Flash `airgap.iso` to an SD Card:

    * `dd if=out/airgap.iso of=/dev/<your_device> bs=4M status=progress oflag=direct`

* Use the `sdtool` to lock the SD Card:

    * `git clone git@github.com:BertoldVdb/sdtool.git`

    * `cd sdtool`

    * `make`

    * `./sdtool /dev/mmcblk permlock`

    * Test that the card can't be written to:

        * `dd if=out/airgap.iso of=/dev/sdb bs=1M conv=sync status=progress`

* Verify that the hash of `airgap.iso` matches what's flashed on the SD card:

    * `head -c $(stat -c '%s' out/airgap.iso) /dev/sdb | sha256sum`
    * `sha256sum out/airgap.iso`