Commit Graph

1614 Commits

Author SHA1 Message Date
tlaurion
160b3d19e7
Merge pull request #1196 from JonathonHall-Purism/dropbear-mirror
dropbear: Use mirror, main host is down
2022-08-02 17:42:47 -04:00
Jonathon Hall
2c3244f48d
dropbear: Use mirror, main host is down
Switch to mirror https://mirror.dropbear.nl/

Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
2022-08-02 17:35:18 -04:00
tlaurion
21505aa5dd
Merge pull request #1194 from Unb0rn/ecc_fix
EC keys support
2022-07-29 11:48:01 -04:00
Victor Bessonov
a221321b6a Allow gpg to select digest algo
EC signatures requires that the digest has the corresponding length. Removing the hardcoded sha2-256 hash function and adding support of sha2-384 and sha2-512 should allow using EC crypto.
2022-07-23 01:10:52 +03:00
tlaurion
2cfa94003b
Merge pull request #1178 from tlaurion/remove_gawk_make_local_build-fix_xx30_maximized-boards_produce_top_bottom_hashes
Remove local gawk and make builds, add xx30 top and bottom hashes under hashes.txt
2022-06-28 12:46:41 -04:00
tlaurion
7c69167e2a
Merge pull request #1183 from tlaurion/QrCode_named_after_boardname
gui-init: Have TPMTOTP QrCode named under TOTP app with $BOARD_NAME
2022-06-23 14:20:11 -04:00
Thierry Laurion
ba9235abcb
xx30 boards: add top bottom roms statements to get hashes under hashes.txt 2022-06-23 11:05:53 -04:00
Thierry Laurion
bf415a8d69
Remove local build of gawk make
-Makefile: remove local gawk and make version compare and local build
-modules: remove gawk and make
-patches: remove make

local make was added to build 4.2.1 on OSes that were having older version. It was then patched to be built on OSes having newer buildstack.
local gawk was added when GPG toolstack was older then libgpg-error 1.37. GPG toolstack was then upgraded, but local gawk stayed.

Removing those permits better parallelization and of builds and reduces CircleCI (and higher cores systems) to have race conditions and stalled builds
2022-06-23 10:51:13 -04:00
tlaurion
d6dfe9328d
Merge pull request #1182 from tlaurion/CircleCI-remove_coreboot_411_boards
CircleCI: Remove coreboot 4.11 builds
2022-06-22 22:01:57 -04:00
tlaurion
46414fa4a2
Changing landing picture to show FBWhiptail 2022-06-22 16:47:05 -04:00
Thierry Laurion
cc28121beb
gui-init: Have TPMTOTP QrCode named under TOTP app with $BOARD_NAME 2022-06-22 16:43:29 -04:00
Thierry Laurion
af26a7ef0c
CircleCI: Remove coreboot 4.11 builds
Coreboot 4.11 boards are not properly building as of now.
coreboot.pre fails to depend on .car.data because of a race condition that can only be mitigated by single threading CPUS=

This is unrelated to other changes.
KGPE-D16 will soon enough depend on dasharo coreboot and be ported upstream later on.
2022-06-22 16:30:05 -04:00
tlaurion
8760551e70
Merge pull request #1174 from tlaurion/mbetls_move_archive_dl_github
modules/mbetls: move dl from tls.mbed.org to github
2022-06-17 18:57:14 -04:00
Thierry Laurion
b6651ee8ec
modules/mbetls: move dl from tls.mbed.org to github
- licensing change to APACHE 2.0
- sha256sum changed too

TODO: bump version to 3.1+, not trivial.
2022-06-17 10:15:00 -04:00
tlaurion
2ddc559653
Merge pull request #1171 from tlaurion/oem-system-info-xx30_fix_missing_exec_mode
oem-system-info-xx30: fix missing exec mode on shell script
2022-06-15 16:13:49 -04:00
Thierry Laurion
810daebc58
oem-system-info-xx30: fix missing exec mode on shell script 2022-06-15 15:40:37 -04:00
tlaurion
55b51610fb
Merge pull request #1164 from tlaurion/system_info_improvements
System info improvements (under separate oem-system-info-xx30 script)
2022-06-13 14:36:30 -04:00
Thierry Laurion
7548580450
create oem-system-info-xx30 (w/trackpad info)
- Take System Info changes from 06311ff068 (Thanks to @nestire)
- Move changes to seperate script under /bin/oem-system-info-xx30
- Add additional camera and wifi card IDs, add synaptic touchpad detection if kernel has module built in

Above changes squashed in this commit.
2022-06-10 10:00:25 -04:00
Thierry Laurion
8e1eeebdee
maximized boards: add ps2mouse modules to maximized kernel cfg 2022-06-10 09:56:36 -04:00
Thierry Laurion
0bfd696fbf
xx20 and xx30: split kernel configs to legacy and maximized and board configs point to them 2022-06-10 09:52:07 -04:00
tlaurion
5a6af8f13d
Merge pull request #1168 from tlaurion/oem-factory-reset_circumvent-hotp-sealing-bug_with-gpg-admin-pin-gt-25-chars
bin/oem-factory-reset: prevent users to choose a GPG Admin PIN > 25 chars which would fail HOTP sealing
2022-06-02 17:22:48 -04:00
Thierry Laurion
32e7031678
bin/oem-factory-reset: prevent users to choose a GPG Admin PIN > 25 chars which would fail HOTP sealing
Fixes https://github.com/osresearch/heads/issues/1167
Circumvents https://github.com/Nitrokey/nitrokey-pro-firmware/issues/32
Adds validation so user cannot enter GPG User PIN > 64 while we are at it.

Note that GPG PINs can be up to 64 characters.
But GPG Admin PIN will fail HOTP sealing with GPG Admin PIN of more then 25 chars.

Edit: change upstream error to firmware issue, not nitrokey-app.
2022-06-02 14:08:39 -04:00
tlaurion
d285401369
Merge pull request #1163 from tlaurion/remove_fedora_public_key
Remove fedora public key. They don't detach sign ISOs since before 2020.
2022-05-17 18:57:48 -04:00
Thierry Laurion
4b9757ceef
Remove fedora public key. They don't detach sign ISOs since before 2020. 2022-05-17 15:54:21 -04:00
tlaurion
79486b5dc8
Merge pull request #1162 from tlaurion/oem-factory-reset_passwd_change-without_reencryption-fix
bugfix: oem-factory-reset - permit LUKS passphrase change without reencryption
2022-05-03 21:07:26 -04:00
Thierry Laurion
dd0e4b0a8d
luks-functions: typo correction and consistent warnings across functions. 2022-05-03 16:45:20 -04:00
Thierry Laurion
37bb4906ce
oem-factory-reset: fix bug where it was impossible to just change LUKS passphrase without reencrypting encrypted container.
Since /etc/luks-functions are currently exporting passphrases tested good per cryptsetup to be reused in the code,
the logic calling both luks_reencrypt and luks_change_passphrase testing for non-empty luks_current_Disk_Recovery_Key_passphrase
was bogus.

This commit includes a new variable luks_new_Disk_Recovery_Key_desired which is set when reencryption is desired.
The 3 use cases (reencrypt+passphrase change, reencrypt no passphrase change and passphrase change alone now only test
for luks_new_Disk_Recovery_Key_desired and luks_new_Disk_Recovery_Key_passphrase_desired, nothing else.
2022-05-03 16:41:07 -04:00
tlaurion
46d64e9f16
Merge pull request #1160 from tlaurion/gen_mac_address_for_maximized_boards
Add Heads mac address randomization for maximized boards
2022-05-02 13:08:59 -04:00
Thierry Laurion
e60287fa1d
bin/network-init-recovery: generate random MAC and set it to eth0
network-init-reovery can be used to automatically set RTC clock to obtained NTP clock.
The script would fail if other devices devices previously registered on the network with the same MAC.
Consequently, maximized boards are detected here, and a full random MAC is generated and used instead of using hardcoded DE:AD:C0:FF:EE.
2022-04-29 10:26:12 -04:00
Thierry Laurion
37a343a49c
etc/functions: Add a function to generate random MAC address 2022-04-29 10:24:02 -04:00
tlaurion
fb5cfd5cc2
Merge pull request #1155 from tlaurion/oem_factory_reset-only_if_no_tpm_disk_unlock_key
oem-factory-reset: Only set default boot option if no TPM Disk Unlock Key
2022-04-15 10:24:41 -04:00
Thierry Laurion
70572fd100
oem-factory-reset: Only set default boot option if no TPM Disk Unlock Key
This continues to generate checksums and sign them per new GPG User PIN, but does not set a default boot option.
The user hitting Default Boot on reboot will go through having to setup a new boot default, which will ask him to setup a Disk Unlock Key if desired.

Otherwise, hitting Default Boot goes into asking the user for its Disk Recovery Key passphrase, and requires to manually setup a default boot option.
2022-04-13 14:29:54 -04:00
tlaurion
3201cd4d95
Merge pull request #1153 from tlaurion/fix_kexec-select-boot
Bugfix: fix accidental removal of --menu statement in kexec-select-boot
2022-04-13 11:58:14 -04:00
Thierry Laurion
4e5f781be3
fix removal of --menu from commit ba054b15c3 2022-04-13 11:15:52 -04:00
tlaurion
1dd03d0361
Merge pull request #1151 from MrChromebox/kexec_improvements
Kexec QOL Improvements
2022-04-07 15:41:44 -04:00
Matt DeVillier
ba054b15c3
kexec-select-boot: use 'fold' to wrap kernel args at 80 char
Prevents truncation via fbwhiptail window

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 14:32:29 -05:00
Matt DeVillier
025f914eb3
kexec-select-boot: Skip duplicate prompt when setting new default boot entry
The text based prompt isn't needed when using a GUI menu for selection/confirmation, so skip it

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 13:21:29 -05:00
Matt DeVillier
19067a9a72
kexec-select-boot: Simplify boot selection confirmation, reverse order
Simplify the menu options by removing the duplication of the entry name
in the menu selections; instead, use clear verbiage to distinish
between booting one time and making the default. And as the majority of
the boot menu is shown is when the grub entires have changed and the
user is prompted to select a new default, so make that the first/default
menu option.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 13:21:27 -05:00
Matt DeVillier
7769d13996
kexec-select-boot: Simplify boot menu entries
Drop the duplicated kernel info which hurts readability, runs off the
end of the menu window. This also makes it easier to identify which
menu option is the default, and more closely resembles the grub menu
shown in a traditional BIOS boot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-07 12:25:37 -05:00
tlaurion
b07833e1b7
Merge pull request #1150 from MrChromebox/luks_cleanup
Luks-reencrypt Cleanup
2022-04-07 09:51:24 -04:00
Matt DeVillier
0f3f86d21e
etc/luks-functions: exit function when select_luks_container() returns non-zero
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:25 -05:00
Matt DeVillier
5b5880b4e8
select_luks_container(): return non-zero when no device found/selected
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:24 -05:00
Matt DeVillier
98c251678c
luks_reencrypt(): remove extraneous call to select_luks_container()
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:24 -05:00
Matt DeVillier
f3d4924646
/bin/reencrypt-luks: rename to /etc/luks-functions
Move/rename as file is only sourced, not directly executed

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2022-04-06 17:17:07 -05:00
tlaurion
4bf4dcbb40
Merge pull request #1145 from tlaurion/seperate_usb-hid_from_usb_requirements_for_usb-keyboard_support
Make loading of usb-hid kernel module dependent only for USB keyboard support
2022-04-06 11:19:00 -04:00
Thierry Laurion
7327f3524e
CircleCI : add x230-maximized_usb-kb board
Testing points:
- x230-hotp-maximized: USB keyboard is not working (confirmed)
- x230-hotp-maximized_usb-kb: USB keyboard is working (confirmed)
2022-04-05 14:36:53 -04:00
Thierry Laurion
6012e7724c
add new board x230-maximized_usb-kb
- this boards is a duplicate of x230-hotp-maximized with USB Keyboard support

Testing points:
- x230-hotp-maximized does not accept input from USB keyboard
- x230-hotp-maximized_usb-kb accepts input from USB keyboard
2022-04-05 14:09:44 -04:00
Thierry Laurion
7b15726e1d
functions: add loading of usb-hid via enable_usb
Testing points:
- All boards explicitely declaring CONFIG_USB_KEYBOARD=y gets USB Keyboard back under Heads
- All other boards are not impacted.
2022-04-05 13:53:09 -04:00
Thierry Laurion
97b124ab8e
adding the usb-hid kernel module inclusion under linux module when CONFIG_USB_KEYBOARD is defined
Testing points:
- None here. Board who exported "CONFIG_USB_KEYBOARD=y" have it packed under their initrd, but there is no logic loading the module yet.
2022-04-05 13:46:48 -04:00
Thierry Laurion
b90f4f53a1
all linux configs: changing usb-hid support from Y to M
Testing point:
- All board configs not explicitely stating export CONFIG_USB_KEYBOARD=y should not have any impact
- librem_l1um, kgpe-d16_workstation-usb_keyboard, librem_mini_v2 and librem_mini will loose USB Keyboard input with this commit alone.
2022-04-05 13:39:29 -04:00