Commit Graph

338 Commits

Author SHA1 Message Date
Matt DeVillier
6a3bb5897a Drop duplicate board-specific background color configs
Set and export currently-used defaults in gui-init, but still
allow for inidividual boards to override via config if desired.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
95442dccd4 flash-gui: improve readability of ROM filename
Strip the path prefix from the ROM filename, and place on own
line to prevent truncation with long filenames / narrow screens.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
755e9787a7 gui-init: add board name, kernel version to System Info
Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
6df281813f Specify 'friendly' board name vs overriding CONFIG_BOOT_GUI_MENU_NAME
This will allow it to be used elsewhere within the UI.
Rename CONFIG_BOOT_GUI_MENU_NAME to better indicate use/function.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
8b3b8cedb5 gui_init: use consistent notation for main menu
sed -i 's/default boot menu/main menu/g'

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
Matt DeVillier
998dc684f1 gpg_gui: use 'and' vs '+' in menu listings
Using words is more explicit and clear here rather than symbols.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-27 16:19:46 -04:00
MrChromebox
85d7e29d18
Add new board: Purism Librem Server L1UM (#858)
* modules/coreboot: add option to use coreboot 4.11

Port patches from coreboot 4.8.1 to 4.11:
* 0000-measure-boot -> 0001
* 0010-cross-compiler-support

All other patches for coreboot 4.8.1 have either already been
integrated, or are for platforms which do not need to be migrated
to coreboot 4.11 (they will move to 4.12 or newer).

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add Broadwell-DE platform patch

Add a patch for FSP Broadwell-DE to make use of Heads' measured boot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add patch to read serial # from CBFS

Will be used by multiple Librem boards.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: add board support for Librem Server L1UM

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* Librem Server L1UM: add new board

Add board config, coreboot config, kernel config files.
Add conditional purism-blobs dependency to coreboot-4.11 module.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* flash.sh: add special handling for librem_l1um board

Add support for persisting PCIe config via PCHSTRP9 in flash descriptor.
This is needed to support multiple variants of the L1UM server which
use the same firmware but differ in PCIe lane configuration via the
PCH straps configuration in the flash descriptor.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* patches/coreboot-4.11: Add 'Use PRIxPTR to print uintptr_t' patch

Cherry-picked from upstream coreboot (post-4.11), fixes compilation issue.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* CircleCI: add target to build board librem_l1um

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-10-18 14:48:25 -04:00
Tom Hiller
636e40456e
fix: update chesksums of filenames with spaces (#847)
Signed-off-by: Tom Hiller <thrilleratplay@gmail.com>
2020-10-18 14:46:57 -04:00
alex-nitrokey
7baeebe9bf Change hash files only if gpg card is present
Update_checksum was already changing files in /boot, befor checking for
gpg card. If no card is present, the user will end up in the recovery
next time instead of getting the same dialog again. Therefore, the
confirm_gpg_card should be checked before altering files.

The dead -u flag/$update_counter is used to mark the necessisty to
update the hash files now.
2020-10-15 17:05:12 +02:00
alex-nitrokey
c7085d89c3
Remove quotes to fix use of asterisk in command
Changing the default boot was failing because remove the old entries did
not work as `rm "/some/path/*.txt"` does not work as intended, e.g. the
asterisk is no catch-all.
2020-08-26 13:21:57 +02:00
MrChromebox
a075347351
kexec-parse-boot/bls: Strip boot dir from front of grub entries (#804)
Some grub configs/bls entries contain the full paths to the
kernel/initrd files, which the parsers currently fail to handle,
causing a failed boot without any useful error being presented to the user.

To fix this, strip the bootdir prefix from the menu entries when parsing,
should it exist.

Test: build/boot Librem 13v2 w/F32 and bls entries containing absolute paths.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-24 16:42:33 -04:00
tlaurion
ae9fb74759
Merge pull request #763 from Nitrokey/storage-factoryreset
Delete AES keys of Nitrokey Storage after reset
2020-08-06 16:14:01 -04:00
tlaurion
3aa919ade9
Merge pull request #791 from MrChromebox/gui_boot_tweaks
GUI / Boot Device Tweaks
2020-08-06 16:13:21 -04:00
alex-nitrokey
872a4b0488 Merge remote-tracking branch 'upstream/master' into storage-factoryreset 2020-08-05 11:49:18 +02:00
alex-nitrokey
a224c43026 Add PID for Storage 2020-08-05 11:49:06 +02:00
Alexander Paetzelt
c725f869e2
Merge branch 'master' into gpgexport-factoryreset 2020-08-05 10:49:04 +02:00
Matt DeVillier
0b970b745e
config-gui: clean up boot device selection
When a new /boot device is selected, wait until after
successfully mounting the newly-selected device before
updating CONFIG_BOOT_DEV.

Also, don't assume /boot already mounted, as this can cause
a false failure and prevent mounting of the newly-selected device.

Lastly, tidy up the error output in case mounting /boot fails.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-03 18:49:26 -05:00
Matt DeVillier
0afa599491
Fix eval of DEV_NUM_PARTITIONS
Using 'let' in these scripts fails when evaluating to zero
for some reason, so replace with '$(())' which works as intended.

Test: Boot device selection menu shown properly when
new/unpartitioned drive installed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-03 18:48:58 -05:00
Matt DeVillier
244de9de94
gui-init: remove double-prompt for checksum update
Not need to prompt the user twice for the same action

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-03 18:48:38 -05:00
Matt DeVillier
5d641ee5b1
gui-init: Guard TPM reset function with CONFIG_TPM
Attempting to reset the TPM when once isn't present causes a kernel
panic, so let's not allow users to do that.

Test: verify 'No TPM Detected' shown on Librem Mini when Reset TPM
option selected from menu.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-30 14:47:01 -05:00
tlaurion
3c551cc249
Merge pull request #784 from MrChromebox/default_boot_fixes
Fix OEM factory reset and setting of default boot with F32
2020-07-30 15:42:08 -04:00
tlaurion
624faa1a9d
Merge pull request #778 from MrChromebox/usb_gui_tweaks
USB / GUI Tweaks
2020-07-30 13:54:25 -04:00
tlaurion
b9f487aa36
Merge pull request #779 from MrChromebox/pwd_fix
Encapsulate changes to working directory inside subshells
2020-07-30 13:54:15 -04:00
Matt DeVillier
97143953e8
Fix check for valid boot options
-r will always succeed since the file will be generated regardless
of number of boot entries found. Use -s instead to check for zero
file size.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-29 00:24:11 -05:00
Matt DeVillier
4c64ca631a
oem-factory-reset: Fix index used for default boot option
Since we sort the boot options prior to selecting the new default entry,
we need to use the index of the entry in the list prior to being sorted,
vs always setting it as 1. This fixes setting/booting of the default
OS target where the list entries are changed when calling sort.

Test: perform OEM factory reset with Fedora 32 installed, verify
default boot succeeds followng reset.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-29 00:24:01 -05:00
Matt DeVillier
009c10465a
oem-factory-reset: Parse BLS format grub files
The same grub parsing logic used in kexec-select-boot should
be used here as well, so copy it over.

Test: oem-factory-reset succeeds with Fedora 32 installed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-29 00:23:50 -05:00
Matt DeVillier
a89d5a2780
seal-hotp: Fix HOTP key identification
With current implementation, Librem Keys with VID 0x316d are
not identified properly; correct the if/else logic to resolve.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-24 12:45:44 -05:00
tlaurion
7ea13ee000
Merge pull request #761 from Nitrokey/hotp-neutral
Fix branding issue with HOTP USB Security Dongles
2020-07-23 15:05:13 -04:00
Matt DeVillier
2dbe6c9d3b
gui-init: Improve readability of checksum dialogs
Add a linebreak before showing list of files with changed
checksums. Fix text truncation on checksum update prompt.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:48:01 -05:00
Matt DeVillier
5005c92953
oem-factory-reset: Improve readability of error output
Use fold to wrap long lines. Don't show pubkey filename if not needed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:47:55 -05:00
Matt DeVillier
d6ea02d7d5
flash-gui: Improve readability of prompts
Adjust text on GUI dialogs to prevent filenames from being truncated
and to improve clarity/readability.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:47:46 -05:00
Matt DeVillier
ba4fcefcea
usb-scan/mount: Improve USB handling
Currently, /media is mounted once per boot, which causes issues
if a user need to change USB sticks, or unknowning performs an
operation that mounts /media and then needs to access a different
USB stick later (eg, updating the firmware).

To mitigate this, always unmount /media if mounted before scanning
for USB devices, so the user can choose the correct device at the
time of its use.

Additionally, add a unique exit code for user abort so we're not
treating it the same as a failure, and use it to prevent unnecessary
GUI prompts when cancelling selection of a USB device.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:46:59 -05:00
tlaurion
d5262f11d4
Merge pull request #759 from Nitrokey/usb_label
Add partition Label to list of mount-usb
2020-07-18 22:33:03 -04:00
Alexander Paetzelt
d472c43c79
Fix quoting of variable 2020-07-15 09:49:00 +02:00
Matt DeVillier
c2c45dae0e
Encapsulate changes to working directory inside subshells
For the handful of operations which need to be done with /boot
as the pwd, encapsulate them in subshells to ensure the pwd
doesn't unexpectedly change for other operations, as functions
which need to mount/unmount /boot may fail if the pwd isn't root.

Also, set the pwd to root at the start of detect_boot_device as an
added safety measure.

Test: run oem-factory-reset function, ensure it doesn't fail to
detect boot device due to incorrect working directory.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-13 17:30:00 -05:00
Matt DeVillier
f7c4cae903
*gui.sh: move common ops to gui_functions
Move code duplicated across several GUI scripts into a common
gui_functions file and include/use that.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-10 17:37:07 -05:00
Alexander Paetzelt
6fe409aaf3 Still need the exported pubkey file 2020-07-07 11:16:18 +02:00
Alexander Paetzelt
43971dc029 Make export to USB drive an option 2020-07-07 10:32:22 +02:00
Matt DeVillier
cdbd0fcf2a
gui-init: Fix RAM and firmware version strings
Show RAM in GB, since the calculation in MB is imprecise as
it excludes RAM allocated for GPU (eg).

Fix display of firmware version strings which contain spaces by
adjusting cut and simply chopping off the date at the end, which
is a fixed 10-char length.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-01 13:42:10 -05:00
alex-nitrokey
19cd15cf96
Remove gnupg pubkey export in oem-factory-reset
Since #758 is merged, users have a option to export GnuPG pubkey if
necessary. Thus, we they do not need to insert a USB drive during
factory reset. Until now the whole process failed just because a user
did not provide a USB drive instead.

This shall be fixed by this commit
2020-06-30 19:16:10 +02:00
alex-nitrokey
30236ffbaa
Delete AES keys of Nitrokey Storage after reset
If smartcard Nitrokey Storage was factory-reset, we delete AES keys on
it as well.

Explaination: After oem-factory-reset was started the AES on the Nitrokey Storage that is used for the encrypted volume and the password safe is is not usable anymore because the smart card was factory-reset. To make it usable, a user needs to delete it via Nitrokey App. By doing so, the HOTP secret is deleted as well, resulting in a bad warning in Heads. Therefore, we are resetting AES key right after factory-reset with hotp_verification
2020-06-30 18:29:42 +02:00
alex-nitrokey
e0f0655b5d
Merge branch 'hotp-neutral' into storage-factoryreset 2020-06-30 16:17:51 +02:00
alex-nitrokey
84b2f9b540
Re-arrange the order of label and device 2020-06-30 09:28:35 +02:00
tlaurion
d579e731b9
Merge pull request #659 from MrChromebox/mount-usb-status
mount-usb: provide useful output when loading kernel modules
2020-06-28 15:30:16 -04:00
tlaurion
94476bb470
Merge pull request #747 from MrChromebox/factory_reset_no_tpm
oem-factory-reset: Handle non-TPM case
2020-06-28 15:26:16 -04:00
tlaurion
cc572f4c68
Merge pull request #758 from Nitrokey/gpg-export
Add option to export pubkey
2020-06-28 15:08:36 -04:00
alex-nitrokey
53dc659c01
Replace libremkey_htop_* by hotp_* 2020-06-25 15:35:47 +02:00
alex-nitrokey
e418ecbf71
Fix MEMTOTAL calculation 2020-06-25 10:41:01 +02:00
alex-nitrokey
481082f2d8
Include adaption of @MrChromebox
See
5a3f599233
2020-06-25 10:40:25 +02:00
alex-nitrokey
20b07dd1b3
swap label and device and minor formatting change 2020-06-25 09:46:11 +02:00
alex-nitrokey
c2a2134eb2
Merge remote-tracking branch 'upstream/master' into hotp-neutral 2020-06-24 18:22:13 +02:00
alex-nitrokey
fecb9cfd80
Rename CONFIG_HOTP_BRANDING to HOTP_BRANDING
reason: it not a config option anymore
2020-06-24 18:12:56 +02:00
alex-nitrokey
2fe946ccbe
Fix termonology 2020-06-24 17:54:39 +02:00
alex-nitrokey
3236f0e170
Change name seal-libremkey -> seal-hotpkey 2020-06-24 17:45:08 +02:00
alex-nitrokey
5867fc516c
Store HOTP USB Security Key branding in /boot 2020-06-24 17:40:49 +02:00
alex-nitrokey
92b1826537
/boot needs to get mounted first 2020-06-24 17:36:53 +02:00
alex-nitrokey
aab2c327e3
Fix warning box title 2020-06-24 17:25:39 +02:00
alex-nitrokey
407778eb9a
Remove unintented paranthesis 2020-06-24 16:16:03 +02:00
alex-nitrokey
53b67d27a4
Prepare usage of /boot/kexec_hotp_key as branding 2020-06-24 16:11:41 +02:00
alex-nitrokey
c07f3b7f7c
Add systeminfo menu option 2020-06-24 10:07:36 +02:00
alex-nitrokey
6d29ab71f9
dd partition Label to menu list 2020-06-24 09:44:50 +02:00
alex-nitrokey
2763711083
Add option to export pubkey 2020-06-23 15:32:51 +02:00
tlaurion
05c854753c
Merge pull request #625 from MrChromebox/tpm_luks
kexec-save-default: guard TPM LUKS usage with config option
2020-06-18 23:08:54 -04:00
tlaurion
fab603153b
Merge pull request #646 from alex-nitrokey/custom-userinfo
Add option to choose GnuPG userinfo during OEM reset
2020-06-17 14:00:31 -04:00
alex-nitrokey
28735a8c84
Add CONFIG_HOTP_BRANDING 2020-06-11 17:04:03 +02:00
alex-nitrokey
1ba73ac1d5
Rename CONFIG_LIBREMKEY to CONFIG_HOTPKEY 2020-06-11 15:29:51 +02:00
Matt DeVillier
cbad9b6637
oem-factory-reset: Handle non-TPM case
Guard TPM-related bits by checking CONFIG_TPM = y

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-06-09 12:45:39 -05:00
Matt DeVillier
0cae2d7805
kexec-save-default: guard TPM LUKS usage with config option
Add CONFIG_TPM_NO_LUKS_DISK_UNLOCK to allow Librem boards to opt
out of using TPM to store LUKS key, and use it to guard the user
option to add the disk encryption key to the TPM.

Select this option for all Librem boards; all other boards which
select CONFIG_TPM=y will have no change in functionality.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-06-08 11:40:55 -05:00
tlaurion
4245aec857
Merge pull request #706 from tlaurion/network-init-recovery_dhcp-ntp
network-init-recovery script: Request IP from DHCP, NTP time
2020-05-24 11:33:23 -04:00
flawedworld
23735d729a Add T430 board support
Co-authored-by: Sebastian McMillan <22755892+SebastianMcMillan@users.noreply.github.com>
Co-authored-by: Andrew Montoya <halossqwerty@gmail.com>
2020-05-15 18:52:11 +01:00
Matt DeVillier
8d6f47fb4d
mount-usb: suppress error output from calls to stat
If no USB storage devices inserted, stat will output
unnecessary error text to console

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-05-04 11:41:21 -05:00
Matt DeVillier
a2d50a10f7
mount-usb: replace fixed timeout with drive detection
Rather than wait a fixed 5s for the usb storage kernel modules
to load, and the user to insert a drive, check for new USB drives
inserted every 1s with a 5s timeout.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-05-04 11:41:20 -05:00
Thierry Laurion
01dabe19e7
network-init-recovery: do DHCP, then ask NTP from DNS server before attempting sync on internet 2020-04-22 15:00:48 -04:00
alex-nitrokey
a16b97b6ea
Add more input validation
Based on tlaurion's work done here
ff148e4daf/initrd/bin/factory-reset-libremkey.sh (L53)
2020-03-26 15:05:51 +01:00
Matt DeVillier
1bd93d6679
Eliminate use of CONFIG_USB_BOOT_DEV
mount-usb switched to dynamic USB device detection a while back,
so eliminate instances of CONFIG_BOOT_USB_DEV, and derive the
mounted USB device from /etc/mtab in the one place where it's
actually needed (usb-scan). Clean up areas around calls to
mount-usb for clarity/readability.

Addresses issue #673

Test: Build Librem 13v4, boot ISO file on USB

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-02-19 22:32:08 -06:00
tlaurion
76ac9d2259
Merge pull request #683 from MrChromebox/oem-reset-fix
oem-factory-reset: fix GPG key backup filename
2020-02-19 18:04:21 -05:00
tlaurion
e5c7f7397f
Merge pull request #682 from MrChromebox/clean_boot_detect_fix
gui-init: fix checking librem key card-status
2020-02-19 17:57:46 -05:00
Matt DeVillier
83a67d2798
oem-factory-reset: fix GPG key backup filename
fix $GPG_GEN_KEY getting clobbered when using a custom password

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-02-19 16:47:51 -06:00
Matt DeVillier
30b098bfac
gui-init: fix checking librem key card-status
Commit 6b5adcca moved the call to enable_usb from gui-init
to init and guarded it with CONFIG_USB_KEYBOARD, but it was
missed that this is needed for the clean boot check logic
when a librem key is used. Add the call back to gui-init
and guard it properly

Test: clean_boot_detect works properly on a librem 13v4

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-02-19 16:31:39 -06:00
Thierry Laurion
62f180d098
Flash.sh cleanup: Fix FLASHROM_OPTIONS -> CONFIG_FLASHROM_OPTIONS to be exported by Makefile 2020-02-19 17:18:01 -05:00
Matt DeVillier
6b5adcca6f
init: load usb modules for devices using USB keyboard
Some (out of tree) servers require use of a USB keyboard, and need
the USB kernel modules loaded prior to checking for keypress to enter
a recovery console. Since loading the modules affects the value in PRC5
and can cause issues putting a LUKS key in TPM, guard the loading of the
USB modules with CONFIG_USB_KEYBOARD and remove the unguarded call from
gui-init.

This should resolve issues #603 and #674.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-02-19 11:40:34 -06:00
Sebastian McMillan
f0d85ba2d7
Flash.sh cleanup : flashrom specifics now in board configs (#592)
Flash.sh cleanup : flashrom specifics now in board configs (#592)
2020-02-19 12:04:56 -05:00
Matt DeVillier
132dcb2344
flash-gui: set unset variable USB_FAILED
Not setting USB_FAILED when call to mount-usb succeeds results
in a spurious 'sh: 0 unknown operand' error printed to console.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-01-29 13:58:29 -06:00
alex-nitrokey
f0f6e80e95
Add option to choose GnuPG userinfo during OEM reset 2020-01-02 17:29:11 +01:00
Martin Kepplinger
81df949632 oem-factory-reset: Fix description for rebooting when finished
As is in many cases in Heads, not any key will work, just Enter.

Signed-off-by: Martin Kepplinger <martin.kepplinger@puri.sm>
2019-11-26 18:10:39 +01:00
Matt DeVillier
4db6fbd51a
oem-factory-reset: enforce 8-char min on custom password
Since the custom password is used to set the GPG admin
password as well as the TPM and GPG user passwords, an
8-character minimum is required. Inform the user of this,
and validate custom password length upon entry.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-11-25 12:44:56 -06:00
Kyle Rankin
8110b6192c
Merge pull request #628 from MrChromebox/hotp_check_boot
unseal-hotp: ensure /boot mounted before checking HOTP secret
2019-11-25 09:26:07 -08:00
Kyle Rankin
9576a427a0
Merge pull request #627 from MrChromebox/totp_error_prompt
gui-init: update TOTP error prompt
2019-11-25 09:23:21 -08:00
Matt DeVillier
0dbc748233
unseal-hotp: ensure /boot mounted before checking HOTP secret
If /boot isn't mounted, we can't read the HOTP counter, so no
point in reading from the TPM. This speeds up getting to the
main menu in the case of an inaccessible or non-existant /boot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-11-18 21:52:48 -06:00
Matt DeVillier
b9fd6e2708
gui-init: update TOTP error prompt
Update text on TOTP error prompt to provide better
guidance for users following the use of the OEM
factory reset function

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-11-18 21:46:04 -06:00
Kyle Rankin
018279b2bf
Add ability to enter custom password for OEM reset
Normally we resort to default passwords for OEM reset, however we have a
use case where it would be convenient to set a custom password instead.
This patch adds a simple prompt (that defaults to the defaults if you
hit Enter) that enables someone using the OEM reset to enter a single
password that will replace the defaults (TPM, GPG Admin, GPG User).
2019-11-18 11:31:55 -06:00
Matt DeVillier
c14c09b602
flash-gui: clear boot signatures after flashing a cleaned ROM
If the user chooses to flash a "cleaned" ROM (not persisting settings
or GPG keys) then the signatures on /boot are no longer valid, so clear
them out. This allows for the OEM factory reset prompt to be shown on
the next boot.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-11-18 11:17:35 -06:00
Matt DeVillier
5dc9b0b457
config-gui: mount new /boot after selection
Users may wish to temporarily boot an OS from a drive other than
their primary boot drive, without changing the default and saving
to ROM. Mounting /boot after changing the device selection
facilitates this by allowing the user to then choose an unsafe boot
from the newly-selected boot drive.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-11-18 11:16:53 -06:00
Matt DeVillier
0599ce97af
config-gui: fix Save Config option
when commit [928f003] config-gui: add 'Full Reset' option
was added, the bottom end of the save config option was
accidentally truncated; restore it to fix save config option

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-11-18 11:16:49 -06:00
Matt DeVillier
aab9004c53
gui-init: add clean boot check
Add a check to determine if first boot after flashing a cleaned
ROM, and prompt user to run the OEM Factory Reset if so

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-08-21 17:10:25 -05:00
Matt DeVillier
ba23fb7ac2
gpg-gui: remove OEM factory reset option
superseded by newer version in main options menu

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-08-21 17:10:24 -05:00
Matt DeVillier
d8bcc7b841
gui-init: add OEM Factory Reset to options menu
Add an OEM Factory Reset menu option, which performs an
unattended reset and configuration of the device's TPM,
GPG security token, and boot device / boot selection.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-08-21 17:10:24 -05:00
Matt DeVillier
f067d9af23
initrd/bin: add OEM Factory Reset
Add oem-factory-reset script which performs an unattended
reset and configuration of the device's TPM, GPG security token,
and boot device / boot selection.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-08-21 17:10:23 -05:00
Matt DeVillier
a27affcc7d
flash.sh: persist serial in cbfs
Librem devices store their serial number as a text file
in cbfs; persist this across flashes.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-08-05 11:06:46 -05:00
Matt DeVillier
e8e1032027
gpg_add_key_reflash: handle user cancellation
if user chooses abort option, exit without flashing ROM

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2019-08-05 11:03:47 -05:00