Commit Graph

1235 Commits

Author SHA1 Message Date
alex-nitrokey
c7085d89c3
Remove quotes to fix use of asterisk in command
Changing the default boot was failing because remove the old entries did
not work as `rm "/some/path/*.txt"` does not work as intended, e.g. the
asterisk is no catch-all.
2020-08-26 13:21:57 +02:00
MrChromebox
a075347351
kexec-parse-boot/bls: Strip boot dir from front of grub entries ()
Some grub configs/bls entries contain the full paths to the
kernel/initrd files, which the parsers currently fail to handle,
causing a failed boot without any useful error being presented to the user.

To fix this, strip the bootdir prefix from the menu entries when parsing,
should it exist.

Test: build/boot Librem 13v2 w/F32 and bls entries containing absolute paths.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-24 16:42:33 -04:00
MrChromebox
f23ced0a3b
Support Multiple Kernel Options ()
* modules/linux: Add support for multiple kernel versions

Follow same pattern as used for coreboot. Add existing kernel version
as default for all existing boards.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>

* modules/linux: Add option to use 4.19 LTS kernel

Add option to use kernel 4.19.139 (current LTS version).
Duplicate existing patches from 4.14.62 as they all apply cleanly.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-20 19:26:48 -04:00
tlaurion
b14e564ac9
Fix CircleCI build problems ()
* CircleCI: debian:10 docker based. Give possitility to override CACHE_VERSION through CircleCI when needed
* Makefile: fix  with implementation of @osresearch's recommended https://github.com/osresearch/heads/issues/799#issuecomment-673059028
* modules/coreboot : indentation fix and putting version hashes together to facilitate future maintainership.
2020-08-20 15:15:46 -04:00
tlaurion
9eff5c5b70
Merge pull request from MrChromebox/coreboot-4.12
Add option to build against coreboot 4.12
2020-08-17 19:56:03 -04:00
Matt DeVillier
5f9e59afae
modules/coreboot: Add option to build with coreboot 4.12
Add version and hash for coreboot and coreboot-blobs modules.
Adjust to use own toolchain, fix blobs path and extraction depth.

Test: build Librem 13v4 using both coreboot 4.8.1 and coreboot 4.12
(after adjusting board defconfig), verify correct toolchains used to
build each, and that teh result is a bootable ROM.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-13 09:51:22 -05:00
tlaurion
c6a82a2464
CircleCI: mitigate issue () 2020-08-12 15:07:54 -04:00
Patrick Rudolph
28d3b7c89c
patches/coreboot-4.8.1: Measure firmware into PCR2 ()
As part of migration to coreboot 4.12, which includes measured boot
without additional patches, measure all parts of the firmware and the
payload into PCR2.

The same is done in coreboot 4.12. This commit ensures that boards not
migrated yet will show the same behaviour.

TODO: Update heads-wiki.

Signed-off-by: Patrick Rudolph <patrick.rudolph@9elements.com>
2020-08-11 17:54:59 -04:00
tlaurion
63b400c73f
CircleCI : specialized caches ()
CircleCI: two cache save/restore mechanisms. One bound to musl-cross+patches, one for modules + patches.

* Replacing the generic cache bound to CircleCI user to have two caches levels. One for musl-cross and its patchsets, one for all modules and their patchset being the same. So if modules changed, we use the cache for musl-cross as a fallback to economize one hour of precious build time out of two, while most of Heads changes are on the scripts and can be built on top of packages+patches cache
2020-08-11 16:38:26 -04:00
tlaurion
ae9fb74759
Merge pull request from Nitrokey/storage-factoryreset
Delete AES keys of Nitrokey Storage after reset
2020-08-06 16:14:01 -04:00
tlaurion
3aa919ade9
Merge pull request from MrChromebox/gui_boot_tweaks
GUI / Boot Device Tweaks
2020-08-06 16:13:21 -04:00
tlaurion
5dc65f63b6
Merge pull request from Nitrokey/gpgexport-factoryreset
Make gnupg pubkey export an option only in oem-factory-reset
2020-08-06 16:12:53 -04:00
alex-nitrokey
872a4b0488 Merge remote-tracking branch 'upstream/master' into storage-factoryreset 2020-08-05 11:49:18 +02:00
alex-nitrokey
a224c43026 Add PID for Storage 2020-08-05 11:49:06 +02:00
Alexander Paetzelt
c725f869e2
Merge branch 'master' into gpgexport-factoryreset 2020-08-05 10:49:04 +02:00
Matt DeVillier
0b970b745e
config-gui: clean up boot device selection
When a new /boot device is selected, wait until after
successfully mounting the newly-selected device before
updating CONFIG_BOOT_DEV.

Also, don't assume /boot already mounted, as this can cause
a false failure and prevent mounting of the newly-selected device.

Lastly, tidy up the error output in case mounting /boot fails.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-03 18:49:26 -05:00
Matt DeVillier
0afa599491
Fix eval of DEV_NUM_PARTITIONS
Using 'let' in these scripts fails when evaluating to zero
for some reason, so replace with '$(())' which works as intended.

Test: Boot device selection menu shown properly when
new/unpartitioned drive installed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-03 18:48:58 -05:00
Matt DeVillier
244de9de94
gui-init: remove double-prompt for checksum update
Not need to prompt the user twice for the same action

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-08-03 18:48:38 -05:00
tlaurion
06656c4d29
Merge pull request from MrChromebox/guard_tpm_reset
gui-init: Guard TPM reset function with CONFIG_TPM
2020-08-01 15:55:53 -04:00
tlaurion
116787fd03
Merge pull request from Nitrokey/kexec-debian
Fix kexec to work with Debian Installer (fixes )
2020-08-01 15:52:57 -04:00
tlaurion
fb98d0e3e0
Merge pull request from MrChromebox/drop_hotp_patch
modules/hotp-verification: Update and drop patch
2020-08-01 15:25:29 -04:00
alex-nitrokey
83cac9ed14
Fix kexec to work with Debian Installer (fixes )
This patch was reported by @bemoody in issue 

Tested via `BOARD=x230-hotp-verification` on a Thinkpad x230

Signed-off-by: alex-nitrokey <alex@nitrokey.com>
2020-07-30 22:11:05 +02:00
Matt DeVillier
5d641ee5b1
gui-init: Guard TPM reset function with CONFIG_TPM
Attempting to reset the TPM when once isn't present causes a kernel
panic, so let's not allow users to do that.

Test: verify 'No TPM Detected' shown on Librem Mini when Reset TPM
option selected from menu.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-30 14:47:01 -05:00
tlaurion
3c551cc249
Merge pull request from MrChromebox/default_boot_fixes
Fix OEM factory reset and setting of default boot with F32
2020-07-30 15:42:08 -04:00
Matt DeVillier
d6292015a1
modules/hotp-verification: Update and drop patch
Update to nitrokey-hotp-verification master (c0956cf) and drop
existing patch which is no longer needed.

Test: clean build for Librem 13v2

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-30 14:26:59 -05:00
tlaurion
624faa1a9d
Merge pull request from MrChromebox/usb_gui_tweaks
USB / GUI Tweaks
2020-07-30 13:54:25 -04:00
tlaurion
b9f487aa36
Merge pull request from MrChromebox/pwd_fix
Encapsulate changes to working directory inside subshells
2020-07-30 13:54:15 -04:00
Matt DeVillier
97143953e8
Fix check for valid boot options
-r will always succeed since the file will be generated regardless
of number of boot entries found. Use -s instead to check for zero
file size.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-29 00:24:11 -05:00
Matt DeVillier
4c64ca631a
oem-factory-reset: Fix index used for default boot option
Since we sort the boot options prior to selecting the new default entry,
we need to use the index of the entry in the list prior to being sorted,
vs always setting it as 1. This fixes setting/booting of the default
OS target where the list entries are changed when calling sort.

Test: perform OEM factory reset with Fedora 32 installed, verify
default boot succeeds followng reset.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-29 00:24:01 -05:00
Matt DeVillier
009c10465a
oem-factory-reset: Parse BLS format grub files
The same grub parsing logic used in kexec-select-boot should
be used here as well, so copy it over.

Test: oem-factory-reset succeeds with Fedora 32 installed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-29 00:23:50 -05:00
tlaurion
fbbdf67c57
Merge pull request from MrChromebox/fix_hotp_verification
patches: Add patch to fix hotp-verification
2020-07-28 09:49:58 -04:00
Matt DeVillier
302f044e8e
patches: Add patch to fix hotp-verification
Commit 7ea13ee0 made some significant changes to Librem/Nitrokey
verification which broke both compilation and calls to hotp_initialize.
Fix them via a patch until it's fixed upstream.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-28 01:20:06 -05:00
tlaurion
1d6460a3cd
Merge pull request from MrChromebox/update_lk_hotp_verification
modules/hotp-verification: update to upstream master
2020-07-25 22:56:53 -04:00
tlaurion
c89f67077c
Merge pull request from MrChromebox/fix_hotp_id
seal-hotp: Fix HOTP key identification
2020-07-25 22:54:44 -04:00
Matt DeVillier
a89d5a2780
seal-hotp: Fix HOTP key identification
With current implementation, Librem Keys with VID 0x316d are
not identified properly; correct the if/else logic to resolve.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-24 12:45:44 -05:00
Matt DeVillier
efe30b72bf
modules/hotp-verification: update to upstream master
Update hotp-verification to Nitrokey upstream commit 03a198c4.

Test: build/boot Librem 13v4, verify Librem key verification functional.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-23 19:59:46 -05:00
tlaurion
7ea13ee000
Merge pull request from Nitrokey/hotp-neutral
Fix branding issue with HOTP USB Security Dongles
2020-07-23 15:05:13 -04:00
Matt DeVillier
2dbe6c9d3b
gui-init: Improve readability of checksum dialogs
Add a linebreak before showing list of files with changed
checksums. Fix text truncation on checksum update prompt.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:48:01 -05:00
Matt DeVillier
5005c92953
oem-factory-reset: Improve readability of error output
Use fold to wrap long lines. Don't show pubkey filename if not needed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:47:55 -05:00
Matt DeVillier
ffedd3ac11
configs/busybox: include 'fold' utility
Will be used to wrap long error messages so not truncated
when shown in fbwhiptail dialogs.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:47:51 -05:00
Matt DeVillier
d6ea02d7d5
flash-gui: Improve readability of prompts
Adjust text on GUI dialogs to prevent filenames from being truncated
and to improve clarity/readability.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:47:46 -05:00
Matt DeVillier
ba4fcefcea
usb-scan/mount: Improve USB handling
Currently, /media is mounted once per boot, which causes issues
if a user need to change USB sticks, or unknowning performs an
operation that mounts /media and then needs to access a different
USB stick later (eg, updating the firmware).

To mitigate this, always unmount /media if mounted before scanning
for USB devices, so the user can choose the correct device at the
time of its use.

Additionally, add a unique exit code for user abort so we're not
treating it the same as a failure, and use it to prevent unnecessary
GUI prompts when cancelling selection of a USB device.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-21 09:46:59 -05:00
tlaurion
d5262f11d4
Merge pull request from Nitrokey/usb_label
Add partition Label to list of mount-usb
2020-07-18 22:33:03 -04:00
Alexander Paetzelt
d472c43c79
Fix quoting of variable 2020-07-15 09:49:00 +02:00
Matt DeVillier
c2c45dae0e
Encapsulate changes to working directory inside subshells
For the handful of operations which need to be done with /boot
as the pwd, encapsulate them in subshells to ensure the pwd
doesn't unexpectedly change for other operations, as functions
which need to mount/unmount /boot may fail if the pwd isn't root.

Also, set the pwd to root at the start of detect_boot_device as an
added safety measure.

Test: run oem-factory-reset function, ensure it doesn't fail to
detect boot device due to incorrect working directory.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-13 17:30:00 -05:00
tlaurion
9719510f39
Merge pull request from tlaurion/coreboot_481
coreboot: 4.8.1 fixed in Makefile, coreboot module and board configs
2020-07-12 11:51:15 -04:00
Matt DeVillier
f7c4cae903
*gui.sh: move common ops to gui_functions
Move code duplicated across several GUI scripts into a common
gui_functions file and include/use that.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-10 17:37:07 -05:00
Thierry Laurion
5f067ea908
coreboot: 4.8.1 fixed in Makefile, coreboot module and board configs (coreboot_481) to facilitate newer coreboot version integration and testing without breaking old fixed boards 2020-07-10 12:37:11 -04:00
tlaurion
268d9d64ac
Merge pull request from MrChromebox/revert_gpg_toolstack
Revert "upgrade gpg toolstack to latest versions"
2020-07-10 10:07:25 -04:00
Matt DeVillier
5cb45bbc99
Revert "upgrade gpg toolstack to latest versions"
This reverts commit 972c25de7d.

This commit broke OEM factory reset functionality, so revert it
until the issue can be properly diagnosed.

Signed-off-by: Matt DeVillier <matt.devillier@puri.sm>
2020-07-07 17:50:45 -05:00