cbfs-init used to measure filenames as well as the data in the files,
but after refactoring it only measures file data. This means files
could be renamed, or contents pivoted, without affecting the PCR
measurements. Bring back the filename measurement.
Similarly, insmod used to measure module parameters, but no longer
does. Though we don't currently insert any modules with parameters,
there's no reason to leave this open to break later, bring back the
measurement.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
The 'warn' message was not very effective, because change-time.sh
clears the screen right after. Prompt with whiptail instead, which
also lets the user know what's happening before we drop them into a
series of prompts.
Let the user skip changing time if they really want to. While they
usually should set the time, it's rather frustrating if Heads forces
them to go through these prompts when they don't want to.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
a9e6dfe8 ("config/coreboot-*: Turn off WIFI support in coreboot. If
regression, will turn on case by case") broke builds for Librem 11.
CONFIG_DRIVER_WIFI_GENERIC is required for Librem 11 as it describes
its built-in Wi-Fi card in the device tree.
The CONFIG_DRIVER_INTEL_WIFI driver does not actually seem to be
needed directly, but this is the only way to bring in the generic
driver, which is not selectable itself.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
The added patches fix bugs in fam15h ram DQS timing and configure the motherboard to restart
gracefully if raminit fails instead of booting into an unstable state and/or crashing.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
cbfs-init: remove temp files, measure direct cbfs output, extend PCR with proper introspection tracing
flash.sh: do not die but go to recovery if flashrom fails, cosmetic fix for warning given to user
kexec-insert-key: extend PCR with proper introspection tracing
kexec-select-boot: extend PCR with proper introspection tracing
kexec-measure-luks: extend PCR with proper introspection tracing
tpmr: Add missing TRACE_FUNC, fix comments, extend give hash that was extended to tpm call in DEBUG, fix TPM startsession unsuppressed output still present
ash_functions: extend PCR with proper introspection tracing
insmod: DEBUG info more pertinent, extend PCR with proper introspection tracing
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
This was a yes/no prompt but didn't actually have a question in it,
ask if the user wants to change the time.
Include the current time so the user can tell if it's correct.
Mention that if it's incorrect they should change the time and check
again.
The first line was too long for fbwhiptail by a few characters, trim it
a little.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
We're trying to move all shell scripts to including '.sh' to
differentiate them from functions. While it's not 100% consistent yet,
do it for new scripts.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Adjust prompt wording when entering fields. Technically the desired
value isn't always between min/max, because min and max are also
acceptable :)
No need to repeat an incorrect value, it is right there on the screen
and it dilutes the important point describing what value is needed.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Ask whether to retry instead of always retrying, so users can escape
if there is a problem setting the date instead of being forced to enter
values until it works.
Ask to press Enter instead of "any key". "Any key" prompts are
generally misleading, because there are usually keys that won't
actually work (e.g. Ctrl, Caps Lock, Shift).
Loop to retry if setting the date fails instead of recursing.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
There's little value to offering the minimum field value as a default
IMO:
* it's rarely accurate (e.g. minute 00 is only accuate 1/60 of the time)
* it's very obvious to just press '0'<enter> instead (and no longer
needs to be '00')
* it eliminates a lot of wordiness you otherwise have to read (or more
likely, ignore)
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
There's no need to try to parse stdout/stderr to figure out if date
succeeded, just check if it was successful directly.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Allow Backspace in input. It's really frustrating otherwise if a typo
cannot be corrected, and worse, the backspace key actually produces a
character that becomes part of the input.
Complete input with Enter. It is surprising when the script just
moves on right away once a fourth/second digit is entered, and worse,
users expecting to press Enter could reasonably press it before
realizing the script did not require it, which then skips the _next_
prompt inadvertently. Users with imperfect typing might double a
digit unintentionally, do not force them to proceed with an incorrect
value.
Removing '-n $digits' from read does both of those. Add '-r' so
backslashes do not have unexpected behavior.
Don't require leading zeroes, zero-pad automatically.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
PureOS ISOs still are not detach-signed and it is misleading that there
is a key here. Remove it, we'll add it when the ISOs are signed.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Commit 46cad549 ("WiP flake.nix: make docker image usable for...")
added 'root' to the swtpm_setup call, but broke skip-if-exist because
the flags are supposed to be comma-separated. swtpm_setup was ignoring
skip-if-exist and would fail if the config files exist.
Put a comma there so it works again.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
Use local named variables instead of $1-$4 throughout the function.
This makes the implementation clearer and documents the usage.
Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
