mirror of
https://github.com/linuxboot/heads.git
synced 2024-12-18 20:47:55 +00:00
5021bec3cd
Allow boards to optionally include loadkeys to set a custom keymap. showkey and dumpkeys (normally only needed for development) can also be optionally included. Remove *.map from .gitignore; this was probably intended for build artifacts that are now excluded via the build/ directory. Add reboot and poweroff to shell history, which is useful for devices lacking full hardware keyboards to escape the recovery shell with just "up" and "enter". Signed-off-by: Jonathon Hall <jonathon.hall@puri.sm>
21 lines
1.3 KiB
Plaintext
21 lines
1.3 KiB
Plaintext
#remove invalid kexec_* signed files
|
|
mount /dev/sda1 /boot && mount -o remount,rw /boot && rm /boot/kexec* && mount -o remount,ro /boot
|
|
#Generate keys from GPG smartcard:
|
|
mount-usb && gpg --home=/.gnupg/ --card-edit
|
|
#Copy generated public key, private_subkey, trustdb and artifacts to external media for backup:
|
|
mount -o remount,rw /media && mkdir -p /media/gpg_keys; gpg --export-secret-keys --armor email@address.com > /media/gpg_keys/private.key && gpg --export --armor email@address.com > /media/gpg_keys/public.key && gpg --export-ownertrust > /media/gpg_keys/otrust.txt && cp -r ./.gnupg/* /media/gpg_keys/ 2> /dev/null
|
|
#Insert public key and trustdb export into reproducible rom:
|
|
cbfs -o /media/coreboot.rom -a "heads/initrd/.gnupg/keys/public.key" -f /media/gpg_keys/public.key && cbfs -o /media/coreboot.rom -a "heads/initrd/.gnupg/keys/otrust.txt" -f /media/gpg_keys/otrust.txt
|
|
#Flush changes to external media:
|
|
mount -o,remount ro /media
|
|
#Flash modified reproducible rom with inserted public key and trustdb export from precedent step. Flushes actual rom's keys (-c: clean):
|
|
flash.sh -c /media/coreboot.rom
|
|
#Attest integrity of firmware as it is
|
|
seal-totp
|
|
#Verify Intel ME state:
|
|
cbmem --console | grep '^ME'
|
|
cbmem --console | less
|
|
# Reboot/power off (important for devices with no keyboard to escape recovery shell)
|
|
reboot
|
|
poweroff
|