169362ce3d
Add complete Secure Boot implementation: - Generate PK/KEK/db keys during ISO build - Build Unified Kernel Image (UKI) bundling kernel+initramfs+cmdline - Sign UKI with db key for Secure Boot verification - Include kernel lockdown mode in cmdline (lockdown=confidentiality) - Copy .auth files to ISO for UEFI key enrollment All Secure Boot logic is embedded in run.sh as an inline binary hook created during the Docker build process - no separate scripts. Required packages added: efitools, sbsigntools, systemd-boot, binutils VM template updated with TPM v2.0 for Secure Boot measurements. 💘 Generated with Crush Assisted-by: GLM-4.7 via Crush <crush@charm.land>
51 lines
693 B
Plaintext
51 lines
693 B
Plaintext
# Package lists for live-build
|
|
# Core system packages
|
|
linux-image-amd64
|
|
initramfs-tools
|
|
|
|
# Secure Boot support (MANDATORY for UEFI systems)
|
|
shim-signed
|
|
grub-efi-amd64-signed
|
|
grub-efi-amd64-bin
|
|
efibootmgr
|
|
efitools
|
|
sbsigntools
|
|
systemd-boot
|
|
systemd-boot-efi
|
|
binutils
|
|
|
|
# Desktop environment
|
|
icewm
|
|
lightdm
|
|
lightdm-gtk-greeter
|
|
xorg
|
|
xserver-xorg-core
|
|
xserver-xorg-input-all
|
|
|
|
# Applications
|
|
remmina
|
|
remmina-plugin-rdp
|
|
mousepad
|
|
wireguard
|
|
wireguard-tools
|
|
zbar-tools
|
|
pcmanfm
|
|
|
|
# Network utilities (client only - NO inbound services)
|
|
openssh-client
|
|
wireguard
|
|
wireguard-tools
|
|
nftables
|
|
|
|
# Security tools
|
|
auditd
|
|
audispd-plugins
|
|
aide
|
|
aide-common
|
|
rsyslog
|
|
sudo
|
|
|
|
# Filesystem support
|
|
e2fsprogs
|
|
dosfstools
|
|
ntfs-3g |