Skip to content
GitLab
Projects Groups Snippets
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
  • Sign in
  • A archiso
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Graph
    • Compare
    • Locked Files
  • Issues 41
    • Issues 41
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
  • Merge requests 11
    • Merge requests 11
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test Cases
  • Deployments
    • Deployments
    • Releases
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Arch LinuxArch Linux
  • archiso
  • Issues
  • #156
Closed
Open
Issue created Nov 06, 2021 by Tallero Tallero@talleroContributor

Producing (and distributing) encrypted ISOs

Rationale

At first I thought it would have been cool if mkarchiso had support to make ISOs that are able to boot LUKS-encrypted airootfs images.

Then I thought it would have been cooler if it also automatically produced a second ISO to be put on an USB drive or CDROM and to be used as a multi-function dongle which is also able to boot the system when connected.

Then I thought it would have been even cooler if we provided a simple way for users to produce private-ish install drives directly online and on AUR with simple names.

Use cases

  • For users:
    • Producing private install mediums.
    • Producing safer live desktop systems.
    • For new users:
      • Having access to a configuration for a safer system.
  • For developers:
    • Producing safer live developer-level systems.
    • Selling private install mediums.
  • Common
    • any downstream project would benefit from the extra security layer upstream.

Target:

  • Individuals or organizations willing to build encrypted modified installers by themselves for at most distribution in a closed or at least restricted environment.
  • Shops which are authorized to sell Arch merchandise, who could add the "pre-encrypted featureful install drive with dongle"* item to their stores so that one refer a nice startup kit to kids.
  • Individuals or organizations willing to use archiso as a practical tool to manage their systems as easily reproducible immutable snapshots.

Changes

To make that happen I'm proposing (!217 (closed)) to add and extend some new profiledef.sh fields

airootfs_image_type:     ext4+squashfs+luks
                         squashfs+luks
                         erofs+luks
keys_image_type:         same values as above
keys_image_tool_options: same as airootfs_image_tool_options
buildmode:               keys  # when enabled produces the iso/image
                               # for the aforementioned dongle
encryption_key:          <file>
                         auto

For users produce the profiles online, there is an IPython script which can be opened in a Jupyter notebook public online instance like those offered by Wikimedia or Google.

Notes

  • This MR depends on the encrypt hook-compatible branch of mkinitcpio-archiso, which depends on
  • the cryptsetup-nested-cryptkey AUR package, which you can interpret as my I don't know where to send it merge request to add "root on file" compatibility to cryptsetup's package encrypt hook;
  • it already includes !253 (closed).

Testing

A PKGBUILD that builds an ereleng, encrypted releng, has been published as archlinux (AUR).

Private-ish images can be built online with the IPython script in archiso-profiles-git and downloaded from Google Colab, currently only unencrypted profiles build with the provided script.

*I'd like proposals for other useful features it could be mostly be considered free to add to it i.e. bootloader, initramfs pre-configured for pxe.

Edited Jul 06, 2022 by Tallero Tallero
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking