February 2016 - Arch-releng - lists.archlinux.org

[arch-releng] [RFC 0/4] Add gpg signature verification for the squashfs image
by Thomas Bächler 28 Feb '16

28 Feb '16

I have recently been working on a better and more robust netboot setup. One change is that booting via netboot needs to be secure, i.e. all files need to be verified. One crucial step in this setup is that the squashfs image is verified before the archiso initramfs tries to mount it. This patchset adds a new verify=y option that forces archiso to verify the signature of the squashfs image. In order to build an image with squashfs signatures: 1) Make sure gpg-agent is running for your user before starting the build process. 2) Run su -c "GNUPGHOME=/home/youruser/.gnupg /path/to/build.sh -g yourkeyid"

3 16

[arch-releng] [archiso] [GIT] annotated tag v24 created (now 5092e9b)
by djgera＠archlinux.org 28 Feb '16

28 Feb '16

This is an automated email from the git hooks/post-receive script. djgera pushed a change to annotated tag v24 in repository archiso. at 5092e9b (tag) tagging 80b159345f1892383e48204da61b62aa36dc9455 (commit) replaces v23 tagged by Gerardo Exequiel Pozzi on Sun Feb 28 18:30:25 2016 -0300 - Log ----------------------------------------------------------------- tagging -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABCAAGBQJW02bxAAoJEF7VFKRb1ck4GpoH/2dZ4bDaY1og2vNR5rLowk1f VFricpkBfjwchkXSwCa5F9+J1TQEzvJEDHktCTvpvps8x3gq0O7KaOJfPGFsuKga bRirV8vRnZrRTLUlJMuev2u2t6Z4lWpe/klAmFo5UzJamUGNxZYUfQcZaeE53AB0 ZQT1C2mu2r/8XPheZc1/5g7kUbd940L/J13VNCpPFS+zJ6wk5El9ti5gDkSZAwrI LuUBigDsl/nAzqbzTMFfcxBkWr9Ec7cjC5J9EX6Lk69lJpkd9xFtV9P/puNP525S DJiJB2uqGWJo+LWhcGHe/bWA7IsD7uKckLIu3NFElQAXvqoMCuOscoFKqjbec9s= =Tugs -----END PGP SIGNATURE----- Christian Hesse (2): add boot params archisoflags= and cow_flags= for mount options fix boot parameters for mount options Gerardo Exequiel Pozzi (1): prepare release Thomas Bächler (4): Add gpg to the image and optionally create a keyring Add the verify=y option to verify the squashfs signature with gpg Optionally sign the squashfs files with gpg Optionally sign the squashfs files with gpg and add the gpg key to the initramfs ----------------------------------------------------------------------- No new revisions were added by this update. -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[arch-releng] [archiso] [GIT] branch testing updated (e36e63b -> 80b1593)
by djgera＠archlinux.org 28 Feb '16

28 Feb '16

This is an automated email from the git hooks/post-receive script. djgera pushed a change to branch testing in repository archiso. from e36e63b Optionally sign the squashfs files with gpg and add the gpg key to the initramfs new 80b1593 prepare release The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference. Detailed log of new commits: commit 80b159345f1892383e48204da61b62aa36dc9455 Author: Gerardo Exequiel Pozzi <vmlinuz386(a)gmail.com> Date: Sun Feb 28 18:30:01 2016 -0300 prepare release Signed-off-by: Gerardo Exequiel Pozzi <vmlinuz386(a)gmail.com> Summary of changes: Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[arch-releng] [archiso] [GIT] branch master updated (e36e63b -> 80b1593)
by djgera＠archlinux.org 28 Feb '16

28 Feb '16

This is an automated email from the git hooks/post-receive script. djgera pushed a change to branch master in repository archiso. from e36e63b Optionally sign the squashfs files with gpg and add the gpg key to the initramfs new 80b1593 prepare release The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference. Detailed log of new commits: commit 80b159345f1892383e48204da61b62aa36dc9455 Author: Gerardo Exequiel Pozzi <vmlinuz386(a)gmail.com> Date: Sun Feb 28 18:30:01 2016 -0300 prepare release Signed-off-by: Gerardo Exequiel Pozzi <vmlinuz386(a)gmail.com> Summary of changes: Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[arch-releng] [archiso] [GIT] branch testing updated (5725183 -> e36e63b)
by djgera＠archlinux.org 28 Feb '16

28 Feb '16

This is an automated email from the git hooks/post-receive script. djgera pushed a change to branch testing in repository archiso. from 5725183 fix boot parameters for mount options new 249a52d Add gpg to the image and optionally create a keyring new 1a59eb3 Add the verify=y option to verify the squashfs signature with gpg new b644d3e Optionally sign the squashfs files with gpg new e36e63b Optionally sign the squashfs files with gpg and add the gpg key to the initramfs The 4 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference. Detailed log of new commits: commit e36e63b8f1b3d7324e7e3706fd11fdff4ec24358 Author: Thomas Bächler <thomas(a)archlinux.org> Date: Sat Feb 13 10:08:38 2016 +0100 Optionally sign the squashfs files with gpg and add the gpg key to the initramfs A new option -g <keyid> is added to build.sh set the key id. If it is set, the squashfs files will be signed by gpg and the gpg key will be added to archiso.img. In order to use this option, a gpg agent must be running. Since build.sh is executed as root, it may be necessary to set the GNUPGHOME environment variable, for example $ su -c "GNUPGHOME=/home/youruser/.gnupg /path/to/build.sh -g yourkeyid" commit b644d3e92396e50e54fd66a634e183338f39bea8 Author: Thomas Bächler <thomas(a)archlinux.org> Date: Sat Feb 13 01:08:50 2016 +0100 Optionally sign the squashfs files with gpg A new option -g <keyid> is added to set the key id. The squashfs files are only signed if this option is set. commit 1a59eb379269d5312cb9fd0cde21d5691cae733d Author: Thomas Bächler <thomas(a)archlinux.org> Date: Sat Feb 13 01:08:49 2016 +0100 Add the verify=y option to verify the squashfs signature with gpg commit 249a52d941ca3edbffa4607683220a90be357ebd Author: Thomas Bächler <thomas(a)archlinux.org> Date: Sat Feb 13 10:07:28 2016 +0100 Add gpg to the image and optionally create a keyring If the ARCHISO_GNUPG_FD environment variable is set, its contents will be interpreted as an open file descriptor and its contents will be used to create a keyring in the initramfs in /gpg. Summary of changes: archiso/initcpio/hooks/archiso | 24 ++++++++++++++++++++++++ archiso/initcpio/hooks/archiso_pxe_http | 3 +++ archiso/initcpio/install/archiso | 6 ++++++ archiso/mkarchiso | 13 ++++++++++++- configs/releng/build.sh | 15 ++++++++++++--- 5 files changed, 57 insertions(+), 4 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[arch-releng] [archiso] [GIT] branch master updated (5725183 -> e36e63b)
by djgera＠archlinux.org 28 Feb '16

28 Feb '16

This is an automated email from the git hooks/post-receive script. djgera pushed a change to branch master in repository archiso. from 5725183 fix boot parameters for mount options new 249a52d Add gpg to the image and optionally create a keyring new 1a59eb3 Add the verify=y option to verify the squashfs signature with gpg new b644d3e Optionally sign the squashfs files with gpg new e36e63b Optionally sign the squashfs files with gpg and add the gpg key to the initramfs The 4 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference. Detailed log of new commits: commit e36e63b8f1b3d7324e7e3706fd11fdff4ec24358 Author: Thomas Bächler <thomas(a)archlinux.org> Date: Sat Feb 13 10:08:38 2016 +0100 Optionally sign the squashfs files with gpg and add the gpg key to the initramfs A new option -g <keyid> is added to build.sh set the key id. If it is set, the squashfs files will be signed by gpg and the gpg key will be added to archiso.img. In order to use this option, a gpg agent must be running. Since build.sh is executed as root, it may be necessary to set the GNUPGHOME environment variable, for example $ su -c "GNUPGHOME=/home/youruser/.gnupg /path/to/build.sh -g yourkeyid" commit b644d3e92396e50e54fd66a634e183338f39bea8 Author: Thomas Bächler <thomas(a)archlinux.org> Date: Sat Feb 13 01:08:50 2016 +0100 Optionally sign the squashfs files with gpg A new option -g <keyid> is added to set the key id. The squashfs files are only signed if this option is set. commit 1a59eb379269d5312cb9fd0cde21d5691cae733d Author: Thomas Bächler <thomas(a)archlinux.org> Date: Sat Feb 13 01:08:49 2016 +0100 Add the verify=y option to verify the squashfs signature with gpg commit 249a52d941ca3edbffa4607683220a90be357ebd Author: Thomas Bächler <thomas(a)archlinux.org> Date: Sat Feb 13 10:07:28 2016 +0100 Add gpg to the image and optionally create a keyring If the ARCHISO_GNUPG_FD environment variable is set, its contents will be interpreted as an open file descriptor and its contents will be used to create a keyring in the initramfs in /gpg. Summary of changes: archiso/initcpio/hooks/archiso | 24 ++++++++++++++++++++++++ archiso/initcpio/hooks/archiso_pxe_http | 3 +++ archiso/initcpio/install/archiso | 6 ++++++ archiso/mkarchiso | 13 ++++++++++++- configs/releng/build.sh | 15 ++++++++++++--- 5 files changed, 57 insertions(+), 4 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[arch-releng] How can I unsub from this mailing list?
by delarosa＠openmailbox.org 27 Feb '16

27 Feb '16

Hi guys, How can I unsub from this mailing list? Thanks!

2 1

[arch-releng] [archiso] [GIT] branch testing updated (d1e95f8 -> 5725183)
by djgera＠archlinux.org 05 Feb '16

05 Feb '16

This is an automated email from the git hooks/post-receive script. djgera pushed a change to branch testing in repository archiso. from d1e95f8 prepare release adds 03c296c add boot params archisoflags= and cow_flags= for mount options new 5725183 fix boot parameters for mount options The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference. Detailed log of new commits: commit 57251837166b25e07f39b203d8bb8f5596188f23 Author: Christian Hesse <mail(a)eworm.de> Date: Tue Feb 2 15:45:48 2016 +0100 fix boot parameters for mount options Fixes: 03c296cb4f031148f657b8924460a30c5c9dfecc Signed-off-by: Christian Hesse <mail(a)eworm.de> Summary of changes: archiso/initcpio/hooks/archiso | 14 ++++++++------ archiso/initcpio/hooks/archiso_loop_mnt | 3 ++- docs/README.bootparams | 4 ++++ 3 files changed, 14 insertions(+), 7 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[arch-releng] [archiso] [GIT] branch master updated (03c296c -> 5725183)
by djgera＠archlinux.org 05 Feb '16

05 Feb '16

This is an automated email from the git hooks/post-receive script. djgera pushed a change to branch master in repository archiso. from 03c296c add boot params archisoflags= and cow_flags= for mount options new 5725183 fix boot parameters for mount options The 1 revisions listed above as "new" are entirely new to this repository and will be described in separate emails. The revisions listed as "adds" were already present in the repository and have only been added to this reference. Detailed log of new commits: commit 57251837166b25e07f39b203d8bb8f5596188f23 Author: Christian Hesse <mail(a)eworm.de> Date: Tue Feb 2 15:45:48 2016 +0100 fix boot parameters for mount options Fixes: 03c296cb4f031148f657b8924460a30c5c9dfecc Signed-off-by: Christian Hesse <mail(a)eworm.de> Summary of changes: archiso/initcpio/hooks/archiso | 14 +++++++------- archiso/initcpio/hooks/archiso_loop_mnt | 3 ++- docs/README.bootparams | 4 ++-- 3 files changed, 11 insertions(+), 10 deletions(-) -- To stop receiving notification emails like this one, please contact the administrator of this repository.

1 0

[arch-releng] [PATCH v2 1/1] add boot params archisoflags= and cow_flags= for mount options
by Christian Hesse 05 Feb '16

05 Feb '16

From: Christian Hesse <mail(a)eworm.de> Having files on btrfs subvolumes requires to give mount options. Add boot params archisoflags= and cow_flags= for this purpose. Boot parameters could look like this: ... archisodevice=/dev/sdaX archisoflags=subvolume=isos cow_device=/dev/sdaX cow_flags=subvolume=persist ... Signed-off-by: Christian Hesse <mail(a)eworm.de> --- archiso/initcpio/hooks/archiso | 6 ++++-- docs/README.bootparams | 4 ++++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/archiso/initcpio/hooks/archiso b/archiso/initcpio/hooks/archiso index 3edc76c..b4c0b43 100644 --- a/archiso/initcpio/hooks/archiso +++ b/archiso/initcpio/hooks/archiso @@ -110,6 +110,7 @@ run_hook() { [[ -z "${archisobasedir}" ]] && archisobasedir="arch" [[ -z "${dm_snap_prefix}" ]] && dm_snap_prefix="arch" [[ -z "${archisodevice}" ]] && archisodevice="/dev/disk/by-label/${archisolabel}" + [[ -z "${archisoflags}" ]] && archisoflags="defaults" [[ -z "${cow_spacesize}" ]] && cow_spacesize="256M" if [[ -n "${cow_label}" ]]; then @@ -121,6 +122,7 @@ run_hook() { cow_persistent="N" fi + [[ -z "${cow_flags}" ]] && cow_flags="defaults" [[ -z "${cow_directory}" ]] && cow_directory="persistent_${archisolabel}/${arch}" [[ -z "${cow_chunksize}" ]] && cow_chunksize="8" @@ -135,7 +137,7 @@ archiso_mount_handler() { local newroot="${1}" if ! mountpoint -q "/run/archiso/bootmnt"; then - _mnt_dev "${archisodevice}" "/run/archiso/bootmnt" "-r" + _mnt_dev -o "${archisoflags}" "${archisodevice}" "/run/archiso/bootmnt" "-r" if [[ "${copytoram}" != "y" ]]; then echo $(readlink -f ${archisodevice}) >> /run/archiso/used_block_devices fi @@ -164,7 +166,7 @@ archiso_mount_handler() { fi if [[ -n "${cow_device}" ]]; then - _mnt_dev "${cow_device}" "/run/archiso/cowspace" "-r" + _mnt_dev -o "${cow_flags}" "${cow_device}" "/run/archiso/cowspace" "-r" echo $(readlink -f ${cow_device}) >> /run/archiso/used_block_devices mount -o remount,rw "/run/archiso/cowspace" else diff --git a/docs/README.bootparams b/docs/README.bootparams index 356375d..9737554 100644 --- a/docs/README.bootparams +++ b/docs/README.bootparams @@ -21,6 +21,8 @@ INDEX Default: (unset) * archisodevice= Set the device node where archiso medium is located. Default: "/dev/disk/by-label/${archisolabel}" +* archisoflags= Set extra mount options, e.g. for btrfs subvolumes. + Default: defaults * archisobasedir= Set the base directory where all files reside. Default: "arch" * copytoram= If set to "y" or just "copytoram" without arguments, @@ -35,6 +37,8 @@ INDEX Default: (unset) * cow_device= Like cow_label= but using device node. Default: (unset) or "/dev/disk/by-label/${cow_label}" +* cow_flags= Set extra mount options, e.g. for btrfs subvolumes. + Default: defaults * cow_directory= Set a directory inside ${cow_device}. Default: "/persistent_${archisolabel}/${arch}" * cow_persistent= Set if snapshot is persistent "P" or non-persistent "N". -- 2.6.4

2 4