unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed
From: indieterminacy <indieterminacy@libre.brussels>
To: Guix Devel <guix-devel@gnu.org>
Subject: Building Bootloader Images for Owner-Controlled Computers
Date: Wed, 15 Feb 2023 23:34:31 +0100	[thread overview]
Message-ID: <1082f8b3a6d3411ba5ef8090d169a98e@libre.brussels> (raw)

I noticed this recommendation of a Nix tool.
Its not my specialism and Im only providing it for stimulation or as a 
conversation starter.

```
All the necessary components (coreboot, kernel, busybox-based initramfs 
with cryptsetup/lvm2) are stored entirely in the bootloader flash chip. 
This leaves no writable unencrypted media in the boot process when the 
flash chip's write protect pin is shorted.

Ownerboot extends coreboot with a new normal/fallback mechanism. The 
flash chip holds two complete copies of the bootloader; only a single 
page (the bootblock) is shared between them. Each image can be flashed 
and write-protected indepedently of the other. The fallback image can be 
selected by /dev/watchdog, nvramtool, or physical input (front-panel 
button on servers, stylus eject on laptops).

Because ownerboot is written in nix, it can ensure that these builds are 
deterministic. Ownerboot contains no binaries, and instantiates nixpkgs 
with config.allowNonSource=false; if you disable nix's binary 
substituter you are assured that all the software in your bootloader 
will be built from source on your local machine, all the way back to the 
compiler which compiles your compiler.
```
https://sr.ht/~amjoseph/ownerboot/

-- 
Jonathan McHugh
indieterminacy@libre.brussels


                 reply	other threads:[~2023-02-15 22:35 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1082f8b3a6d3411ba5ef8090d169a98e@libre.brussels \
    --to=indieterminacy@libre.brussels \
    --cc=guix-devel@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).