github.com/tlaurion/heads-ci-fedora30 commits

CircleCI based on Fedora:30 for x230-libremkey (PrivacyBeast X230)

80570fe4e46f016891282a0d5282b3c8b5715423 authored about 5 years ago by Thierry Laurion <[email protected]>

CircleCI based on Ubuntu 18.04 for x230libremkey (PrivacyBeast)

c1cadb2adc3bdd8f5622945ce4f141ca4f6346d8 authored about 5 years ago by Thierry Laurion <[email protected]>

Rollback musl-cross to last known working commit

6d2647edb3c294566eb21cae22a566b53ee536d0 authored about 5 years ago by Francis Lam <[email protected]>

LVM2 segfaults. Bringing par to master

d4df22752f5f7f09ee9c04d982f3769eb8a7f1fe authored about 5 years ago by Thierry Laurion <[email protected]>

Kernel upgrade patches didn't follow. fixing

d0b5b19a81a575559fc104a831e1e4254bdc68d0 authored about 5 years ago by Thierry Laurion <[email protected]>

x230-libremkey: top and bottom flash are now exported. But CBFS region inside of coreboot config needs to reflect BIOS region. Fixed arbitrary value to 0x700000 but do not know how to calcultate properly

fbdd3694f8f27047a05f9e1f4380d64967e8da38 authored about 5 years ago by Thierry Laurion <[email protected]>

X230 PrivacyBeast blobs: were text based commit. Those are binary files

46b5207b0bec001f723e7b6257f79179b1f61e26 authored about 5 years ago by Thierry Laurion <[email protected]>

GitlabCI: Add bottom and up roms in artifact produced.

12e2aa016cc7012badaf260042bfe7f19dd9bb23 authored about 5 years ago by Thierry Laurion <[email protected]>

x230-libremkey: add shrinked deactivated+neutered ME and expended ifd in blobs, expend CBFS region in coreboot config and link precedent blobs, include bases for thin-provisioning-tools in linux config

c60514cccf3ff9c0927fc032a275c494f52a7b26 authored about 5 years ago by Thierry Laurion <[email protected]>

Merge branch 'PrivacyBeast_X230_QubesOS_Certified_merge-cross' into PrivacyBeast_X230_QubesOS_Certified

549a077ab667c53f94bab5e4eb7586655dcf86a4 authored about 5 years ago by Thierry Laurion <[email protected]>

Making it pair with musl-cross-pin

ac4d65e0a93b1008542ec188638f4381d4c4067f authored about 5 years ago by Thierry Laurion <[email protected]>

OEM: fixing logic in PrepareOrder

4e76345566d446fe5ab9ce739f42055d8de85f16 authored about 5 years ago by Thierry Laurion <[email protected]>

GitlabCI: based on fedora:30 docker base image

48148a1231e4029e5820e987d968d6b172d76dea authored about 5 years ago by Thierry Laurion <[email protected]>

Manually merge diffs from musl-cross-pin branch (TODO: find back original commits of change and cherry-pick)

72751e38e90b0caec9753ca1d3404ce6b1f927ed authored about 5 years ago by Thierry Laurion <[email protected]>

GitlabCI: docker image based on fedora:30

1131a1bfac47b9b79f23e5b6e4debacdd34634f8 authored about 5 years ago by Thierry Laurion <[email protected]>

modules: add module_tar_opt to allow different strip options

Signed-off-by: Trammell hudson <[email protected]>

cf77d7cd75034c436d86152193b8a0e99dcd426c authored about 5 years ago by Trammell hudson <[email protected]>

update musl-cross to 1952975

this should fix issues with compressed ELF header sections.

179110c09b11c9e0d021fa11f371dcbf079890ef authored about 5 years ago by rofl0r <[email protected]>

pin msrtools and tpmtotp to current git heads

Signed-off-by: Trammell hudson <[email protected]>

45dfeeed2835a516eddf2c8019713cc4916764d2 authored about 5 years ago by Trammell hudson <[email protected]>

musl-cross: crossgcc binary changed names (#617)

Signed-off-by: Trammell hudson <[email protected]>

df78801c686f57ebbfb6e98fb4284d410dd89842 authored about 5 years ago by Trammell hudson <[email protected]>

musl-cross: pin to a specific checkout (#617)

Add `--strip 1` to tar file extraction in the `Makefile`,
which ensures that the directory name ...

cc4fc7f990862bbd153845fa0d6f5ea99278ce4e authored about 5 years ago by Trammell hudson <[email protected]>

musl-cross: update patch for recent git commits (#617)

Signed-off-by: Trammell hudson <[email protected]>

23f33579f4dd12f2c649305c10fee68e4fc7530e authored about 5 years ago by Trammell hudson <[email protected]>

musl-cross: crossgcc binary changed names (#617)

Signed-off-by: Trammell hudson <[email protected]>

e49cea66e81cd3b0ad60ab30f881d0c292abbb01 authored about 5 years ago by Trammell hudson <[email protected]>

musl-cross: pin to a specific checkout (#617)

Add `--strip 1` to tar file extraction in the `Makefile`,
which ensures that the directory name ...

ebb664cc38d67aaa36c7822e2bcef0bfd69cf217 authored about 5 years ago by Trammell hudson <[email protected]>

GitlabCi is really acting weird, not finishing all steps required for a build...

4a04fa979bce132c6c6cd1eeb1d34c1239c0c452 authored about 5 years ago by Thierry Laurion <[email protected]>

GitlabCI: force real.clean upon each build.

37a82c54583781de48eee6994bcc45142c3439c8 authored about 5 years ago by Thierry Laurion <[email protected]>

OEM: verify actual battery capacity vs factory and notify if less then 65%

2b9e971b4133abf8d9c0aa37fc96ca0d235e89fc authored about 5 years ago by Thierry Laurion <[email protected]>

functions: add calc to do basic arithmetics using awk

b5768ff68942fac13bc783fb6070daef2da856a7 authored about 5 years ago by Thierry Laurion <[email protected]>

OEM Reownership: typo correction on error when AC power is not detected

33777ab7e87d547d38867e967f47a82ccc76d62e authored about 5 years ago by Thierry Laurion <[email protected]>

OEM: PrepareOrder fix so that LUKS recovery key passprase is exported from oem.information in a functional way

623e873244dda01b811e62990574d6a7def27f41 authored about 5 years ago by Thierry Laurion <[email protected]>

OEM PrepareOrder: pushing reprogrammer to validate information present under oem.information

385c32b4dd7f7aaca07ce8494dd10b0582cf9c4d authored about 5 years ago by Thierry Laurion <[email protected]>

OEM: PrepareOrder script now loop directly in script for top and bottom known SPI chips, read OEM information from oem.information, exports OEM_SSD_sdcard_Disks_Recovery_Key_Passphrase and warns reprogrammer from common mistakes.

d63cca0da8c2f469b3e7de880ce1529cd4d17752 authored about 5 years ago by Thierry Laurion <[email protected]>

OEM: PrepareOrder: adding bottom N25Q064..3E SPI rom support

136fd0673e19a43843dae06cb40fa122e3222cfc authored about 5 years ago by Thierry Laurion <[email protected]>

OEM: PrepareOrder script and subscripts now include top 4mb SPI chip N25Q0323E

ee849f09586d80834d138be68ba4b70502e90c0d authored about 5 years ago by Thierry Laurion <[email protected]>

OEM: PrepareOrder download latest stable x230-flash-libremkey and x230-libremkey rom images, verify that OEM_SDCARD_PUBLIC exists in current dir to be filled with desired ISO images to distribute and call subscripts. NOTE: Insurgo branded.

80042d5a86f2fad3ed190862ccafba859691d82f authored about 5 years ago by Thierry Laurion <[email protected]>

OEM PrepareOrder: automated script now backups, reflash and prepare SDCARD with order number in a functional loop. TODO: change hardcoded value and external dependencies to make them local and download them if not present.

8eb03539529aa2b65de47aabcaba55fabec23e06 authored about 5 years ago by Thierry Laurion <[email protected]>

GitlabCI: typo correction.

dbcba802eee344d9e871a0268bf9e4eaea82f356 authored about 5 years ago by Thierry Laurion <[email protected]>

Add external OEM tools to prepare sdcard content. More owrk needed but suffice for now

24d1cf9210abcec1c69a38c190b0507af7b65934 authored about 5 years ago by Thierry Laurion <[email protected]>

GitlabCI: removing qemu apt install, adding back cpio and thin-provisioning-tools build requirements.

c0d50f5c9e0ec2484daf3163bcc292223a8cd663 authored about 5 years ago by Thierry Laurion <[email protected]>

put libremkey-hotp-verification to latest commit id

984338a296521fe4f7c36fdc766d8cc379c93c44 authored about 5 years ago by Thierry Laurion <[email protected]>

x230-librem board: remove quiet from kernel options to be able to see systemd output since QubesOS changed and no output is given on console when hitting escape key on boot.

37f6fe4dbd4e9e46d3d2d238afd20bcebdbb1019 authored about 5 years ago by Thierry Laurion <[email protected]>

GitlabCI: add build error output in case of build failing

35747ab7500e4f606a9d0fd1ea3a6cb8029b6a2d authored about 5 years ago by Thierry Laurion <[email protected]>

use strugee patch to pin repos to specific commit ID.

1d6dd6d15261d8a282b13bda47ec6d683a6a3a14 authored about 5 years ago by AJ Jordan <[email protected]>

Revert "use strugee patch to pin repos to specific commit ID."

Not well applied patch

This reverts commit d2a51e5d4cd9b466e50213ca6bb0604cc8ff4a67.

4a8a1050606819e62e7912f37c0c1cbc04e759e7 authored about 5 years ago by Thierry Laurion <[email protected]>

use strugee patch to pin repos to specific commit ID.

d2a51e5d4cd9b466e50213ca6bb0604cc8ff4a67 authored about 5 years ago by AJ Jordan <[email protected]>

Build system: get away of custom images. Use fedora-29 at first

283b4ea645046a139f9f13a8b4760f4fc0929ebe authored about 5 years ago by Thierry Laurion <[email protected]>

OEM Re-Ownership typo correction

19903600a552b5b7338dbe321ef8351e8a7e670a authored about 5 years ago by Thierry Laurion <[email protected]>

mount-sdcard mmc_core module name, mmc-core.ko module name correction. Duh

b2f860cf1360d09aa7e8b8043191f77e669137b5 authored over 5 years ago by Thierry Laurion <[email protected]>

Seperating x230-flash-libremkey of x230-libremkey to respect 3h limit

3af863ee5b65f0abfbbddf65b289228f86f36543 authored over 5 years ago by Thierry Laurion <[email protected]>

Putting retry count to maximum: 2.

de5e70906e5a2229cffceeb824e035408a4952a5 authored over 5 years ago by Thierry Laurion <[email protected]>

GitLab limit for shared runners is of 3h. That 3 hours is reached at first build. Hacking it since retrying manually normally succeeds. Will also schedule weekly automatic builds so the cache doesn't expire. This is a really sad limitation of GitLab. They suggest to host a GitLab CI to mitigate the limatation. That would forfeit the purpose.

c1a59aa065785b3d67c1a6faaebe720bf0bd129d authored over 5 years ago by Thierry Laurion <[email protected]>

SDHCI card support changed to MMC and extended to support both Ricoh and Realtek

linux config, board config and x230 configs and mount-sdcard script modified accordingly

f2cd35e53c801aa5018d805ccea42b73f544636b authored over 5 years ago by Thierry Laurion <[email protected]>

mount-sdcard: do not bypass measurement of cqhci.ko in normal operations (when not in reownership)

aea8f0b94bec29f77bb1225921bf37710356ded2 authored over 5 years ago by Thierry Laurion <[email protected]>

Kernel: adding back PRINTK support since we have enough space (dmesg). Removing CONFIG_MMC_RICOH_MMC which steals the SDCARD and causes IO hangs.

8f762343e183bc86212866b94467b3b9abb068ab authored over 5 years ago by Thierry Laurion <[email protected]>

gitlab-ci.yml path fixes for hashes output and artifact collection

6d5550840fb4e58e7d31c2eebfc7ee0411644d51 authored over 5 years ago by Thierry Laurion <[email protected]>

coreboot-x230-flash-libremkey.config needs to point to built bzimage and initrd

0661b415d8da96c41abb317a45e809a39bd39d33 authored over 5 years ago by Thierry Laurion <[email protected]>

adding boards/x230-flash-libremkey/x230-flash-libremkey.config which points to x230-flash-libremkey coreboot and linux config

88e437a2a8641bcdad9a5a6090d1b7bc5de50f08 authored over 5 years ago by Thierry Laurion <[email protected]>

CI: modification of .gitlab-ci.yml to build x230-flash-libremkey instead of x230-flash

13a84ee114d68b2152c509163f613abf06618ba7 authored over 5 years ago by Thierry Laurion <[email protected]>

adding coreboot-x230-flash-libremkey.config, copy of coreboot-x230-flash.config for x230-flash-libremkey board config

825d4cba13b3c11b324cc07610284968fa609b69 authored over 5 years ago by Thierry Laurion <[email protected]>

OEM Re-Ownership: linux version bumped to LTS 4.19.63. x230-flash is x230-flash-libremkey until merged upstream.

7bd025deb2b5480ccdd2ce19f9f2f0c5e93566ba authored over 5 years ago by Thierry Laurion <[email protected]>

OEM Re-Ownership: linux version bumped to LTS 4.19.63. Required changes to support cryptsetup-reencrypt on sdhci sdcard reader tht otherwise was unreliable.

05e8152e9e2bb8154c01660e45b31458f6ea8d2f authored over 5 years ago by Thierry Laurion <[email protected]>

reencrypt-luks: uniformisation of wording

ca021d2858c7c96893b43f6020622a1950e017f8 authored over 5 years ago by Thierry Laurion <[email protected]>

gui-init: Fix 'Update checksums and sign all files in /boot' whiptail message over multiple lines

8f5d0b1a665637d1a09227a07e0a111f706d6681 authored over 5 years ago by Thierry Laurion <[email protected]>

OEM: small typos correction

47d024e9f493491e1a2b11c8abace1e97d092139 authored over 5 years ago by Thierry Laurion <[email protected]>

OEM: Disk Unlock Key Passphrase was missing a notify to confirm exported secret value

96c710e882a9f86e9900065efaa5b84055a68f36 authored over 5 years ago by Thierry Laurion <[email protected]>

OEM: readd automatic provisioning of GPG Admin PIN in seal-libremkey

53e863d32c77459a06f1cebcb1f08a6954569df1 authored over 5 years ago by Thierry Laurion <[email protected]>

OEM: make diceware suggested passwords sepearated by spaces (Since GPG Admin PIN/HOTP doesn't require to not have space anymore)

bb7e89e034bdf77b7a93da3345903bfe8182ca22 authored over 5 years ago by Thierry Laurion <[email protected]>

factory-reset-libremkey: Remove no space constraint on GPG Admin PIN

3ddaab76169ead57f9cb3acf779817dbbc3494b2 authored over 5 years ago by Thierry Laurion <[email protected]>

cryptsetup: add LUKS nuke patchset from https://gitlab.com/kalilinux/packages/cryptsetup/blob/3ddbbb67ade4e60f4bcacd26d8647ae04c8fabb5/debian/patches/cryptsetup_nuke_keys.patch

879aada8619a0f6e2b5fd6f30f63e68018e55969 authored over 5 years ago by Thierry Laurion <[email protected]>

OEM: Remove requirement of GPG Admin PIN to not contain space, the bug having been corrected and upstreamed.

01baf58b90d06ca4875c28e9da8a49b63479fbcb authored over 5 years ago by Thierry Laurion <[email protected]>

Merge remote-tracking branch 'osresearch/master' into oem_reownership-staging_rebase_master_PR

Includes MrChromebook changes from his branches HOTP and small_fixes

0e8384c6f3ce0242e72a24ac10481572f7c4dd6f authored over 5 years ago by Thierry Laurion <[email protected]>

Merge pull request #589 from MrChromebox/small_fixes

Small fixes

20d79f5ab54957e18322fa010b92b8376b33ae7f authored over 5 years ago by Kyle Rankin <[email protected]>

Merge pull request #588 from MrChromebox/hotp_fixes

HOTP fixes

a29c10ad51e3a556decba0ebc98e42391dfc8a7e authored over 5 years ago by Kyle Rankin <[email protected]>

initrd: don't mount efivars fs on non-linuxboot systems

it doesn't exist and produces a spurious error on Heads systems

Signed-off-by: Matt DeVillier <...

6cfbc86618ae05908ca035aa59ba43e48c0c2a0d authored over 5 years ago by Matt DeVillier <[email protected]>

gui-init: load USB modules at startup

ensures external USB keyboards are accessible

Signed-off-by: Matt DeVillier <matt.devillier@pur...

4a85c85336130b801c178741ed7246bdfc3eabef authored over 5 years ago by Matt DeVillier <[email protected]>

gui-init: ensure /boot is sane first thing

Before anything else, ensure that a default boot device
is set. If not, prompt the user to set o...

2686c836c6aa8abfb6ee605c3bd2987d1028b701 authored over 5 years ago by Matt DeVillier <[email protected]>

unseal-hotp: ensure /boot mounted before checking HOTP secret

If /boot isn't mounted, we can't read the HOTP secret, so no
point in reading from the TPM. This...

f772f2d088cb69e0642bc5ff646690959b887e6c authored over 5 years ago by Matt DeVillier <[email protected]>

Skip prompt to set default boot when booting from USB

Since a USB boot target can't be the default (at least currently,
/boot must be on internal medi...

65d669d408d212729a4bf01ac28f5261b6596397 authored over 5 years ago by Matt DeVillier <[email protected]>

flash-gui: clean up ROM list

Exclude dot folders from ROM search path, so that files in
.Trash (eg) aren't shown. Sort the re...

3306dbb66d2859edd095cb6707c532e9ca23d93e authored over 5 years ago by Matt DeVillier <[email protected]>

kexec-select-boot: correct order of USB boot options

Using sort on USB boot options produces a reverse-ordered list,
leading users to often select th...

e0e0019250ee5904d036d310d820db88c0575d0d authored over 5 years ago by Matt DeVillier <[email protected]>

unseal-hotp: fix/rename mount_boot()

Because of the way unseal-hotp is called from gui-init,
dropping to a recovery shell when failin...

5eb758711da626d952e03bb9b8b4c8d1fd346dc7 authored over 5 years ago by Matt DeVillier <[email protected]>

libremkey_hotp_initialize: handle spaces in admin pin/pass

Fix HOTP verfication failure if LK admin pin/passphrase contains
spaces by quoting the variables...

77949c9cffef0566093d61fd1ceb373865b032d4 authored over 5 years ago by Matt DeVillier <[email protected]>

libremkey-hotp-verification: pass in key file directly

Reading the file into a variable and then redirecting to stdin
via echo() can cause the binary d...

286303d95cc8d17504516bb181ea4e8d76fab2bd authored over 5 years ago by Matt DeVillier <[email protected]>

OEM: Last message adjustments before ending OEM reownership

0f3fd5d95ef070431f58c93e262a0ca033c0c1fd authored over 5 years ago by Thierry Laurion <[email protected]>

OEM: Add a last whiptail warning before Reownership ends, just prior enforcing Disk Unlock Key passphrase

89115ee23d7949fa935f773c2421a0167d9ba6db authored over 5 years ago by Thierry Laurion <[email protected]>

OEM : add instruction on GPG public Key Comment: Cannot be empty.

4b69f5587040f777bd7e3a7d889536a4afbff9f5 authored over 5 years ago by Thierry Laurion <[email protected]>

EOM: add back manual input validation of oem_luks_Disk_Unlock_Key

29058dfcd5bce600d943f75fd09556c672aea56b authored over 5 years ago by Thierry Laurion <[email protected]>

OEM: sort provisioned information prior to store them into /media/oem-provisioning

42418ad74a41387031fb3c968fd586bec8b18814 authored over 5 years ago by Thierry Laurion <[email protected]>

Fix bug of OEM asking to validate manually disk unlock key while diceware generated and supposed to be kept.

0b7cf060cff3e81ee13a81cbf7c58c577f64307b authored over 5 years ago by Thierry Laurion <[email protected]>

Forcing reset of git in gitlab config

cc56d6309324eb7092041b4ff11ad5c2d7631772 authored over 5 years ago by Thierry Laurion <[email protected]>

Gitlab CI cache plays. Doing a complete ./ cache and forcing gitlab to checkout instead of pulling

e897cd94e0c4180233cb9b6e3187713334dd160b authored over 5 years ago by Thierry Laurion <[email protected]>

Clariy and add OEM specific notes

6be2fb84c986f242bde48616785e8ac193b8777d authored over 5 years ago by Thierry Laurion <[email protected]>

Documentation changes

c20c1842594eeefbb1da831f9de75bbd0ef119d7 authored over 5 years ago by Thierry Laurion <[email protected]>

Try to cache only the .build dir

00b4d87623d785919fdb314d462261999237db8a authored over 5 years ago by Thierry Laurion <[email protected]>

Playing with gitlab caches... Still some corruption found. Grrrr...

b884994a14ba878424071aec106d6f41c842f565 authored over 5 years ago by Thierry Laurion <[email protected]>

Fix USB boot following mount-usb changes deprecating CONFIG_USB_BOOT_DEV usage

9a65931c5707d868a3a14da65e20017646636e8a authored over 5 years ago by Thierry Laurion <[email protected]>

x230-libremkey missed requirements

bf5761bacd3dee7cedeccb55f35edeffb031e15c authored over 5 years ago by Thierry Laurion <[email protected]>

Change x230 OEM default board build to x230-libremkey

c5946acae9a05929343354812335f4dc1cb2c403 authored over 5 years ago by Thierry Laurion <[email protected]>

Change Nitrokey/Librem Key references to Librem Key only to remove confusion.

+ cosmetic changes.
+ WiP to boot on SDCARD (debug todo)

e7a2ceddcd1ff7ce2ec85d3680537065a129e4f5 authored over 5 years ago by Thierry Laurion <[email protected]>

Reverting LIBREMKEY dependence on x230.config board. Creating x230-libremkey board config.

0b348f13734f72ef05fd4e3108e99907898c6383 authored over 5 years ago by Thierry Laurion <[email protected]>

Typo corrections

e0cf0cec53e1f8c1d7feb8f2f2e41da3f06f5c28 authored over 5 years ago by Thierry Laurion <[email protected]>

Ecosyste.ms: OpenCollective

github.com/tlaurion/heads-ci-fedora30