The prompt_tpm_owner_password() function sets tpm_owner_passphrase variable,
but tpm2_seal was using an unset tpm_owner_password variable instead.
This caused evictcontrol to fail with auth error (0x9A2) since no passphrase
was being passed to the TPM command.
Also standardizes all user-facing strings and variables to use 'passphrase'
instead of 'password' for TPM owner auth, including the cache file path.
Fixes regression introduced in commit 16648ca4b9.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
When a passphrase is supplied (--pass) and multiple USB partitions are
present, scan for the one LUKS partition and mount it automatically.
This removes the need for the user to manually pick the correct partition
when using the GPG key-material backup thumb drive, which always has two
partitions: a LUKS-encrypted private partition and an exFAT public one.
If exactly one LUKS partition is found it is selected silently; if zero
or more than one LUKS partition is found the existing interactive menu
is shown as before, so the behavior is unchanged for all other cases.
Remove the now-redundant WARN in cache_gpg_signing_pin that instructed
the user to select the encrypted LUKS partition manually.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
- Auto-adjust RSA key size based on dongle type; show firmware version
before reset; add firmware-aware RSA keygen timing guidance
- Fix GPG signing failure by clearing scdaemon CCID lock before signing
- Fix keytocard 'Invalid command': remove spurious echo arguments from
RSA subkey generation and keytocard operations (scdaemon caches card
admin PIN after first keytocard; stale ADMIN_PIN_DEF was landing at
keyedit.prompt causing 'No user ID with index 12345678')
- Fix set_card_identity sending ADMIN_PIN_DEF to cardedit.prompt after
name/login commands (scdaemon caches admin PIN; no re-prompt needed)
- Fix ECC P-256 encryption subkey generation: remove invalid 'echo Q'
(option 12 skips capabilities menu, goes straight to curve selection)
- Use DONGLE_BRAND variable in GPG User PIN prompt for consistent branding
- Label ADMIN_PIN as 'NK3 Secrets app PIN / GPG Admin PIN' when Nitrokey 3
is detected, in all user-facing prompts and status messages
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
- Skip integrity report when OEM factory reset is called from TPM error menu
- Improve boot messaging and fix console output
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
- Add Canokey QEMU USB (20a0:42d4) to detect_usb_security_dongle_branding()
with debug logging
- Display Nitrokey 3 firmware version in hotpkey_fw_display(); warn when
firmware is below the minimum supported version
- Re-detect DONGLE_BRAND in cache_gpg_signing_pin() after GPG card is
confirmed present; fixes generic 'USB security dongle' label when dongle
enumerates after the initial detection in gui-init.sh
- Combine DONGLE_BRAND assignment and export into a single line
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
This is the core commit of PR #2068. It introduces:
Integrity gating (gui-init.sh):
- gate_reseal_with_integrity_report(): blocks reseal/reset unless /boot
integrity is confirmed; set INTEGRITY_GATE_REQUIRED=y on TOTP/HOTP
failure to trigger the gate before any signing or secret-sealing
- report_integrity_measurements(): shows /boot hash state (OK/CHANGED/UNKNOWN)
- investigate_integrity_discrepancies(): guided flow when hashes mismatch,
letting the user inspect changed files before deciding to re-sign
- tpm_reset_required() guard in update_checksums() and gate_reseal_with_integrity_report():
forces TPM reset before signing if the rollback counter is broken/absent
- LUKS_PARTITION_DETECTED reuse to distinguish "no /boot" from "no OS"
and route user to the correct recovery path
Dongle branding (gui-init.sh, oem-factory-reset.sh, gpg-gui.sh):
- DONGLE_BRAND set from detect_usb_security_dongle_branding() (VID:PID);
displayed in menu headers, HOTP prompts and error messages
- hotpkey_fw_display() called for firmware version in HOTP prompts
- oem-factory-reset.sh: STATUS messages use DONGLE_BRAND; adds Nitrokey 3
Secrets app reset
GPG / kexec signing:
- gpg-gui.sh: refactored to use shared gpg_functions.sh
- kexec-seal-key.sh: LUKS DUK setup with per-device unlock validation,
partial-device handling, and 3-attempt recovery
- kexec-unseal-key.sh: STATUS/WARN output for unlock flow
General:
- config-gui.sh, flash-gui.sh: improved prompts and error handling
- All scripts: tabs indentation, die() -> DIE()
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Add initrd/etc/dongle-versions with USB security dongle firmware version
constants (firmware versions, VID:PID) used by OEM reset and firmware display.
Add initrd/etc/gpg_functions.sh with shared GPG functions factored out of
gpg-gui.sh for reusability across scripts.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Re-export both keys through the new update_distro_signing_key scripts
to strip non-signing subkeys (encryption, authentication) and expired
subkeys that had accumulated in the in-tree copies. Only the primary
key and currently-valid signing subkeys are retained.
archlinux.key: 1168B -> 673B (495B saved, auth+encrypt subkeys removed)
tails.key: 21282B -> 7376B (13906B saved, expired+non-signing subkeys removed)
Qubes OS keys (4.2, 4.3, weekly builds) were already minimal -- no change.
Fixes linuxboot/heads#2066.
This class of manual update has been needed repeatedly in the past and
was caught late each time, causing distro ISO verification failures in
the field for Tails and other supported distros:
linuxboot/heads#1808 (issue: Tails key expired, ISOs unbootable)
linuxboot/heads#1631 (PR: update tails.key, replay of manual steps)
linuxboot/heads#1809 (PR: replay of #1631 for next Tails rotation)
linuxboot/heads#2000 (PR: Tails 7.0 key, same manual process again)
linuxboot/heads#1457 (PR: Arch Linux key update)
linuxboot/heads#2033 (PR: Qubes OS 4.3 key addition)
TODO: wire bin/update_distro_signing_keys.sh into CI (e.g. a scheduled
workflow) so upstream key rotations are detected automatically
before they break users.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Compared to HEAD^, this commit updates initrd root-hash probing in:
- initrd/bin/root-hashes-gui.sh
- initrd/etc/functions
Behavior expected to work:
- Root-hash create/verify flow on latest Ubuntu, Debian, and PureOS under KVM.
- LUKS/LVM root probing based on mountability + expected root directory checks.
- Clear unsupported-layout whiptail guidance for unsupported filesystem/layout combinations.
Current status and non-goals:
- Fedora and QubesOS are untested in this change set.
- QubesOS on coreboot q35 with Heads still does not support qemu/kvm; no regression is implied.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
fdisk -l can’t be trusted inside Heads’ initrd: busybox limits it to
2 TiB and parsing its output is fragile.
Changes relative to origin/master:
* add new function disk_info_sysfs() in initrd/etc/functions
– walks /sys/block, skips partition entries, and computes a byte
count (preferring blockdev --getsize64, otherwise size*512)
– converts to decimal GB, switching to TB for ≥1000 GB
* update show_system_info() (gui_functions & oem‑system‑info‑xx30) to call the
helper and no longer invoke `fdisk -l` for size output
* add TRACE_FUNC/DEBUG logging around the helper invocation
Tested in qemu/debian‑13/PureOS; only the size line differs, other behaviour
is identical to master.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
* show progress hint when flashprog --progress is used
* don't silence command output; capture stderr for diagnostics
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
DO_WITH_DEBUG redirects stdout/stderr through tee for logging, which
breaks interactive password prompts by interfering with TTY access.
Both increment_tpm_counter calls already redirect output to /dev/null,
so DO_WITH_DEBUG provided no logging benefit while breaking prompts.
This allows TPM owner password prompts to display correctly on console
when TPM counters need to be created or incremented.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Thierry Laurion