The coreboot module for NovaCustom MTL boards was renamed from
'dasharo' to 'dasharo_v56'. The Heads patch system resolves patch
directories as <module_name>[-<patch_version>], so with module
coreboot-dasharo_v56 and patch_version=unreleased the expected path
is patches/coreboot-dasharo_v56-unreleased/.
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
When the coreboot git commit changes (canary mismatch), remove and recreate
the board-specific build directories to prevent stale artifacts from causing
compilation failures.
This eliminates the need for manual `rm -rf build/x86/BOARD` before rebuilding
after coreboot canary updates in development cycles (when creating patches).
One currently still has to, eg:
echo "bogues repo url + commit hash" | sudo tee /home/user/heads/build/x86/coreboot-25.09/.canary
Current logic then:
1. Detects canary changes and triggers repository cleanup
2. Removes both Heads board directory (build/x86/BOARD) and coreboot board
directory (build/x86/coreboot-*/BOARD) that contain stale build artifacts
3. Recreates empty board directories for the subsequent build
4. Allows patches to apply cleanly without Ada compilation errors
This ensures Ada builds work correctly after coreboot updates without manual
intervention (resync repo, apply patches, clean artifact dirs and rebuilds only what changed).
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
- config/coreboot-novacustom-v560tu.config: switch EC from SYSTEM76_EC
to DASHARO_EC (CONFIG_EC_DASHARO_EC=y, _UPDATE=y, _UPDATE_FILE="ec.rom"),
matching the v540tu change already in this branch
- modules/dasharo-ec: strip UNTESTED_/EOL_ board name prefixes before
the board model mapping so that boards not yet promoted (e.g.
UNTESTED_nitropad-ns50) resolve correctly without a separate entry
- modules/dasharo-ec: add board model mappings for novacustom-nv4x_adl
(ns5x_adl - nv4x_adl) and nitropad-ns50 (ns5x_adl)
- modules/dasharo-ec: drop redundant sh -c wrapper from cp recipe;
Make already invokes recipe lines via the shell
- modules/dasharo-ec: replace dd seek-based padding with
truncate --size=128KiB, as suggested in review (ec.rom is always
smaller than 128 KiB)
- modules/dasharo-ec: indent ifeq variable assignments with a tab for
readability
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
- Remove leading tabs from ifeq variable assignments (Make parse error)
- Move post-build steps (cp, dd, touch) out of dasharo-ec_target into
a proper Make rule; _target is now only make arguments
- Set dasharo-ec_output to ec.rom (the actual artifact, not .built)
- Add -$(BOARD) suffix to dasharo-ec_base_dir and dasharo-ec_dir so
v540tu and v560tu maintain independent build trees and ec.rom files
- Add explicit rule to copy and zero-pad ec.rom to 128 KB
- Fix coreboot copy rule: use FORCE + cmp so the recipe always runs
but only updates the destination (and its mtime) when content differs,
preventing the mtime race between boards sharing coreboot_base_dir
Signed-off-by: Filip Lewiński <filip.lewinski@3mdeb.com>
The NK3 uses 'Secrets app' terminology and has 8 PIN retry attempts (vs 3 for
older devices), but the codebase had inconsistent UX messaging that referred to
'GPG Admin PIN', 'USB security dongle', 'TOKEN', etc. instead of the actual
brand and PIN type.
Fix 1: PIN label - $prompt_message is used in all user-facing strings (status,
prompts, error messages, reminder note) with correct value: 'Secrets app' for NK3,
'GPG Admin' for older devices.
Fix 2: Dynamic attempt counting - after the default PIN trial consumes an attempt,
re-read the counter and limit user attempts to min(retries-1, 3). If the counter
read is unreliable (0 or 1), fall back to 3 attempts so the user is never
blocked from sealing. Documented with example outcomes for NK3 (8 retries) and
pre-NK3 (3 retries).
Fix 3: NK3-specific error message now references 'Secrets app PIN' instead of
'GPG Admin PIN' in the PIN reset instructions.
Fix 4: Use $DONGLE_BRAND consistently in all USB security dongle messaging
(STATUS, prompts, dialog titles, guidance strings, integrity report, DEBUG
logs, error messages, NOTES) instead of hardcoded 'USB security dongle',
'OpenPGP signing card', 'GPG security dongle', 'dongle', 'signing card',
'Dongle key'. Also replaces 'TOKEN' in hotp_state/hotp_display with
$DONGLE_BRAND so integrity report shows actual brand (e.g. 'Nitrokey 3
PRESENT' instead of 'TOKEN PRESENT').
Fix 5: Centralize branding detection in standalone script entry points:
- gui-init.sh: already detects at boot flow entry (line ~965)
- oem-factory-reset.sh: added detection at script start (was missing)
- confirm_gpg_card: detects for gpg-gui.sh and kexec-sign-config.sh
- report_integrity_measurements: detects for hotp/gpg flow
- seal-hotpkey.sh: has its own detection at script start
Fix 6: detect_usb_security_dongle_branding now guards against redundant
re-detection while preserving USB init safety: it skips USB re-init and lsusb
re-scan only when a specific DONGLE_BRAND is already set and _USB_ENABLED=y in
the current process. In child scripts that inherit DONGLE_BRAND but reset
_USB_ENABLED, it still runs enable_usb, then returns without re-scan if
branding is already specific.
Fix 7: Comment casing fix in oem-factory-reset.sh (Secrets App -> Secrets app)
to match user-facing strings and hotp_verification output.
Fix 8: Remove duplicate show_pin_retries call before PIN entry loop in
seal-hotpkey.sh. The function was being called twice before the first prompt
(once before the loop, once at loop start), showing 'Nitrokey 3 Secrets app
PIN retries remaining: 8' twice.
Fix 9: Clarify and enforce fast-path behavior for
detect_usb_security_dongle_branding in mixed parent/child script contexts:
avoid redundant module loads and scans in the same process, but do not skip USB
initialization when only branding is inherited.
Fix 10: detect_usb_security_dongle_branding now reuses wait_for_usb_devices
after enable_usb only when USB was not already initialized in the current
process. This avoids early lsusb enumeration races without regressing the
no-redundant-load/no-re-scan fast path.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
- Add HEADS_FORCE_DOCKER_REBUILD=1 to force rebuild from flake.nix/flake.lock
- Delete cached nix store result when forcing rebuild
- Add --print-build-logs to nix build for visibility
- Use docker load -i instead of docker load < for consistency
- Improve reproducibility check: explain config vs manifest digests
- Show method used (registry+jq, registry+sed, or pulled)
- Add tip to install jq and curl for faster registry checks
- Add get_remote_manifest_digest() with correct Docker Hub URL format
- Update doc/docker.md explaining config vs manifest digests
- Normalize indentation to tabs across docker scripts
- Use script-relative paths for deterministic nix build (--out-link)
- Add shared _parse_docker_image helper for consistent registry parsing
- Handle localhost as registry hostname (not Docker Hub)
Fixes:
- local result_target declaration in force rebuild
- handle regular file case for result (not just symlink)
- use printf instead of echo in hash computation
- fall back to shasum when sha256sum unavailable
- ensure temp directory cleanup on all paths
- handle @digest references in get_remote_manifest_digest
- restrict sha256 regex to exactly 64 hex chars
- use remote_method instead of hardcoded message
- Docker Hub URL uses sha256-{digest} not sha256:{digest}
- fix regex in get_remote_config_digest: use \. not \. for dot matching
- remove unused get_local_manifest_digest function
- move End marker to actual end points
- distinguish fetch_failed from mismatch in fallback message
- update documentation mismatch example to match current output
- check curl availability in get_remote_config_digest
- only show Docker Hub URL for Docker Hub images
- add curl availability check to get_remote_manifest_digest
- fix readlink -f fallback to use quoted variable
- fix pin-and-run.sh: strip :tag before appending @digest for valid Docker ref
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
The prompt_tpm_owner_password() function sets tpm_owner_passphrase variable,
but tpm2_seal was using an unset tpm_owner_password variable instead.
This caused evictcontrol to fail with auth error (0x9A2) since no passphrase
was being passed to the TPM command.
Also standardizes all user-facing strings and variables to use 'passphrase'
instead of 'password' for TPM owner auth, including the cache file path.
Fixes regression introduced in commit 16648ca4b9.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
When a passphrase is supplied (--pass) and multiple USB partitions are
present, scan for the one LUKS partition and mount it automatically.
This removes the need for the user to manually pick the correct partition
when using the GPG key-material backup thumb drive, which always has two
partitions: a LUKS-encrypted private partition and an exFAT public one.
If exactly one LUKS partition is found it is selected silently; if zero
or more than one LUKS partition is found the existing interactive menu
is shown as before, so the behavior is unchanged for all other cases.
Remove the now-redundant WARN in cache_gpg_signing_pin that instructed
the user to select the encrypted LUKS partition manually.
Signed-off-by: Thierry Laurion <insurgo@riseup.net>
Filip Lewiński
Thierry Laurion
Maciej Pijanowski
Daniel Schaefer