diff options
Diffstat (limited to 'static/install')
| -rw-r--r-- | static/install/cli.html | 72 | ||||
| -rw-r--r-- | static/install/index.html | 2 |
2 files changed, 39 insertions, 35 deletions
diff --git a/static/install/cli.html b/static/install/cli.html index 1be722fc..dfd44ee1 100644 --- a/static/install/cli.html +++ b/static/install/cli.html @@ -74,7 +74,7 @@ <li><a href="#booting-into-the-bootloader-interface">Booting into the bootloader interface</a></li> <li><a href="#connecting-device">Connecting the device</a></li> <li><a href="#unlocking-the-bootloader">Unlocking the bootloader</a></li> - <li><a href="#obtaining-signify">Obtaining signify</a></li> + <li><a href="#obtaining-openssh">Obtaining OpenSSH</a></li> <li><a href="#obtaining-factory-images">Obtaining factory images</a></li> <li> <a href="#flashing-factory-images">Flashing factory images</a> @@ -370,28 +370,22 @@ Installed as /home/username/platform-tools/fastboot</pre> to confirm.</p> </section> - <section id="obtaining-signify"> - <h2><a href="#obtaining-signify">Obtaining signify</a></h2> + <section id="obtaining-openssh"> + <h2><a href="#obtaining-openssh">Obtaining openssh</a></h2> - <p>On the supported Linux distributions, the signify tool is used to verify the - download of the OS beyond the security offered by HTTPS. You should skip this on - macOS and Windows. It only makes sense to do this if you can obtain signify from - the distribution package repositories. GrapheneOS releases are hosted on our - servers and we do not have third party mirrors.</p> + <p>On the supported Linux distributions, OpenSSH is used to verify the download of + the OS beyond the security offered by HTTPS. You should skip this on macOS and + Windows. It only makes sense to do this if you can obtain OpenSSH from the + distribution package repositories. GrapheneOS releases are hosted on our servers and + we do not have third party mirrors.</p> <p>On Arch Linux:</p> - <pre>sudo pacman -S signify</pre> + <pre>sudo pacman -S openssh</pre> <p>On Debian and Ubuntu:</p> - <pre>sudo apt install signify-openbsd -alias signify=signify-openbsd</pre> - - <p>On Debian-based distributions, the <code>signify</code> package and command are an - <a href="http://signify.sourceforge.net/" rel="nofollow">unmaintained mail-related - tool for generating mail signatures (not cryptographic signatures)</a>. Make sure - to install <code>signify-openbsd</code>.</p> + <pre>sudo apt install openssh-client</pre> </section> <section id="obtaining-factory-images"> @@ -405,22 +399,31 @@ alias signify=signify-openbsd</pre> using it for the rest of the installation process, so these instructions use <code>curl</code>.</p> - <p>Download <a href="https://releases.grapheneos.org/factory.pub">the factory images - public key (factory.pub)</a> in order to verify the factory images:</p> + <p>Download <a href="https://releases.grapheneos.org/allowed_signers">the factory images + public key (allowed_signers)</a> in order to verify the factory images:</p> + + <pre>curl -O https://releases.grapheneos.org/allowed_signers</pre> + + <p>This is the content of <code>allowed_signers</code>:</p> + + <pre>contact@grapheneos.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUg/m5CoP83b0rfSCzYSVA4cw4ir49io5GPoxbgxdJE</pre> - <pre>curl -O https://releases.grapheneos.org/factory.pub</pre> + <p>Other locations to obtain the signing key:</p> - <p>This is the content of <code>factory.pub</code>:</p> + <ul> + <li><a href="https://bsky.app/profile/grapheneos.org/post/3kleyygkptm2x">Bluesky</a></li> + <li><a href="https://twitter.com/GrapheneOS/status/1757758688952009209">Twitter</a></li> + <li><a href="https://github.com/GrapheneOS/releases.grapheneos.org/blob/main/static/allowed_signers">GitHub</a></li> + </ul> - <pre>untrusted comment: GrapheneOS factory images public key -RWQZW9NItOuQYJ86EooQBxScfclrWiieJtAO9GpnfEjKbCO/3FriLGX3</pre> + <p>The current public key is signed with the previous signify key. If you already + have the previous signify public key (factory.pub) and want to verify the new key + with it:</p> - <p>The public key has also been published via the official - <a href="https://twitter.com/GrapheneOS/status/1145259815851253762">@GrapheneOS Twitter - account</a>, - <a href="https://www.reddit.com/r/GrapheneOS/comments/c7gb3f/grapheneos_factory_images_are_now_signed_with/esewpm9">the /u/GrapheneOS - Reddit account</a> and <a href="https://github.com/GrapheneOS/releases.grapheneos.org/blob/main/static/factory.pub">is available on GitHub</a>. - When the current signing key is replaced, the new key will be signed with it.</p> + <pre>curl -O https://releases.grapheneos.org/allowed_signers.sig +signify -V -m allowed_signers -x allowed_signers.sig -p factory.pub</pre> + + <p>When the current signing key is replaced, the new key will be signed with it.</p> <p>Download the factory images for the device from <a href="/releases">the releases page</a>. For example, to download the 2021110122 release for a device with the @@ -429,14 +432,15 @@ RWQZW9NItOuQYJ86EooQBxScfclrWiieJtAO9GpnfEjKbCO/3FriLGX3</pre> <pre>curl -O https://releases.grapheneos.org/<var>DEVICE_NAME</var>-factory-2021110122.zip curl -O https://releases.grapheneos.org/<var>DEVICE_NAME</var>-factory-2021110122.zip.sig</pre> - <p>Verify the factory images using the signature if you were able to obtain - <code>signify</code> from trusted package repositories (see above), otherwise - continue on to the next section without this:</p> + <p>Verify the factory images using the signature if you were able to obtain OpenSSH + from trusted package repositories (see above), otherwise continue on to the next + section without this:</p> + + <pre>ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s <var>DEVICE_NAME</var>-factory-2021110122.zip.sig < <var>DEVICE_NAME</var>-factory-2021110122.zip</pre> - <pre>signify -Cqp factory.pub -x <var>DEVICE_NAME</var>-factory-2021110122.zip.sig && echo verified</pre> + <p>This will producing the following output when successful:</p> - <p>This will output <code>verified</code> if verification is successful. If something - goes wrong, it will output an error message rather than <code>verified</code>.</p> + <pre>Good "factory images" signature for contact@grapheneos.org with ED25519 key SHA256:AhgHif0mei+9aNyKLfMZBh2yptHdw/aN7Tlh/j2eFwM</pre> </section> <section id="flashing-factory-images"> diff --git a/static/install/index.html b/static/install/index.html index 77691640..9ec5bfad 100644 --- a/static/install/index.html +++ b/static/install/index.html @@ -53,7 +53,7 @@ on.</p> <p>The command-line approach offers a way to install GrapheneOS without trusting our - server infrastructure. This requires being on an OS with proper fastboot and signify + server infrastructure. This requires being on an OS with proper fastboot and OpenSSH packages along with understanding the process enough to avoid blindly trusting the instructions from our site. For most users, the web-based installation approach is no less secure and avoids needing any software beyond a browser with WebUSB support.</p> |