diff options
Diffstat (limited to 'static')
| -rw-r--r-- | static/build.html | 17 | ||||
| -rw-r--r-- | static/faq.html | 2 | ||||
| -rw-r--r-- | static/install/cli.html | 72 | ||||
| -rw-r--r-- | static/install/index.html | 2 | ||||
| -rw-r--r-- | static/js/redirect.js | 2 |
5 files changed, 50 insertions, 45 deletions
diff --git a/static/build.html b/static/build.html index 9dbc2518..99f07b9e 100644 --- a/static/build.html +++ b/static/build.html @@ -261,8 +261,11 @@ <li>32-bit gcc runtime library</li> </ul> - <p>The <code>signify</code> tool (with the proper naming) is also required for signing - factory images zips.</p> + <p>Additional dependencies for signing factory images releases:</p> + + <ul> + <li>ssh-keygen (OpenSSH)</li> + </ul> </section> <section id="downloading-source-code"> @@ -537,14 +540,10 @@ cd ../..</pre> <p>Generate a signify key for signing factory images:</p> - <pre>signify -G -n -p keys/raven/factory.pub -s keys/raven/factory.sec</pre> + <pre>ssh-keygen -t ed25519 -f keys/raven/id_ed25519</pre> - <p>Remove the <code>-n</code> switch to set a passphrase. The <code>signify</code> - tool doesn't provide a way to change the passphrase without generating a new key, so - this is currently handled separately from encrypting the other keys and there will be - a separate prompt for the passphrase. In the future, expect this to be handled by the - same scripts along with the expectation of it using the same passphrase as the other - keys.</p> + <p>The passphrase for the SSH key should also match the other keys, although we + don't currently handle it automatically in the encrypt/decrypt scripts.</p> <section id="encrypting-keys"> <h4><a href="#encrypting-keys">Encrypting keys</a></h4> diff --git a/static/faq.html b/static/faq.html index df3e81ec..206a3a3d 100644 --- a/static/faq.html +++ b/static/faq.html @@ -1740,7 +1740,7 @@ <p>The command-line approach offers a way to install GrapheneOS without trusting our server infrastructure. This requires being on an OS with proper fastboot and - signify packages along with understanding the process enough to avoid blindly + OpenSSH packages along with understanding the process enough to avoid blindly trusting the instructions from our site. For most users, the web-based installation approach is no less secure and avoids needing any software beyond a browser with WebUSB support.</p> diff --git a/static/install/cli.html b/static/install/cli.html index 1be722fc..dfd44ee1 100644 --- a/static/install/cli.html +++ b/static/install/cli.html @@ -74,7 +74,7 @@ <li><a href="#booting-into-the-bootloader-interface">Booting into the bootloader interface</a></li> <li><a href="#connecting-device">Connecting the device</a></li> <li><a href="#unlocking-the-bootloader">Unlocking the bootloader</a></li> - <li><a href="#obtaining-signify">Obtaining signify</a></li> + <li><a href="#obtaining-openssh">Obtaining OpenSSH</a></li> <li><a href="#obtaining-factory-images">Obtaining factory images</a></li> <li> <a href="#flashing-factory-images">Flashing factory images</a> @@ -370,28 +370,22 @@ Installed as /home/username/platform-tools/fastboot</pre> to confirm.</p> </section> - <section id="obtaining-signify"> - <h2><a href="#obtaining-signify">Obtaining signify</a></h2> + <section id="obtaining-openssh"> + <h2><a href="#obtaining-openssh">Obtaining openssh</a></h2> - <p>On the supported Linux distributions, the signify tool is used to verify the - download of the OS beyond the security offered by HTTPS. You should skip this on - macOS and Windows. It only makes sense to do this if you can obtain signify from - the distribution package repositories. GrapheneOS releases are hosted on our - servers and we do not have third party mirrors.</p> + <p>On the supported Linux distributions, OpenSSH is used to verify the download of + the OS beyond the security offered by HTTPS. You should skip this on macOS and + Windows. It only makes sense to do this if you can obtain OpenSSH from the + distribution package repositories. GrapheneOS releases are hosted on our servers and + we do not have third party mirrors.</p> <p>On Arch Linux:</p> - <pre>sudo pacman -S signify</pre> + <pre>sudo pacman -S openssh</pre> <p>On Debian and Ubuntu:</p> - <pre>sudo apt install signify-openbsd -alias signify=signify-openbsd</pre> - - <p>On Debian-based distributions, the <code>signify</code> package and command are an - <a href="http://signify.sourceforge.net/" rel="nofollow">unmaintained mail-related - tool for generating mail signatures (not cryptographic signatures)</a>. Make sure - to install <code>signify-openbsd</code>.</p> + <pre>sudo apt install openssh-client</pre> </section> <section id="obtaining-factory-images"> @@ -405,22 +399,31 @@ alias signify=signify-openbsd</pre> using it for the rest of the installation process, so these instructions use <code>curl</code>.</p> - <p>Download <a href="https://releases.grapheneos.org/factory.pub">the factory images - public key (factory.pub)</a> in order to verify the factory images:</p> + <p>Download <a href="https://releases.grapheneos.org/allowed_signers">the factory images + public key (allowed_signers)</a> in order to verify the factory images:</p> + + <pre>curl -O https://releases.grapheneos.org/allowed_signers</pre> + + <p>This is the content of <code>allowed_signers</code>:</p> + + <pre>contact@grapheneos.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUg/m5CoP83b0rfSCzYSVA4cw4ir49io5GPoxbgxdJE</pre> - <pre>curl -O https://releases.grapheneos.org/factory.pub</pre> + <p>Other locations to obtain the signing key:</p> - <p>This is the content of <code>factory.pub</code>:</p> + <ul> + <li><a href="https://bsky.app/profile/grapheneos.org/post/3kleyygkptm2x">Bluesky</a></li> + <li><a href="https://twitter.com/GrapheneOS/status/1757758688952009209">Twitter</a></li> + <li><a href="https://github.com/GrapheneOS/releases.grapheneos.org/blob/main/static/allowed_signers">GitHub</a></li> + </ul> - <pre>untrusted comment: GrapheneOS factory images public key -RWQZW9NItOuQYJ86EooQBxScfclrWiieJtAO9GpnfEjKbCO/3FriLGX3</pre> + <p>The current public key is signed with the previous signify key. If you already + have the previous signify public key (factory.pub) and want to verify the new key + with it:</p> - <p>The public key has also been published via the official - <a href="https://twitter.com/GrapheneOS/status/1145259815851253762">@GrapheneOS Twitter - account</a>, - <a href="https://www.reddit.com/r/GrapheneOS/comments/c7gb3f/grapheneos_factory_images_are_now_signed_with/esewpm9">the /u/GrapheneOS - Reddit account</a> and <a href="https://github.com/GrapheneOS/releases.grapheneos.org/blob/main/static/factory.pub">is available on GitHub</a>. - When the current signing key is replaced, the new key will be signed with it.</p> + <pre>curl -O https://releases.grapheneos.org/allowed_signers.sig +signify -V -m allowed_signers -x allowed_signers.sig -p factory.pub</pre> + + <p>When the current signing key is replaced, the new key will be signed with it.</p> <p>Download the factory images for the device from <a href="/releases">the releases page</a>. For example, to download the 2021110122 release for a device with the @@ -429,14 +432,15 @@ RWQZW9NItOuQYJ86EooQBxScfclrWiieJtAO9GpnfEjKbCO/3FriLGX3</pre> <pre>curl -O https://releases.grapheneos.org/<var>DEVICE_NAME</var>-factory-2021110122.zip curl -O https://releases.grapheneos.org/<var>DEVICE_NAME</var>-factory-2021110122.zip.sig</pre> - <p>Verify the factory images using the signature if you were able to obtain - <code>signify</code> from trusted package repositories (see above), otherwise - continue on to the next section without this:</p> + <p>Verify the factory images using the signature if you were able to obtain OpenSSH + from trusted package repositories (see above), otherwise continue on to the next + section without this:</p> + + <pre>ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s <var>DEVICE_NAME</var>-factory-2021110122.zip.sig < <var>DEVICE_NAME</var>-factory-2021110122.zip</pre> - <pre>signify -Cqp factory.pub -x <var>DEVICE_NAME</var>-factory-2021110122.zip.sig && echo verified</pre> + <p>This will producing the following output when successful:</p> - <p>This will output <code>verified</code> if verification is successful. If something - goes wrong, it will output an error message rather than <code>verified</code>.</p> + <pre>Good "factory images" signature for contact@grapheneos.org with ED25519 key SHA256:AhgHif0mei+9aNyKLfMZBh2yptHdw/aN7Tlh/j2eFwM</pre> </section> <section id="flashing-factory-images"> diff --git a/static/install/index.html b/static/install/index.html index 77691640..9ec5bfad 100644 --- a/static/install/index.html +++ b/static/install/index.html @@ -53,7 +53,7 @@ on.</p> <p>The command-line approach offers a way to install GrapheneOS without trusting our - server infrastructure. This requires being on an OS with proper fastboot and signify + server infrastructure. This requires being on an OS with proper fastboot and OpenSSH packages along with understanding the process enough to avoid blindly trusting the instructions from our site. For most users, the web-based installation approach is no less secure and avoids needing any software beyond a browser with WebUSB support.</p> diff --git a/static/js/redirect.js b/static/js/redirect.js index d1818ec0..ea52892a 100644 --- a/static/js/redirect.js +++ b/static/js/redirect.js @@ -28,6 +28,8 @@ const redirects = new Map([ ["/build#enabling-updatable-apex-components", "/build#apex-components"], + ["/install/cli#obtaining-signify", "/install/cli#obtaining-openssh"], + // legacy devices ["/releases#marlin-stable", "/faq#legacy-devices"], ["/releases#marlin-beta", "/faq#legacy-devices"], |