From 4f3bee20cda71458d60985b3713028a7d6460b9e Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Wed, 14 Feb 2024 06:42:12 -0500 Subject: move to OpenSSH signing for factory images --- static/install/cli.html | 72 +++++++++++++++++++++++++---------------------- static/install/index.html | 2 +- 2 files changed, 39 insertions(+), 35 deletions(-) (limited to 'static/install') diff --git a/static/install/cli.html b/static/install/cli.html index 1be722fc..dfd44ee1 100644 --- a/static/install/cli.html +++ b/static/install/cli.html @@ -74,7 +74,7 @@
  • Booting into the bootloader interface
  • Connecting the device
  • Unlocking the bootloader
    • -
  • Obtaining signify
    • +
  • Obtaining OpenSSH
  • Obtaining factory images
  • Flashing factory images @@ -370,28 +370,22 @@ Installed as /home/username/platform-tools/fastboot to confirm.

    -
    -

    Obtaining signify

    +
    +

    Obtaining openssh

    -

    On the supported Linux distributions, the signify tool is used to verify the - download of the OS beyond the security offered by HTTPS. You should skip this on - macOS and Windows. It only makes sense to do this if you can obtain signify from - the distribution package repositories. GrapheneOS releases are hosted on our - servers and we do not have third party mirrors.

    +

    On the supported Linux distributions, OpenSSH is used to verify the download of + the OS beyond the security offered by HTTPS. You should skip this on macOS and + Windows. It only makes sense to do this if you can obtain OpenSSH from the + distribution package repositories. GrapheneOS releases are hosted on our servers and + we do not have third party mirrors.

    On Arch Linux:

    - 
    sudo pacman -S signify
    + 
    sudo pacman -S openssh

    On Debian and Ubuntu:

    - 
    sudo apt install signify-openbsd
-alias signify=signify-openbsd
    - -

    On Debian-based distributions, the signify package and command are an - unmaintained mail-related - tool for generating mail signatures (not cryptographic signatures). Make sure - to install signify-openbsd.

    + 
    sudo apt install openssh-client
    @@ -405,22 +399,31 @@ alias signify=signify-openbsd using it for the rest of the installation process, so these instructions use curl.

    -

    Download the factory images - public key (factory.pub) in order to verify the factory images:

    +

    Download the factory images + public key (allowed_signers) in order to verify the factory images:

    + + 
    curl -O https://releases.grapheneos.org/allowed_signers
    + +

    This is the content of allowed_signers:

    + + 
    contact@grapheneos.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUg/m5CoP83b0rfSCzYSVA4cw4ir49io5GPoxbgxdJE
    - 
    curl -O https://releases.grapheneos.org/factory.pub
    +

    Other locations to obtain the signing key:

    -

    This is the content of factory.pub:

    + - 
    untrusted comment: GrapheneOS factory images public key
-RWQZW9NItOuQYJ86EooQBxScfclrWiieJtAO9GpnfEjKbCO/3FriLGX3
    +

    The current public key is signed with the previous signify key. If you already + have the previous signify public key (factory.pub) and want to verify the new key + with it:

    -

    The public key has also been published via the official - @GrapheneOS Twitter - account, - the /u/GrapheneOS - Reddit account and is available on GitHub. - When the current signing key is replaced, the new key will be signed with it.

    + 
    curl -O https://releases.grapheneos.org/allowed_signers.sig
+signify -V -m allowed_signers -x allowed_signers.sig -p factory.pub
    + +

    When the current signing key is replaced, the new key will be signed with it.

    Download the factory images for the device from the releases page. For example, to download the 2021110122 release for a device with the @@ -429,14 +432,15 @@ RWQZW9NItOuQYJ86EooQBxScfclrWiieJtAO9GpnfEjKbCO/3FriLGX3 

    curl -O https://releases.grapheneos.org/DEVICE_NAME-factory-2021110122.zip
 curl -O https://releases.grapheneos.org/DEVICE_NAME-factory-2021110122.zip.sig
    -

    Verify the factory images using the signature if you were able to obtain - signify from trusted package repositories (see above), otherwise - continue on to the next section without this:

    +

    Verify the factory images using the signature if you were able to obtain OpenSSH + from trusted package repositories (see above), otherwise continue on to the next + section without this:

    + + 
    ssh-keygen -Y verify -f allowed_signers -I contact@grapheneos.org -n "factory images" -s DEVICE_NAME-factory-2021110122.zip.sig < DEVICE_NAME-factory-2021110122.zip
    - 
    signify -Cqp factory.pub -x DEVICE_NAME-factory-2021110122.zip.sig && echo verified
    +

    This will producing the following output when successful:

    -

    This will output verified if verification is successful. If something - goes wrong, it will output an error message rather than verified.

    + 
    Good "factory images" signature for contact@grapheneos.org with ED25519 key SHA256:AhgHif0mei+9aNyKLfMZBh2yptHdw/aN7Tlh/j2eFwM
    diff --git a/static/install/index.html b/static/install/index.html index 77691640..9ec5bfad 100644 --- a/static/install/index.html +++ b/static/install/index.html @@ -53,7 +53,7 @@ on.

    The command-line approach offers a way to install GrapheneOS without trusting our - server infrastructure. This requires being on an OS with proper fastboot and signify + server infrastructure. This requires being on an OS with proper fastboot and OpenSSH packages along with understanding the process enough to avoid blindly trusting the instructions from our site. For most users, the web-based installation approach is no less secure and avoids needing any software beyond a browser with WebUSB support.

    -- cgit v1.3.1