From 191905e493e680dc8a36bce7d28d7e912d2e98bd Mon Sep 17 00:00:00 2001 From: Andrew Cady Date: Wed, 21 Jun 2023 23:40:03 -0400 Subject: remove gpg --- .gitmodules | 3 -- Makefile | 30 +++--------------- initramfs-tools/scripts/samizdat | 19 +----------- src/initrd/btrfs-create.sh | 52 +++---------------------------- src/initrd/common.sh | 5 --- src/initrd/grok-block | 66 ++-------------------------------------- src/initrd/menu-select | 10 +----- src/partvi | 13 -------- 8 files changed, 12 insertions(+), 186 deletions(-) diff --git a/.gitmodules b/.gitmodules index 8dd443e..43d1ad1 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,9 +1,6 @@ [submodule "fsmgr"] path = fsmgr url = d@cryptonomic.net:public_git/fsmgr.git -[submodule "kiki"] - path = kiki - url = d@cryptonomic.net:public_git/kiki.git [submodule "cryptonomic-dyndns-server"] path = cryptonomic-dyndns-server url = d@cryptonomic.net:public_git/cryptonomic-dyndns-server.git diff --git a/Makefile b/Makefile index 634a418..a376a64 100644 --- a/Makefile +++ b/Makefile @@ -8,7 +8,7 @@ compiled_programs=${cc_files} ${cpp_files} CC=gcc -std=gnu99 CFLAGS=-Os -INSTALL_SUBMODULES = fsmgr kiki +INSTALL_SUBMODULES = fsmgr NO_INSTALL_SUBMODULES = cryptonomic-dyndns-server SUBMODULES = $(INSTALL_SUBMODULES) $(NO_INSTALL_SUBMODULES) @@ -47,9 +47,8 @@ $(addprefix src/, $(dyndns_links)): src_bin_programs = xorriso-usb.sh btrfs-functions.sh btrfs-receive-root.sh \ btrfs-send-root.sh var.sh grub-efi.sh keygen.sh initrd.sh qemu.sh \ -dnsmasq-dhcp-script.sh samizdat-password-agent samizdat-gpg-agent publish-ip.sh \ -samizdat-daily-snapshot-root samizdat-diff-root kiki-export-stdout \ -kiki-import-stdin store-child-permanently git-ll-remote usb \ +dnsmasq-dhcp-script.sh publish-ip.sh \ +git-ll-remote usb \ hostname.cryptonomic.net partvi ficlonerange.py ${dyndns_progs} bin_programs=$(addprefix src/, $(src_bin_programs)) samizdat-paths.sh ${cc_files} ${btrfs_utils} @@ -118,8 +117,6 @@ ifndef instdir else install -p -m0644 -DT conf/postfix_main.cf ${instdir}/etc/postfix/main.cf install -p -m0644 -DT conf/torrc ${instdir}/etc/tor/torrc - ln -sf /var/cache/kiki/config/tor/hostname ${instdir}/etc/mailname - ln -sf /var/cache/kiki/config/tor/hostname ${instdir}/etc/hostname endif include user.mk @@ -178,23 +175,10 @@ boot: rootfs fastboot: rootfs sudo qemu.sh -reuse_child := $(shell 2>/dev/null read child < reused-child && echo --reuse-child=$$child; true) - samizdat.netinst.iso: | rootfs/samizdat.btrfs exit 1; sudo initrd.sh sudo xorriso-usb.sh $(reuse_child) --bootloader --out $@ -reused-child: - sudo keygen.sh ${samizdat_child_dir}/child.$$$$ && \ - sudo store-child-permanently $$$$ && \ - echo $$$$ > $@ - -testclean: - make -C kiki install - sudo mv /root/.gnupg /root/.gnupg.$$(date -Im) || true - sudo killall gpg-agent || true - rm -f reused-child - cleantest: make testclean make isotest @@ -205,9 +189,6 @@ isotest: samizdat.iso isotest-netinst: samizdat.netinst.iso USE_ISO=y SLOW_BOOT=y qemu.sh $^ -gpg_iso_path=gnupghome -GPG_INPUT_DIR=${samizdat_child_dir}/child.$(shell cat reused-child)/root/.gnupg - samizdat_btrfs_patch_size=256M get_loop_dev="$$(sudo losetup -n -O name -j $@~tmp)" @@ -233,9 +214,6 @@ veritymount: rootfs/samizdat.seed.btrfs.verity.log $(verity_root_hash) sudo veritysetup remove samizverity -%.verity.log.asc: %.verity.log - sudo gpg --armor --detach-sign $^ - rootfs/%.btrfs: $(SUDO_MAKE) -C rootfs $(notdir $@) @@ -298,7 +276,7 @@ gold.iso: rootfs/seed.iso reused-child mv $@~tmp $@ rootfs/seed.iso: $(addprefix rootfs/samizdat.seed.btrf, s \ - $(if $(VERITY), s.verity s.verity.log $(if $(VERITY_SIGN), s.verity.log.asc))) + $(if $(VERITY), s.verity s.verity.log)) rm -f $@~tmp touch $@~tmp fallocate -n -l 10G $@~tmp diff --git a/initramfs-tools/scripts/samizdat b/initramfs-tools/scripts/samizdat index 8e9d4fa..9d8b846 100644 --- a/initramfs-tools/scripts/samizdat +++ b/initramfs-tools/scripts/samizdat @@ -62,15 +62,11 @@ mountroot() if [ "$nbdroot" ]; then my_configure_networking run_nbd_client - - wait_for_gnupghome_tar - (sleep 5; echo ) & - (. common.sh && . btrfs-create.sh && init_gpg) + (. common.sh && . btrfs-create.sh) fi bootmenu samizdat_install_udev_rules - bootwait samizdat-gpg bootwait root-mounted osname=$(get_os_name) write_resolv_dot_conf @@ -87,19 +83,6 @@ Press alt-f9 for rescue terminal. EOF } -wait_for_gnupghome_tar() -{ - [ -e /gnupghome.tar ] && return - echo -n Waiting to receive GPG keys through the network... > /dev/tty1 - (while ! tftp -g -r gnupghome.tar -l /gnupghome.tar.$$ "$ROOTSERVER" 2>/run/initramfs/samizdat/log/tftp.$$.log; do - sleep 1; - echo -n . > /dev/tty1 - done - mv /gnupghome.tar.$$ /gnupghome.tar) - echo ' done.' > /dev/tty1 - bootdone gnupg-tar -} - samizdat_restart_udev() { local LOG_DIR=/run/initramfs/samizdat/log diff --git a/src/initrd/btrfs-create.sh b/src/initrd/btrfs-create.sh index 894d835..5a43977 100644 --- a/src/initrd/btrfs-create.sh +++ b/src/initrd/btrfs-create.sh @@ -5,21 +5,6 @@ losetup() { /sbin/losetup "$@"; } -luks_secret() -{ - local parms=$-; # this junk keeps set -x from being too annoying - set +x - [ -n "$luks_secret" ] || luks_secret="$(head -c256 /dev/urandom)" - printf %s "$luks_secret" - case $parms in *x*) set -x; set -x ;; esac -} - -floor4() -{ - # Negatives round up, but aren't used. - echo $(($1 / 4 * 4)) -} - ceil4() { local x="$1" @@ -205,11 +190,8 @@ initialize_root_filesystem() done chroot /root chown -R u:u ${uhome} - mv /root/root/.gnupg /root/root/.gnupg~ - mv /gpg/gnupghome /root/root/.gnupg || return - copy_execs sbin mdadm dmsetup cryptsetup fsck.hfsplus - copy_execs bin btrfs rsync gpg gpg2 gpg-agent + copy_execs bin btrfs rsync # Copy these over unconditionally, because they ought to remain in sync with # the initrd. @@ -333,8 +315,7 @@ open_samizdat_blockdev() if [ ! -e "$decrypted_keyfile" ] then - gpg2 --verify "$keyfile" || return - gpg2 --output=- --verify "$keyfile" | gpg2 --decrypt > "$decrypted_keyfile" || return + echo -n secret > "$decrypted_keyfile" fi cryptsetup --key-file "$decrypted_keyfile" luksOpen "$dev" "$cryptname" || return @@ -349,12 +330,9 @@ init_samizdat_blockdev() [ ! -b /dev/mapper/"$cryptname" ] || return - luks_secret >/dev/null - luks_secret | gpg2 --default-recipient-self --encrypt --armor | gpg2 --clearsign --output "$keyfile" || return - - luks_secret | cryptsetup -v luksFormat "$dev" - || return + echo -n secret | cryptsetup -v luksFormat "$dev" - || return cryptsetup luksDump "$dev" >&2 - luks_secret | cryptsetup --key-file - luksOpen "$dev" "$cryptname" || return + echo -n secret | cryptsetup --key-file - luksOpen "$dev" "$cryptname" || return [ -b /dev/mapper/"$cryptname" ] || return } @@ -415,28 +393,6 @@ get_cdrom_sizelimit() fi } -init_gpg() -{ - export GNUPGHOME=/gpg/gnupghome - mkdir -p "$GNUPGHOME" - if [ -e /gnupghome.tar ]; then - tar -C "$GNUPGHOME" -zxf /gnupghome.tar && bootdone samizdat-gpg - return - else - bootwait samizdat-cdrom - (umask 077; rsync --exclude '/luks-key*' --ignore-existing -rpP /cdrom/gnupghome/ "$GNUPGHOME") - bootdone samizdat-gpg - fi - - local LOG_DIR=/run/initramfs/samizdat/log - if samizdat-password-agent > "$LOG_DIR"/samizdat-password-agent.log 2>&1; then - true - else - echo 'samizdat-password-agent failed; continuing in hope of hope...' - true # false - fi -} - start_meter() { local startmsg="$*" diff --git a/src/initrd/common.sh b/src/initrd/common.sh index 8f4e101..d7d7fa0 100644 --- a/src/initrd/common.sh +++ b/src/initrd/common.sh @@ -148,9 +148,4 @@ my_openvt() /bin/openvt -c "$@" } -# This runs before way before NTP and on a LiveCD we have no -# reason to trust the system clock. -gpg2_nobatch() { GPG_TTY=$(tty) command gpg2 --ignore-time-conflict --ignore-valid-from "$@"; } -gpg2() { gpg2_nobatch --batch "$@"; } - xcp() { if [ -f "$1" -a ! -f "$2" ]; then cp "$1" "$2"; fi; } diff --git a/src/initrd/grok-block b/src/initrd/grok-block index a7056ad..d194486 100755 --- a/src/initrd/grok-block +++ b/src/initrd/grok-block @@ -7,15 +7,6 @@ case "$DEVNAME" in /dev/loop*|/dev/ram*|/dev/dm-*|/dev/md*|/dev/fd*) exit ;; esa debug_log "grok-block.${DEVNAME##*/}" -addmenu_choosekey() -{ - dev=$1 - dir=$2 - addmenu "$dev//$dir" \ - "[ Use the GPG key on $dev ]" \ - "menu-select boot-gpg $dev $dir" -} - addmenu_repairhfs() { local device="$1" @@ -87,26 +78,6 @@ retry_mount() done } -Gpg2() -{ - gpg2 --lock-never --no-permission-warning --no-auto-check-trustdb --no-options "$@" -} - -gpg_verify() -{ - [ -e "$1" ] || return - bootwait samizdat-gpg - export GNUPGHOME=/gpg/gnupghome - Gpg2 --verify "$1" -} - -gpg_can_decrypt() -{ - [ -e "$1" ] || return - bootwait samizdat-gpg - Gpg2 --decrypt "$1" | Gpg2 --decrypt "$1" >/dev/null -} - is_lvm() { for n in 0 1 2 3; do @@ -229,21 +200,7 @@ grok_block() # TODO: And what if we create partitions and then reboot the machine mid-install? elif [ "$ID_PART_ENTRY_NAME" = samizdat-rootfs ]; then - : - - elif [ "$ID_PART_ENTRY_NAME" = samizdat-keys ]; then - mkdir -p /gpg - cp -a "$mountpoint"/gnupghome /gpg/ && bootdone samizdat-gpg && bootdone samizdat-cdrom - - elif [ "$ID_PART_ENTRY_NAME" = samizdat-plaintext ]; then - if gpg_verify "$mountpoint"/disk.key && gpg_can_decrypt "$mountpoint"/disk.key; then - umount "$mountpoint" - addmenu_choose_native_root "$(parent_device "$DEVNAME")" - bootdone key-mounted - else - umount "$mountpoint" - fi - + bootdone samizdat-rootfs elif [ "$DEVNAME" = /dev/nbd1 ]; then # This is our rootfs, over the network umount "$mountpoint" @@ -307,25 +264,6 @@ eval "$(PATH=$PATH:/lib/udev vol_id "$DEVNAME" | sed "s/'/'\\\\''/; s/=\(.*\)/='\1'/" )" -CDROM_ID_FS_UUID_ENC='73256269-4002-4e42-adbd-0e49ed1c7438' -CDROM_ID_FS_LABEL_ENC=$(sed 's/ /\\x20/g' /lib/samizdat/vol_id.txt) -if [ "$ID_FS_UUID_ENC" = "$CDROM_ID_FS_UUID_ENC" -o \ - "$ID_FS_LABEL_ENC" = "$CDROM_ID_FS_LABEL_ENC" ] -then - # Recognize and mount the Samizdat - if ! mountpoint -q /cdrom; then - mkdir -p /cdrom - . mdadm-dup.sh - dup_mount_cdrom "$DEVNAME" /cdrom && bootdone samizdat-cdrom - if [ -e /cdrom/gnupghome ]; then - # TODO: don't use first match - mkdir -p /gpg/gnupghome - cp /cdrom/gnupghome/* /gpg/gnupghome - bootdone samizdat-gpg - fi - fi -else - grok_block & -fi +grok_block & # vim:set et sw=2: diff --git a/src/initrd/menu-select b/src/initrd/menu-select index 1fcade4..9730c09 100755 --- a/src/initrd/menu-select +++ b/src/initrd/menu-select @@ -5,7 +5,6 @@ # $0 boot-overwrite [dev name] [loop file] [megabytes] - overwrite with new luks overlay # $0 boot-luks [dev name] [loop file] - boot existing luks-encrypted overlay # $0 boot-destroy-disk [dev-name] - install to a fresh hard disk -# $0 boot-gpg [key id] [gnupg homedir] [???] - boot any device signed with the key . btrfs-create.sh . common.sh @@ -76,7 +75,6 @@ case "$1" in # specified in KB here. I did not really believe it. modprobe brd rd_nr=1 rd_size=$memtotal_kb - init_gpg || error init_samizdat /dev/ram0 '' || { umount /root/cdrom umount /root/outerfs @@ -94,7 +92,6 @@ case "$1" in mkfs.btrfs -f "$dev"2 || error mkdir /plaintext mount "$dev"2 /plaintext || error - init_gpg || error init_samizdat_blockdev "$dev"3 /plaintext/disk.key || error init_samizdat /dev/mapper/samizdatcrypt '' || error @@ -106,10 +103,7 @@ case "$1" in boot-native) dev="$2" umount /plaintext || true - mkdir /plaintext - mount "$dev"2 /plaintext || error - init_gpg || error - open_samizdat_blockdev "$dev"3 /plaintext/disk.key || error + open_samizdat_blockdev "$dev"3 - || error open_samizdat || error open_samizdat bootdone root-mounted ;; @@ -128,8 +122,6 @@ case "$1" in rm "$loopfile" "$loopfile"k fi - init_gpg || error - if [ "$1" = 'boot-luks' ]; then open_samizdat_blockdev_from_loop "$loopfile" "$loopfile"k || error open_samizdat || error open_samizdat diff --git a/src/partvi b/src/partvi index 54e534c..e34eef6 100755 --- a/src/partvi +++ b/src/partvi @@ -298,7 +298,6 @@ copy_data_to_mounted_target_filesystems() $sudo systemd-run -p BindPaths="$(realpath -e "$mnt"):/boot" --wait update-grub ;; samizdat-keys) - $sudo rsync -a --info=STATS "$GPG_INPUT_DIR"/ "$mnt"/gnupghome/ ;; efi-system-partition) EFI_DIR=$mnt @@ -319,18 +318,6 @@ then sudo= else sudo=sudo fi -if [ "$GPG_INPUT_DIR" ] -then - $sudo [ -d "$GPG_INPUT_DIR" ] -else - for d in /root/.gnupg /cdrom/gnupghome - do - $sudo [ -d "$d" ] || continue - GPG_INPUT_DIR=$d - break - done -fi - SKIP_ROOTFS_COPY= if [ "$1" = 'key' ] then -- cgit v1.2.3