Arch iso boot fixup (kexec-parse-boot and kexec-boot-iso fixups) #1120

tlaurion · 2022-02-21T17:17:17Z

Archlinux is providing detached signed iso, just like Tails and Qubes OS. We add it here:

The public key was generated in this PR for inclusion by :

mkdir /tmp/test3
gpg --homedir /tmp/test3 --auto-key-locate clear,wkd -v --locate-external-key [email protected]
gpg --homedir /tmp/test3 --edit-key [email protected]
(minimize, save)
gpg --homedir /tmp/test3 --export --armor > ~/heads/initrd/etc/distro/keys/archlinux.key

One can then build Heads to boot from detached signed iso. Download ISO and detached signature:
http://mirror.rackspace.com/archlinux/iso/2022.02.01/archlinux-2022.02.01-x86_64.iso
http://mirror.rackspace.com/archlinux/iso/2022.02.01/archlinux-2022.02.01-x86_64.iso.sig
Flash build ROM. Put downloaded iso and detached signature on USB thumb drive. Boot from ISO (Options,Boot options, USB boot)
Realize that arch is waiting for /dev/disk/by/label/ARCH_202202 which is never brought up.

@tslilc : Any insight? Does that need to be fixed upstream by Archlinux?

kexec boot params are passing archisolabel=ARCH_202202 and archisobasedir=arch
where the actual Heads added arguments are passing the right uuid, as to boot all other ISOs....
Arch really wants to boot from label, while not making it available.... How to fix this? not sure and not investigated.
EDIT: fixed with kexec-iso-boot fixup.

Hint: There might be code inside of linuxboot/webboot that might help us resolve this, since they implemented a correct parser.

On the good side, the present commit is not breaking other detached signature verified ISO boot:

c511c68 is not breaking:
- Tails 4.26 boots from detached signature verified iso (fromiso= passes uuid not label at final kexec call)
- Qubes 4.0.4 boots from detached signature verified iso. (fromiso= passes uuid not label at final kexec call)

tlaurion · 2022-02-21T17:38:15Z

Some hints on why this might not be working out of the box

Not sure how to hack around this.

On Heads side, a quick hack was done a while ago to permit iso boot, which was to pass fromiso and the iso boot options to cover most OS iso boot.

Some recalled hints: #470 (comment), pointing to https://mbusb.aguslr.com/howto.html shows that Arch expects:
img_dev=$imgdevpath img_loop=$iso_path

Since Heads already passes variables to support debian (findiso=$iso_path) and fedora (iso-scan/filename=$iso_path), there might be a need to support others, since those variables are only picked up by the OS that are interested in them.

tlaurion · 2022-02-21T18:05:03Z

Ok with 8f6c61c change, the iso boots successfully!

Then comes the time to install it and have it booted successfully, which will probably require additional changes to kexec-parse-boot. But in current state, it seems to fit original need of #584.

fixes #584

@tslilc @MrChromebox please review.
If you have ideas on how to fix #1001 and #1117 properly.... be my guest!

techge · 2022-02-23T07:39:20Z

What exactly needs to get tested if you already checked it correctly? That is to say: I am not sure what exactly I am supposed to be looking for.
What is the best way to get a pre-built rom (which option/version shall I use) these days? I do not have a working toolchain right now...

techge · 2022-02-23T10:21:44Z

btw, I just remembered: Ironically, I flashed a coreboot rom last weekend, because I was annoyed that I can not start my arch iso in heads to re-install my system :D

lynxred · 2022-02-23T11:50:09Z

mkdir /tmp/test3
gpg --homedir /tmp/test3 --auto-key-locate clear,wkd -v --locate-external-key [email protected]
gpg --homedir /tmp/test3 --edit-key [email protected]
(minimize, save)
gpg --homedir /tmp/test3 --export --armor > ~/heads/initrd/etc/distro/keys/archlinux.key

it needs to be written in the heads console?

lynxred · 2022-02-23T13:27:19Z

i see this error

tlaurion · 2022-02-23T13:41:59Z

mkdir /tmp/test3
gpg --homedir /tmp/test3 --auto-key-locate clear,wkd -v --locate-external-key [email protected]
gpg --homedir /tmp/test3 --edit-key [email protected]
(minimize, save)
gpg --homedir /tmp/test3 --export --armor > ~/heads/initrd/etc/distro/keys/archlinux.key

@lynxred: No. That is how Arch linux distribution public key was added to Heads in this PR.
And Archlinux distibution signing key being inside of this PR permits Heads to verify ISO detached signed integrity against it through USB boot option. You are not using the ROM provided by this PR in the above picture aren't, you?

@techge The iso boots from this PR.
But that Arch being installed on disk? Not tested.
You reported in the past that initrd needed to be manually generated (#702)
Is it still the case? I915 driver still missing from initrd?

tlaurion · 2022-02-23T14:17:07Z

@techge : To download prebuilt roms: linuxboot/heads-wiki#88

@tslilc

bin/kexec-parse-boot: test linuxboot@2bb1f52 that fix correctly comma seperated arguments. Still TODO: when booting, Heads tries to find where the ISO with /dev/disk/by-label/ARCH_202202 wich is never brought up. uuids could, not sure why the label is not brought up correctly. Maybe an issue in the way Arch makes the ISO. @tslilc : Any idea to continue linuxboot#584 or modify linuxboot#762?

…und at https://mbusb.aguslr.com/howto.html)

tlaurion · 2022-02-23T14:51:10Z

i see this error

So following your comment here #1117 (comment) I expect you are using x230-maximized ROM. And following the error you have #1120 (comment) even through ISO was signed in FEB 2022, I expect you are not running the ROM produced by this PR when clicking 8f6c61c green mark, x230-maximized board, artifacts and then downloading the full ROM (not top.rom nor bottom.rom, and flash internally with USB thumb drive containing that file).

Again: only flash internally from Legacy->Legacy, Maximized->Maximized. Those cannot be mixed.

tlaurion · 2022-02-23T14:52:13Z

@lynxred And I just realised that this PR was not based on master, and consequently, the x230-maximized board was not built by the CircleCI prior of your report.

CircleCI is building for x230-maximized again with 1809b3b being rebased on top of master (which included new instructions for CircleCI to built for x230-maximized), sorry about that.

tlaurion · 2022-02-23T14:57:50Z

btw, I just remembered: Ironically, I flashed a coreboot rom last weekend, because I was annoyed that I can not start my arch iso in heads to re-install my system :D

@techge hopefully, you are willing to retest installation/boot and report with ROM produced in this PR!

techge · 2022-02-28T08:18:14Z

@techge hopefully, you are willing to retest installation/boot and report with ROM produced in this PR!

I am willing, but I can't make any promises about when this will happen. I try to do it this week though. I am sorry.

tlaurion · 2022-03-07T23:13:28Z

Just retested from ISO boot:

Q4.1, Q4.0
Archlinux
Tails 4.26

tlaurion marked this pull request as draft February 21, 2022 17:17

tlaurion marked this pull request as ready for review February 21, 2022 18:06

tlaurion mentioned this pull request Feb 21, 2022

Archlinux freezes after kexec #1117

Closed

tlaurion changed the title ~~WiP: Arch iso boot fixup (kexec-parse-boot fixup)~~ Arch iso boot fixup (kexec-parse-boot and kexec-boot-iso fixups) Feb 21, 2022

This was referenced Feb 21, 2022

Tweak syslinux parsing code to be compatible with new Arch isos #762

Closed

Booting Arch Linux #702

Open

tslil clingman and others added 3 commits February 23, 2022 09:50

Tweak syslinux parsing code to be compatible with new Arch isos

6769c38

bin/kexec-iso-init: Add support for Arch iso support requirements (fo…

1809b3b

…und at https://mbusb.aguslr.com/howto.html)

tlaurion force-pushed the arch_iso_boot_fixup branch from 8f6c61c to 1809b3b Compare February 23, 2022 14:50

MrChromebox approved these changes Mar 7, 2022

View reviewed changes

tlaurion merged commit acf7091 into linuxboot:master Mar 8, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Arch iso boot fixup (kexec-parse-boot and kexec-boot-iso fixups) #1120

Arch iso boot fixup (kexec-parse-boot and kexec-boot-iso fixups) #1120

tlaurion commented Feb 21, 2022 •

edited

Loading

tlaurion commented Feb 21, 2022

tlaurion commented Feb 21, 2022 •

edited

Loading

techge commented Feb 23, 2022

techge commented Feb 23, 2022

lynxred commented Feb 23, 2022

lynxred commented Feb 23, 2022

tlaurion commented Feb 23, 2022 •

edited

Loading

tlaurion commented Feb 23, 2022

tlaurion commented Feb 23, 2022 •

edited

Loading

tlaurion commented Feb 23, 2022 •

edited

Loading

tlaurion commented Feb 23, 2022

techge commented Feb 28, 2022

tlaurion commented Mar 7, 2022

Arch iso boot fixup (kexec-parse-boot and kexec-boot-iso fixups) #1120

Arch iso boot fixup (kexec-parse-boot and kexec-boot-iso fixups) #1120

Conversation

tlaurion commented Feb 21, 2022 • edited Loading

tlaurion commented Feb 21, 2022

tlaurion commented Feb 21, 2022 • edited Loading

techge commented Feb 23, 2022

techge commented Feb 23, 2022

lynxred commented Feb 23, 2022

lynxred commented Feb 23, 2022

tlaurion commented Feb 23, 2022 • edited Loading

tlaurion commented Feb 23, 2022

tlaurion commented Feb 23, 2022 • edited Loading

tlaurion commented Feb 23, 2022 • edited Loading

tlaurion commented Feb 23, 2022

techge commented Feb 28, 2022

tlaurion commented Mar 7, 2022

tlaurion commented Feb 21, 2022 •

edited

Loading

tlaurion commented Feb 21, 2022 •

edited

Loading

tlaurion commented Feb 23, 2022 •

edited

Loading

tlaurion commented Feb 23, 2022 •

edited

Loading

tlaurion commented Feb 23, 2022 •

edited

Loading