diff --git a/docs/MAN_CISS_ISO_BOOT_CHAIN.md b/docs/MAN_CISS_ISO_BOOT_CHAIN.md index 93e267b..9c5efaf 100644 --- a/docs/MAN_CISS_ISO_BOOT_CHAIN.md +++ b/docs/MAN_CISS_ISO_BOOT_CHAIN.md @@ -224,17 +224,29 @@ dmsetup table --showkeys CHILD # expect integrity hmac sha512 4096 ```mermaid flowchart TD - - -A["Build time: pin EXP_FPR + embed ISO key"] --> B["ISO artifacts: sha512sum.txt + .sig"]; -B --> C["Boot early (0030): gpgv verify + FPR pin"]; -C -->|OK| D["LUKS open (0024)"]; -D --> E["Mount RootFS"]; -E --> F["Boot late (0042): gpgv verify + FPR pin (root key)"]; -F --> G["dmsetup health: crypt(XTS) over integrity(HMAC-SHA-512)"]; -C -- FAIL --> X["Abort"]; -F -- FAIL --> X; +A["ISO build time: embedded and pinned GPG FPR"] e1@--> B["ISO build time: generate sha512sum.txt and .sig"]; +B e2@--> C["ISO build time: LUKS2 dm-integrity encryption of filesystem.squashfs in ciss_rootfs.crypt"]; +C e3@--> D["ISO boot time: 0024 LUKS2, dm-integrity HMAC-SHA512"]; +D e4@-->|SUCCESSFUL| E["ISO boot time: ciss_rootfs.crypt opened"]; +E e5@--> F["ISO boot time: mounting RootFS"]; +F e6@--> G["ISO boot time: 0030 verification of authenticity and integrity via embedded and pinned GPG of ISO edge"]; +G e7@-->|SUCCESSFUL| H["ISO boot time: ISO edge verified"]; +H e8@--> I["ISO boot time: 0042 verification of authenticity and integrity via embedded and pinned GPG of RootFS"]; +I e9@-->|SUCCESSFUL| J["ISO boot time: ISO RootFS verified"]; +J e0@--> K{{"ISO run time: CISS.debian.live.builder ISO running"}}; +D -- FAIL --> X{{"Boot process halted"}}; G -- FAIL --> X; +I -- FAIL --> X; +e0@{ animation: fast } +e1@{ animation: fast } +e2@{ animation: fast } +e3@{ animation: fast } +e4@{ animation: fast } +e5@{ animation: fast } +e6@{ animation: fast } +e7@{ animation: fast } +e8@{ animation: fast } +e9@{ animation: fast } ``` # 14. Closing Remark