msw/CISS.debian.live.builder
SHA256
2
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 6 Wiki Activity

V8.13.432.2025.11.18
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m26s
Details

Browse Source 
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
Marc S. Weidner
2025-11-18 14:50:55 +00:00
parent 0bb2d4e398
commit 80fb860f35
1 changed files with 22 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
docs/MAN_CISS_ISO_BOOT_CHAIN.md
View File

@@ -224,17 +224,29 @@ dmsetup table --showkeys CHILD # expect integrity hmac sha512 4096
```mermaid
flowchart TD
A["Build time: pin EXP_FPR + embed ISO key"] --> B["ISO artifacts: sha512sum.txt + .sig"];
B --> C["Boot early (0030): gpgv verify + FPR pin"];
C -->|OK| D["LUKS open (0024)"];
D --> E["Mount RootFS"];
E --> F["Boot late (0042): gpgv verify + FPR pin (root key)"];
F --> G["dmsetup health: crypt(XTS) over integrity(HMAC-SHA-512)"];
C -- FAIL --> X["Abort"];
F -- FAIL --> X;
A["ISO build time: embedded and pinned GPG FPR"] e1@--> B["ISO build time: generate sha512sum.txt and .sig"];
B e2@--> C["ISO build time: LUKS2 dm-integrity encryption of filesystem.squashfs in ciss_rootfs.crypt"];
C e3@--> D["ISO boot time: 0024 LUKS2, dm-integrity HMAC-SHA512"];
D e4@-->|SUCCESSFUL| E["ISO boot time: ciss_rootfs.crypt opened"];
E e5@--> F["ISO boot time: mounting RootFS"];
F e6@--> G["ISO boot time: 0030 verification of authenticity and integrity via embedded and pinned GPG of ISO edge"];
G e7@-->|SUCCESSFUL| H["ISO boot time: ISO edge verified"];
H e8@--> I["ISO boot time: 0042 verification of authenticity and integrity via embedded and pinned GPG of RootFS"];
I e9@-->|SUCCESSFUL| J["ISO boot time: ISO RootFS verified"];
J e0@--> K{{"ISO run time: CISS.debian.live.builder ISO running"}};
D -- FAIL --> X{{"Boot process halted"}};
G -- FAIL --> X;
I -- FAIL --> X;
e0@{ animation: fast }
e1@{ animation: fast }
e2@{ animation: fast }
e3@{ animation: fast }
e4@{ animation: fast }
e5@{ animation: fast }
e6@{ animation: fast }
e7@{ animation: fast }
e8@{ animation: fast }
e9@{ animation: fast }
```
# 14. Closing Remark