26

Re: Question about Grub2 and Luks2

The problem is: Not every professional is thinking same. I could name several strange and weird information contradicting from experts we two would acknowledge being in general individuals we at minimum read through. So I'm cautious with information given as the point of encryption is something always in development. If I would need to use some metaphor for this:

A house in endless building with never finishing possible. An eternal construction site!

You have one encryption-method you recognize that current time "safe". Tomorrow it is no longer "safe" as something is discovered. And that essential point is something in need under perspective. If you want to wait? Okay. But I cannot give any kind of timeline here, or if others have that amount of interest. I can only say what I have done for supporting: Giving information I have and also forwarding to people possible to support wide better. When nobody is supporting in the end or cannot offer the time: This ends exactly at the point I have already scribbled with "do it yourself". And a system as Hyperbola is stable and secure as possible, but foremost long-term and stable. That's the point!

And we cannot include any update just "like that". First it has to tested local and long-time, at best not encrypted and encrypted. Demanding this from one single person is not possible. So if you have interest in this, jim: You should be clear to engage within that instead of waiting.

Human being in favor with clear principles and so also for freedom in soft- and hardware!

Certainly anyone who has the power to make you believe absurdities has the power to make you commit injustices: For a life of every being full with peace and kindness, including diversity and freedom. Capitalism is destroying our minds, the planet itself and the universe in the end!

27

Re: Question about Grub2 and Luks2

I'm directly involved in this because I'm trying
install Luks2+argon2id+Libreboot (20230611)+partition /boot+Hyperbola. I haven't seen anyone else do this here. While working, questions arose that I addressed to you, that’s all.

There are no demands, accusations, emotions, etc.

Just a question to continue testing further.

If you don’t have the opportunity to help build PKGBUILD Grub 2.12, no problem, I’ll wait for someone who can help.
Is it possible to use Grub 2.04 which currently uses Hyperbola, I'm not sure...since I get the error I wrote about above.

If no one needs or is interested in it, let it be as it is...

28

Re: Question about Grub2 and Luks2

Well, I only speak of demands for the moment. But the other parts you have mentioned came and come up from way different persons, not you. As you have now mentioned them: That is the point bcause the impression may vary towards the real point behind. smile Meaning also: Grub is very very hard to build, takes also a long time doing so and patching is a tremendous act in that. When we make one error within that we break the whole boot for all people using Grub at the moment. So I need to underline the point we are operating into.

In general: I would then use this now as callout. If people are there granting jim and us from packaging a helping hand? Interested in testing? Please keep a call and come. smile

Human being in favor with clear principles and so also for freedom in soft- and hardware!

Certainly anyone who has the power to make you believe absurdities has the power to make you commit injustices: For a life of every being full with peace and kindness, including diversity and freedom. Capitalism is destroying our minds, the planet itself and the universe in the end!

29 (edited by jim 2024-01-31 14:54:17)

Re: Question about Grub2 and Luks2

Thanks for the information, I understand you. To understand the current situation and understand the actual problem in Grub or the Libreboot firmware (20230611), I’ll install Parabola (I’m just writing this as an example, I’m not comparing) and report the results here. I see that Parabola is using Grub 2:2.12

30

Re: Question about Grub2 and Luks2

You really do not need to be that careful: Comparing to understand errors is always fine. The only point I (personally speaking) just react harder when it comes like "X has Y, Hyperbola has not Y, why" - because it binds that amount of time to reply and get all the information again (we want to be fair and answer with correct parts and decisions made) that you loose time ... being more better to help the person asking for example or solving the more essential question behind: Why is there no real minimalistic or more minimalistic project solving that need from the person? Or did we just not found it until now?

Comparisons for solving errors or issues? Who am I to question that? Just be cautious that you don't fall into the comparison-trap and the version from Parabola is even more different from Arch GNU/Linux and we have another issue we also need to solve. When Parabola is not working the way you have in mind: Try it with Trisquel or Devuan for example. Doing comparisons for test-approval is just a normal way understanding issues. You can have:

- functional tests
- regression tests
- quality approvals and comparisons when there is no current definition known

And many more.

Human being in favor with clear principles and so also for freedom in soft- and hardware!

Certainly anyone who has the power to make you believe absurdities has the power to make you commit injustices: For a life of every being full with peace and kindness, including diversity and freedom. Capitalism is destroying our minds, the planet itself and the universe in the end!

31

Re: Question about Grub2 and Luks2

Hello Throgh. Please tell me Grub Hyperbola supports LUKS2 with Argon2id? If so, how can I check this?

32 (edited by jim 2024-02-01 13:16:52)

Re: Question about Grub2 and Luks2

As you may or may not know, there is another project called Gnuboot that uses a minimal number of blobs (I believe the smallest of all)
unlike Libreboot or Coreboot, here is their repository =>  https://ftp.gnu.org/gnu/gnuboot/gnuboot-0.1-rc3/  , but there is one BUT, at the moment, this is that Grub Gnuboot does not support Luks2+argon2id, but if the distribution supports Luks2+argon2id in our case it is Hyperbola, then you can install full-disk encryption including /boot partition using Luks2 +argon2id !

33

Re: Question about Grub2 and Luks2

jim wrote:

As you may or may not know, there is another project called Gnuboot that uses a minimal number of blobs (I believe the smallest of all)
unlike Libreboot or Coreboot, here is their repository =>  https://ftp.gnu.org/gnu/gnuboot/gnuboot-0.1-rc3/  , but there is one BUT, at the moment, this is that Grub Gnuboot does not support Luks2+argon2id, but if the distribution supports Luks2+argon2id in our case it is Hyperbola, then you can install full-disk encryption including /boot partition using Luks2 +argon2id !

I think there may also be canoeboot, but I do not know if it's code has any problems for freedom supporting software as I did not check all it's code.

https://trisquel.info/en/forum/gnu-boot … al-release

34

Re: Question about Grub2 and Luks2

Hello Other_Cody . You're wrong ! Gnuboot is not Canoeboot, not Libreboot.at, not Libreboot.org, not Coreboot.
Here is the information => https://savannah.gnu.org/news/?id=10571

35

Re: Question about Grub2 and Luks2

Other_Cody wrote:
jim wrote:

As you may or may not know, there is another project called Gnuboot that uses a minimal number of blobs (I believe the smallest of all)
unlike Libreboot or Coreboot, here is their repository =>  https://ftp.gnu.org/gnu/gnuboot/gnuboot-0.1-rc3/  , but there is one BUT, at the moment, this is that Grub Gnuboot does not support Luks2+argon2id, but if the distribution supports Luks2+argon2id in our case it is Hyperbola, then you can install full-disk encryption including /boot partition using Luks2 +argon2id !

I think there may also be canoeboot, but I do not know if it's code has any problems for freedom supporting software as I did not check all it's code.

https://trisquel.info/en/forum/gnu-boot … al-release


jim wrote:

Hello Other_Cody . You're wrong ! Gnuboot is not Canoeboot, not Libreboot.at, not Libreboot.org, not Coreboot.
Here is the information => https://savannah.gnu.org/news/?id=10571

I know Gnuboot is not Canoeboot, or any other program.

I was just typing about Canoeboot as a program that may or may not be a freedom supporting program that may or may not support

Luks2+argon2id

and that you may or may not yet be able to build on Hyperbola GNU/Linux-libre or HyperbolaBSD.

I think the Canoeboot website may have problems in text about "free as in freedom" software or in it's repository, though it may have patches that are under review and may or may not be merged into GNU Boot.

https://lists.gnu.org/archive/html/gnub … index.html

36

Re: Question about Grub2 and Luks2

Regarding Grub Hyperbola, I was wrong.
If the GRUB in the ROM supports LUKS2, then it can unlock the drive and boot the distribution directly - you don't even have to install GRUB in your distribution

Gnuboot developer answer

GNU Boot uses the official/main/major version of GRUB. At the moment, GRUB does not officially support Argon2, which means that using GRUB with Argon2 support may cause problems (and don't say it does, just say it can, since it hasn't been tested by the GRUB maintainers), so we're not changing his. So the answer is no, we do not support Argon2.

37

Re: Question about Grub2 and Luks2

jim wrote:

I wanted to ask you. Can I build this PKGBULD => Grub 2.12 =>  https://aur.archlinux.org/cgit/aur.git/ … 9fa4c2f50d  to install it and continue installing Luks2?
If I have Grub 2.12 (pkgdesc="GNU GRand Unified Bootloader (2) with Argon2 and better LUKS2 support") will the new version of Grub be able to decrypt the disk?

Actually,you should already be able to get FDE + /boot encrypted already.

You would need to reference the FDE + /boot guide on hyperbola's wiki but also reference that guide you made as well for FDE + /boot

If you can do the equivalent of the modifying the grub for FDE + /boot

It was on libreboot's website once, not sure if it still is.

If so it will boot, provided things match properly from your guide of FDE + /boot

to the modifying the grub, etc...

HyperbolaBSD: The Future of Secure Libre Lightweight Operating Systems!

38

Re: Question about Grub2 and Luks2

jim wrote:

Hello Throgh. Please tell me Grub Hyperbola supports LUKS2 with Argon2id? If so, how can I check this?

I had told you, I have gotten luks2 working with argon2id already.

It works. Only question is how to do ti for FDE + encrypted /boot

HyperbolaBSD: The Future of Secure Libre Lightweight Operating Systems!

39

Re: Question about Grub2 and Luks2

Hello Zapper.

Hello . We did not understand each other because the concept of FDE is used incorrectly.

In my understanding of FDE this is encryption including the /boot partition => https://cryptsetup-team.pages.debian.ne … boot.html,

And for most users this is encryption without the /boot partition

That's why confusion arises.

Now I have a question for you, since Throgh did not see in these notes how to solve the problem.

Here, from Leah's words, it is written how to do this => https://libreboot.org/docs/linux/#encry … th-argon2.
Do you understand what needs to be done here to encrypt the boot partition? If you don’t understand, like the rest of us, please check with her if it’s not difficult for you. They told me to look at this link and everything is a very unfriendly chat (my opinion) #libreboot

40 (edited by jim 2024-02-02 10:39:47)

Re: Question about Grub2 and Luks2

At the moment the situation is this: I can log in using Payload> "c"> grub>

grub> cryptomount -a

ls

grub> set root='lvm/matrix-rootvol'
grub>insmod linux
grub> linux /boot/vmlinuz-linux-libre root=/dev/matrix/rootvol cryptdevice=/dev/sda1:lvm
grub> initrd /boot/initramfs-linux-libre.img
grub>boot

the same method works

grub> ls (hd0,msdos1)/boot/grub/i386-pc/normal.mod
normal.mod
grub rescue> insmod normal
grub rescue> normal

But this needs to be done every time you log in, I made a mistake somewhere, I think it’s with the boot partition and that’s why when I log in I get an error related to lvmid


error : disk 'lvmid /WuGDE4-Po2w-3n6d-9pcY-sqsoV-eTsq-aLxagJ' not found

41 (edited by jim 2024-02-18 08:53:40)

Re: Question about Grub2 and Luks2

error : disk 'lvmid /WuGDE4-Po2w-3n6d-9pcY-sqsoV-eTsq-aLxagJ' not found

since seabios doesn't understand luks/dm-crypt, that means you have to leave /boot/ unencrypted. /boot/ simply contains your kernel, and perhaps a bootloader. The rest of the system can be encrypted.