On 2025-11-29 18:46, donotemailme@xganon.com wrote:
Im working on a livebuild of a secure image and looking for some pointers.The intent is to change the initramfs to a custom made one (lets call it initramfs-tiny) that first validates the cryptographic hash of the initramfs, then decrypts the initramfs using a JCOP4 smart card with Smartpgp on it. To do this Ill build a small initramfs that does the work. (not a problem, I can do/script this)The problem is Im not sure how to interrupt and change the build process in live-build to encrypt the initramfs, generate the needed hashes, then change the grub menu to boot to the new initramfs-tiny. Ok that last part is not hard but telling live-build to change how the initramfs is made is something I have not found in any of the docs or anyone writing about.Any help would be appreciated.
Im going to reply to my own post for anyone that may be looking into this in the future.
The man (7) page for live-build lists the subprocesses in alphabetical order not in order of operations. (Note: order of operations would be helpful)
My testing has indicated that the binary hooks are processed after the include.binary additions.
You can build a binary hook to construct a specialized initramfs but need to place it in the binary/live directory and can not rely on the include.binary to add it for you.
I dont think it matters where the hook.binary runs in the order of binary hooks but I set mine to run early at 1000-build-initramfs-mini.hook.binary
Then you can modify the menus in config/bootloaders/grub-pc and config/bootloaders/syslinux_common to point to your initramfs to load it.
Ill note here that the documentation is wrong in saying that the splash.png goes in config/bootloaders you need to put a copy in each bootloader directory.
Now i just need to make the specialized initramfs to do sha512sum checksums on everything and use a ACR39U with jcop4 card containing the Smartpgp app to decrypt the original initrd and switch to it for full boot.
The fun of building a fully encrypted and verified chain of trust boot. :D
Attachment:
0xBE355809.asc
Description: application/pgp-keys
Attachment:
signature.asc
Description: OpenPGP digital signature