PrawnOS uses a custom initramfs, custom init script, and dmcrypt/LUKS to enable full root partition encryption
Because the c201s bootloader, depthcharge, can't be given dynamic cmdline parameters like grub we can't use the "usual" method of setting up an initramfs. Essentially, we can't boot from an initramfs image stored on a /boot partiton
Either the initramfs needs to be built into the part of the kernel image passed to depthcharge using a kernel.its similar to this one by @ifbizo:
```
/dts-v1/;
/ {
description = "Linux-libre kernel image with one or more FDT blobs";
#address-cells = <1>;
images {
kernel {
description = "vmlinuz";
data = /incbin/("/boot/vmlinuz-SED_KVER");
type = "kernel_noload";
arch = "arm";
os = "linux";
compression = "none";
load = <0>;
entry = <0>;
hash {
algo = "sha1";
};
};
fdt {
description = "dtb";
data = /incbin/("/boot/rk3288-veyron-speedy.dtb");
type = "flat_dt";
arch = "arm";
compression = "none";
hash {
algo = "sha1";
};
};
ramdisk@1{
description = "initrd.img";
data = /incbin/("/boot/initrd.img-SED_KVER");
type = "ramdisk";
arch = "arm";
os = "linux";
compression = "none";
hash@1{
algo = "sha1";
};
};
};
configurations {
default = "conf";
conf{
kernel = "kernel";
fdt = "fdt";
ramdisk = "ramdisk@1";
};
};
};
```
Or it needs to be built into the kernel using the kernel config parameter `CONFIG_INITRAMFS_SOURCE="PrawnOS-initramfs.cpio.gz"`
For PrawnOS I decided to go with building into the kernel to avoid relying on the bootloader, the bootloader may change but the kernel will always support booting an initramfs image.
The script `buildInitramFs.sh` creates the `PrawnOS-initramfs.cpio.gz` image that is then used by `buildKerenl.sh`, copying all of the tools and libraries the initramfs needs from the built filesystem image.
The initramfs is what runs initialy at boot, and allows us to enter a password and decrypt the root partiton
In a normal system, when dmcrypt/LUKS is setup the initramfs image is modified to enable decrypting of the root partiton
Since we have to have a static initramfs image, and can't change it without recompiling the kernel, we detect whether encryption is in use by checking for the tag `crypto_LUKS` on the root device at boot.
apt repo holds a short life signing private key, and the long life master public key
the short life signing key is a sub key of the master key
This way we can safely keep the master key off of any distribution servers.
This also allows us to revoke the signing key and issue a new one all without users needing to
update their key store, as the master public key will be valid for all sub keys
importing/exporting was done based off of https://www.debuntu.org/how-to-importexport-gpg-key-pair/
subkey creation instructions found here https://www.digitalocean.com/community/tutorials/how-to-use-reprepro-for-a-secure-package-repository-on-ubuntu-14-04
under the "Generate a Subkey for Package Signing" section
### Uploading packages to deb.prawnos.halemmerich.compression
