summaryrefslogtreecommitdiff
path: root/data
AgeCommit message (Collapse)Author
2024-09-25T861: sign all Kernel modules with an ephemeral keyChristian Breunig
The shim review board (which is the secure boot base loader) recommends using ephemeral keys when signing the Linux Kernel. This commit enables the Kernel build system to generate a one-time ephemeral key that is used to: * sign all build-in Kernel modules * sign all other out-of-tree Kernel modules The key lives in /tmp and is destroyed after the build container exits and is named: "VyOS build time autogenerated kernel key". In addition the Kernel now uses CONFIG_MODULE_SIG_FORCE. This now makes it unable to load any Kernel Module to the image that is NOT signed by the ephemeral key.
2024-09-22Kernel: T5887: update Linux Kernel to v6.6.52Christian Breunig
2024-09-22T861: stripping Kernel modules would also remove module signaturesChristian Breunig
As the VyOS Linux Kernel will be compiled with CONFIG_MODULE_SIG_FORCE all driver modules need to be cryptographically signed. This happens during build of the Kernel and it's 3rd party modules. Stripping the objects would remove said signature and the system will be unable to boot b/c of CONFIG_MODULE_SIG_FORCE.
2024-09-14T861: add UEFI Secure Boot supportChristian Breunig
This adds support for UEFI Secure Boot. It adds the missing pieces to the Linux Kernel and enforces module signing. This results in an additional security layer where untrusted (unsigned) Kernel modules can no longer be loaded into the live system. NOTE: This commit will not work unless signing keys are present. Arbitrary keys can be generated using instructions found in: data/live-build-config/includes.chroot/var/lib/shim-signed/mok/README.md
2024-09-14Kernel: T5887: update Linux Kernel to v6.6.51Christian Breunig
2024-09-07Kernel: T861: remove superfluous architecture from Kernel stringChristian Breunig
2024-09-05T4974: remove package openvpn-dco as it has a proper dependency via vyos-1xChristian Breunig
2024-09-05telegraf: T3664: remove package dependencyChristian Breunig
Telegraf is not a full VyOS feature with a proper dependency in place via vyos-1x package. Drop this temporary dependency.
2024-09-05T1416: remove deprecated default-union-grub-entryChristian Breunig
2024-09-04Kernel: T5887: update Linux Kernel to v6.6.49t5887-kernel-6.6.49Christian Breunig
2024-08-22Merge pull request #738 from bk2zsto/image_format_singularChristian Breunig
build: T6666: singular image_format in flavor files
2024-08-20build: T6666: singular image_format in flavor filesbk2zsto
2024-08-20Kernel: T5887: update Linux Kernel to v6.6.47kernel-6-6-47Christian Breunig
2024-08-11Kernel: T5887: update Linux Kernel to v6.6.45Christian Breunig
2024-07-29Kernel: T5887: update Linux Kernel to v6.6.43cpo-T5887-kernelChristian Breunig
2024-07-25build: T6231: include out-of-tree Mellanox driver in imageChristian Breunig
2024-07-25Kernel: T5887: update Linux Kernel to v6.6.42Christian Breunig
2024-07-24Merge pull request #709 from c-po/podman-T6598Christian Breunig
podman: T6598: add custom podman build for version 4.9.5
2024-07-23podman: T6598: add custom podman build for version 4.9.5Christian Breunig
2024-07-20Kernel: T5887: update Linux Kernel to v6.6.41Christian Breunig
2024-07-17Kernel: T5887: update Linux Kernel to v6.6.40Christian Breunig
2024-07-12Kernel: T5887: update Linux Kernel to v6.6.39Christian Breunig
2024-07-08Merge pull request #690 from c-po/podmanChristian Breunig
container: T5867: pin specific podman version
2024-07-08container: T5867: pin specific podman versionChristian Breunig
As of Debian version 4.9.5+ds1-1 podman increased the dependency on libc6 and libgpgme11t64. podman : Depends: libc6 (>= 2.38) but 2.36-9+deb12u7 is to be installed Depends: libgpgme11t64 (>= 1.4.1) but it is not going to be installed Pin the version to a prior one that requires the old libc.
2024-07-06Kernel: T5887: update Linux Kernel to v6.6.37Christian Breunig
2024-07-02Kernel: T5887: update Linux Kernel to v6.6.36Christian Breunig
2024-06-30T6527: remove legacy packagesChristian Breunig
2024-06-27Merge pull request #667 from c-po/T6507-drop-vyos-worldChristian Breunig
T6507: remove references to vyos-world package
2024-06-22T6507: remove references to vyos-world packageChristian Breunig
As we got rid of most of the old vyatta packages we can now also discontinue vyos-world. It only served the purpose of keeping the package list during ISO build small.
2024-06-22Kernel: T5887: update Linux Kernel to v6.6.35Christian Breunig
2024-06-17Kernel: T5887: update Linux Kernel to v6.6.34Christian Breunig
2024-06-15Merge pull request #653 from ZenithTecnologia/currentChristian Breunig
docker: arm: T6474: Initial support for dynamic arch toml loading
2024-06-12Kernel: T5887: update Linux Kernel to v6.6.33Christian Breunig
2024-06-11docker: arm: T6474: Added Salt Project repo for armhfLeonardo Amaral
Signed-off-by: Leonardo Amaral <contato@leonardoamaral.com.br>
2024-06-05migration: T6006: move config.boot.default to vyos-1xJohn Estabrook
2024-05-28build: T6414: rename the "iso" flavor to "generic"Daniil Baturin
2024-05-25Kernel: T5887: update Linux Kernel to v6.6.32Christian Breunig
2024-05-19Merge pull request #629 from c-po/T5887-kernelChristian Breunig
Kernel: T5887: update Linux Kernel to v6.6.31
2024-05-19Kernel: T5887: update Linux Kernel to v6.6.31Christian Breunig
2024-05-16T6356: normalize '.., ntp, server' path syntax in config.boot.defaultJohn Estabrook
2024-05-16Merge pull request #624 from c-po/targetChristian Breunig
hooks: T6346: set default boot target to multi-user.target
2024-05-16hooks: T6346: set default boot target to multi-user.targetChristian Breunig
2024-05-16Merge pull request #614 from aidan-gibson/currentChristian Breunig
T6333 non-free-firmware to trixie
2024-05-16T6333: drop reference to non-free of trixie as it's not usedAidan Gibson
2024-05-14Merge pull request #582 from 0xThiebaut/suricataChristian Breunig
suricata: T751: Disable suricata.service by default
2024-05-14T3420: Remove service upnpViacheslav Hletenko
2024-05-03container: T5867: podman depends on libgpgme11t64 from trixieChristian Breunig
2024-05-03suricata: T751: Disable suricata.service by defaultMaxime THIEBAUT
2024-05-02Kernel: T5887: update Linux Kernel to v6.6.30Christian Breunig
2024-04-28Kernel: T5887: update Linux Kernel to v6.6.29Christian Breunig
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-27 06:44:10 +0000