stboot

The reference bootloader implementation for System Transparency.

Description

The stboot bootloader can be used as an init program inside an initramfs and is designed to be combined with a Linux kernel to form a LinuxBoot distribution. It is closely related to the u-root project. On the one hand, stboot depends on some standard Linux tools packages provided by u-root, on the other hand, u-root is used to create an initramfs including stboot.

Usage

Make sure your Go version is >=1.13 && <1.16. Make sure your GOPATH is set up correctly. Although using modules, stboot still vendors dependencies to work smoothly with u-root. So if you are usually working with go modules enabled do the following in your working directory:

mkdir go
export GO111MODULE=off
export GOPATH=${PWD}/go

Download and install u-root and stboot:

go get github.com/u-root/u-root
go get github.com/system-transparency/stboot

Build an initramfs:

./go/bin/u-root -o initramfs.cpio -uinitcmd stboot github.com/u-root/u-root/cmds/core/{init,elvish,ls} github.com/system-transparency/stboot

There should be your brand new initramfs.cpio in you working directory.

Test your initramfs (assuming your OS kernel at /boot/vmlinuz):

qemu-system-x86_64 -kernel /boot/vmlinuz -nographic -append "console=ttyS0,115200 uroot.uinitargs='-debug'" -initrd initramfs.cpio -m 2048 --enable-kvm

You should see something like this:

[...]
[    0.689686] Run /init as init process
2021/05/03 12:01:15 Welcome to u-root!
                              _
   _   _      _ __ ___   ___ | |_
  | | | |____| '__/ _ \ / _ \| __|
  | |_| |____| | | (_) | (_) | |_
   \__,_|    |_|  \___/ \___/ \__|

init: 2021/05/03 12:01:15 no modules found matching '/lib/modules/*.ko'
stboot: 
  _____ _______   _____   ____   ____________
 / ____|__   __|  |  _ \ / __ \ / __ \__   __|
| (___    | |     | |_) | |  | | |  | | | |   
 \___ \   | |     |  _ <| |  | | |  | | | |   
 ____) |  | |     | |_) | |__| | |__| | | |   
|_____/   |_|     |____/ \____/ \____/  |_|   

recovery: load security config: read file: open /etc/security_configuration.json: no such file or directory

As long as you can see the stboot banner, everything is fine. The program will exit with an error because of missing configuration data. See https://github.com/system-transparency/system-transparency for details on how to set up System Transparency.