Skip to content

beast-boot 0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Oct 10:19
· 29 commits to main since this release
v0.3.0
c67a3e8

What's new in 0.3.0

Disk tools: recovery and cloning, RAID-aware. A new boot menu entry, "Disk tools: recovery and cloning" (under Tools), shows every disk and every RAID or volume set on the computer. You can check disk health, rescue a failing disk with ddrescue, clone a disk, a partition or a RAID volume to another disk, save it as an image file, and restore an image. A stopped copy resumes where it stopped, and every copy is checked with SHA-256.

Storage What BeastBoot does
Linux md RAID 0, 1, 5, 6, 10, linear (also degraded, also with a bitmap) starts it read-only on in-memory overlays
Intel RST/VROC (IMSM), DDF firmware RAID starts it read-only (Intel: not while it rebuilds or with RWH/PPL on)
LVM with plain (linear/striped) volumes starts it read-only on in-memory overlays
LUKS2, BitLocker, Btrfs on several disks opens it read-only
LVM with RAID/mirror/cache/thin/snapshot volumes, Windows dynamic disks detected; image each disk
Hardware RAID controllers (MegaRAID/PERC, Smart Array, Adaptec, LSI) drivers included; each array shows as one disk
AMD RAID, Storage Spaces, sets whose RAID information is lost works out the layout from the data on in-memory overlays; manual RAID builder as fallback

Safe by design. When Disk tools start, every disk and partition is set read-only, and RAID sets and LVM start on in-memory copy-on-write overlays, so even a write the kernel makes on its own (such as a RAID bitmap update) lands in memory. Guessing a RAID layout happens on copy-on-write overlays in memory. A disk becomes writable only after a plan screen and after you type the last 6 characters of its serial number; it is checked again right before writing. The BeastBoot drive, the source, the source set and smaller disks are refused as targets. Images go to the BeastBoot drive (exFAT or NTFS) or to another disk opened for image files after typing its serial (exFAT, NTFS, ext4 or XFS).

Tested. 37 end-to-end tests pass in QEMU with NVMe and SATA disks: md RAID 0/1/5/6/10 including degraded, linear, with write-intent bitmaps (also a stale one), Intel IMSM RAID5, DDF RAID1, LVM (also two groups with the same name, and a RAID1 volume that is correctly refused), LUKS2, Btrfs RAID1, GPT with NTFS and ext4, and wiped RAID0/RAID5 arrays rebuilt from the data, also with one member missing. Every source disk was hashed before and after and stayed unchanged; clone, image and restore round trips were byte-identical; the refusals (stick, source, wrong confirmation, smaller target) were checked.

Good to know.

  • Not tested yet: real Intel RST/VMD hardware, real AMD RAID arrays, hardware RAID controllers, ZFS, BitLocker, Windows dynamic disks and real failing disks. For data you cannot lose, image the disk first and work from the image.
  • AMD RAID support is generic reconstruction. On an AMD board with SATA in RAID mode, Linux sees each disk on its own; AMD NVMe RAID is not verified.
  • ZFS needs an optional pack that is not shipped yet; the menu says "Needs the ZFS pack".
  • A copy of one disk of a RAID set is a copy of that disk, not of the set.
  • The helper grew by about 10 MB compressed and still runs in 1 GiB of RAM.
  • Updating from 0.2.x: use "Update boot files" in the app; your ISOs and files stay.
  • The downloads and the command are now named beast-boot (beast-boot-0.3.0-linux-x86_64.tar.gz, ./beast-boot) instead of beast-booter. Drives made with 0.2.0 are recognised and updated as before.
  • Still no critical or high vulnerability findings (see the attached VULNERABILITIES.md).

If BeastBoot is useful to you, you can support it at https://buymeacoffee.com/cynak.

beast-boot 0.3.0

Release v0.3.0. Download the package for your system, unpack it and start BeastBooter
(docs/PORTABLE.md), or install from the boot files directly with
beast-boot install --dist beast-boot-0.3.0-dist.zip.

Secure Boot certificate

On the first Secure Boot start, MokManager asks you to enroll
ENROLL_THIS_KEY_IN_MOKMANAGER.cer (also attached as
beast-boot-0.3.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer). Enroll it only if
View key shows exactly this SHA-1 fingerprint:

86 B2 51 E4 C9 7F 0A 88 F4 C7 / 17 7B 2E B3 23 6D 1E 9A E6 9B
  • Subject: CN=beast-booter Secure Boot release key (valid until 2036-10-21T04:21:14Z)
  • SHA-1: 86:B2:51:E4:C9:7F:0A:88:F4:C7:17:7B:2E:B3:23:6D:1E:9A:E6:9B
  • SHA-256: 29:4B:D9:66:25:7B:FF:2A:A6:91:20:F2:14:9B:95:32:BB:9F:53:E0:99:E8:35:D6:6C:63:5E:25:10:FC:26:0A

The procedure is in docs/SECURE_BOOT.md, section 3 "Check the key before you enroll it".

Vulnerabilities

From beast-boot-0.3.0-VULNERABILITIES.md (SBOM scan with grype and osv-scanner, OpenVEX applied,
plus the boot-chain checks: SBAT, dbx, signing certificates):

  • Open boot-chain findings: 1 medium
  • Open findings in shipped software (drive, beast-net, portable runtimes): 564 medium, 45 low, 19 negligible
  • Open findings in build/test tooling (not shipped): 51 medium, 19 low
  • Closed by VEX statements: 195
  • Release gate: passed: no new critical finding without a VEX statement (baseline: previous release, 0 known)

Boot-chain findings and their VEX status:

  • MEDIUM BB-ORIGIN-UNVERIFIED: 1 shipped file(s) cannot be matched to their stated source today - no VEX statement yet

Critical/high findings in shipped software: none

Verify the download

sha256sum -c SHA256SUMS --ignore-missing   # Windows: Get-FileHash <file> -Algorithm SHA256

gh attestation verify beast-boot-0.3.0-dist.zip -R cynak/BeastBoot # build provenance, any file

The SBOM (beast-boot-0.3.0-sbom.cdx.json, CycloneDX 1.6; .spdx.json, SPDX 2.3) lists every
file on the drive, the packages they come from, the beast-net kernel and initrd packages and the
Python runtimes in the portable packages. How releases are built and checked: docs/RELEASING.md.

Files

File Size SHA-256
beast-boot-0.3.0-linux-x86_64.tar.gz 136.1 MiB 0d6b614f58f57257...
beast-boot-0.3.0-windows-x86_64.zip 106.2 MiB 62924d156318c6d8...
beast-boot-0.3.0-macos-x86_64.zip 88.9 MiB 05a4cff9ef879ec4...
beast-boot-0.3.0-macos-arm64.zip 89.0 MiB 99176c414afd176f...
beast-boot-0.3.0-dist.zip 63.6 MiB ad7875d49e07584d...
beast-boot-0.3.0-sbom.cdx.json 801.3 KiB b47dfd0d049611b0...
beast-boot-0.3.0-sbom.spdx.json 730.9 KiB 0a509ac10d4bc502...
beast-boot-0.3.0-vulnerabilities.json 1.8 MiB f2ffd72b5429178d...
beast-boot-0.3.0-VULNERABILITIES.md 109.7 KiB 9f02507af0e9f41d...
beast-boot-0.3.0-ENROLL_THIS_KEY_IN_MOKMANAGER.cer 869 B 294bd966257bff2a...
beast-boot-0.3.0-CERTIFICATE.txt 1.0 KiB f439f6d8ea5fbaef...
SHA256SUMS 1.1 KiB 627a2053a6c468bf...
Assets 14
Loading