branch/comit that has fastboot idpinit support ?

[yyang-giatec]

Hello,

I have an image based on rpi-image-gen v2.2.0's rota layer, with crypt enabled.
From my understanding the current version of rpi-sb-provisioner does not support IDP yet, so I am trying to figure out how to use it with fastboot by following the instruction listed here:
raspberrypi/rpi-image-gen#5 (comment).

I have cloned pi-gen-micro 9874760, built and installed the deb, and managed to produce a 56MB boot.img by doing "sudo pi-gen-micro fastboot". Then use rpiboot with that boot.img

However upon running bin/idp.sh, I am getting the following message:

[16:16:16] Staging description..
Sending 'work/test/image.json' (7 KB) OKAY [ 0.007s]
Finished. Total time: 0.014s
[16:16:16] Checking if provisioning is possible..
FAILED (remote: 'Unknown OEM command.')
fastboot: error: Command failed
[16:16:16] fastboot: error running oem idpinit
[16:16:16] Pre-provision checks failed

With this image I am able to toggle the LED with "fastboot oem led PWR" command, so I figure I might have a version mismatch somewhere.
Can I get some direction on where I might have missed anything? (rpi-fastbootd 14.0.0-69?)

thanks

[learmj]

Hi @yyang-giatec
From an rpi-image-gen perspective, run-time crypt unlock support is not ready for prime time, just yet. In fact it's only due to a bug in the image-rota layer that you're able to specify IGconf_image_pmap=crypt* because unlike the equivalent setting in the image-rpios, it doesn't forcibly set IGconf_image_pmap=clear.

From our perspective, we're deliberately being careful (which, from the outside looking in, may be viewed as 'slow') about how we integrate the end-to-end crypt setup and run-time unlock pipeline. It is most definitely a feature that we intend to roll out, but we do have some loose ends to tie up first.

@tdewey-rpi may have additional points of input on fastboot and pi-gen-micro, but at the moment - the image gadget that supports IDP has not yet made it into pi-gen-micro.

[tdewey-rpi]

I'm expecting to cut the updated fastboot, pi-gen-micro and rpi-sb-provisioner early next week.

[learmj]

Hi @yyang-giatec
We're nearly there with this. Once #62 is merged you will be able to provision your device with encrypted filesystems using pi-gen-micro's fastboot target boot.img and the idp.sh wrapper.
I've recently enabled crypt pmap support in rpi-image-gen's image-rpios and image-rota layers, so building with IGconf_image_pmap=crypt and provisioning with the corresponding image.json will give you a device with all but the vfat boot partition(s) encrypted inside LUKS. You can expect further updates from rpi-sb-provisioner, too.

[yyang-giatec]

Thanks! I will give that a try, as well as the rpi-sb-provisioner part.

[stu-spp]

Is all this going to change (enhance?) how rpi-sb-provisioner currently does secure boot + full disk encryption provisioning?

[tdewey-rpi]

Is all this going to change (enhance?) how rpi-sb-provisioner currently does secure boot + full disk encryption provisioning?

Yes - significantly so.

In essence, it will transition rpi-sb-provisioner from a fixed-function provisioner (single slot, bootfs + rootfs) to a declarative provisioner (read: anything you put in the IDP that's a valid IDP).

That includes full control over ciphers, key sizes, partition layouts & encapsulation & more.

As you can imagine, however, this is a major change, and one that has many, many moving parts.