Skip to content
GitLab

Use GRUB for USB boot on EFI 64-bit

Originally created by @intrigeri on #15806 (Redmine)

We need this for Secure Boot (#6560 (closed)) and it’ll simplify quite a few parts of our code.

Making a Tails USB image boot with GRUB is straightforward but we need to:

  • Find another way to identify the boot device in our partitioning script: git grep -E 'FSUUID|sysappend'
  • Update our test suite accordingly: it currently expects the syslinux UI
  • Subtasks of this very issue
  • Fix whatever the tests below show as broken

Team: FT (intrigeri, segfault)

Manual testing plan

Note:

  • Tests done at 3c79a9cd
  • Since this branch includes #8415 (closed), the upgrade tests below also cover switching from aufs to overlayfs.
  • Automatic upgrade tests are done like this:
    • IUK generated using wrap_tails_create_iuks (just like in our release process)
    • IUK installed manually with tails-install-iuk (UDFs are not impacted by this branch, only IUK generation is)

Freshly installed Tails built from this branch

First, boots using isolinux from DVD: OK

Second, USB tests:

  1. boot a USB stick that’s been freshly installed from this branch
  2. verify that the system partition was resized
  3. boot a 2nd time to ensure that resizing the system partition did not break the boot
GNOME Disks (.img) Tails Installer (cloning) Etcher (.img)
boots using GRUB on EFI 64-bit + Secure Boot OK OK TODO
boots using GRUB on EFI 32-bit OK OK TODO
boots using syslinux on legacy BIOS OK OK TODO

Tails upgraded from older version that had no GRUB 64-bit EFI
with Tails Installer (cloning) with automatic upgrade
boots using GRUB on EFI 64-bit + Secure Boot OK OK
boots using GRUB on EFI 32-bit OK OK
boots using syslinux on legacy BIOS OK OK
syslinux EFI 64-bit was deleted OK OK

Tails upgraded from older Tails that already had GRUB 64-bit EFI

Note: the new image & the corresponding test IUK must modify EFI/debian/grub.cfg.
with Tails Installer (cloning) with automatic upgrade
boots using GRUB on EFI 64-bit + Secure Boot OK OK
boots using GRUB on EFI 32-bit OK OK
boots using syslinux on legacy BIOS OK OK
EFI/debian/grub.cfg was updated OK OK

Feature Branch: feature/6560-secure-boot+force-all-tests

Parent Task: #6560 (closed)

Subtasks

Related issues

Edited by intrigeri
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information