Here is a step-by-step guide on how to cryptographically sign your OS files with keys in your control🗝️https://puri.sm/posts/stay-protected-with-librem-14s-latest-pureboot-feature/

@purism Wondering if there’s a way to cut down the few minutes waiting time on the scan by implementing this feature using hypercore (a cryptographically-secure directed acyclic graph) by keeping the OS files in a hyperdrive and mounting that drive at boot. That would involve checking just one hash.

@aral @purism So it turns out that generating the hashes does take a minute or two, but checking them (like if you automatically check them at each boot) is much faster.

@kyle @purism Ah, right, I thought the couple of minutes was at every boot, sorry.

@aral @purism No problem! I also had to work within a few design constraints. The most relevant one here is that I wanted it to be as OS-agnostic as possible (like PureBoot is in general). I write at length about the design constraints and considerations here: https://puri.sm/posts/new-pureboot-feature-scanning-root-for-tampering/