Where is the repo where is the progress? Where do I contribute and where do I see?
Patrick
February 10, 2024, 11:25am
2
This is a horrible usability bug, not sure it should be considered a blocker:
anon87354919:
Where do I contribute
Build the ISO from a developers git tag.
Boot the ISO (on hardware, or in VM, BIOS or EFI, SecureBoot enabled or not, anything)
Test the ISO.
Test the Calamares installer.
Test the installed system.
Ask in case of issues (build issues or so).
Improve developers documentation to make the process more straight-forward for yourself and potentially other developers.
Fix what’s needed.
A downloadable ISO is now available for developers.
grass
April 19, 2024, 4:24pm
4
The page Kicksecure Operating System Live ISO, Kicksecure-Host Installer has been updated to contain instructions on how to install the ISO. It can help you to contribute for the issues to be fixed.
1 Like
Major progress fixing major issues thanks to massive help by @ArrayBolt3 .
Kicksecure:master ← ArrayBolt3:master
opened 07:34AM - 27 Aug 24 UTC
## Changes
This pull request downloads Calamares from bookworm-backports rath… er than from bookworm. This pulls in a significantly newer version of Calamares that contains support for disabling encryption on specific partitions. See https://github.com/Kicksecure/live-config-dist/pull/5 for more information.
NOTE: For installation to still work right after this, a new submodule for calamares-settings-debian MUST be added to `packages/kicksecure`! Source code suitable for this purpose can be obtained from https://github.com/ArrayBolt3/calamares-settings-debian (though I recommend cloning that repo, reviewing it, and then pushing it to a Kicksecure-specific location rather than using it directly - it contains a Unicode character fix and some Lintian tag overrides for genmkfile). Additionally, it will be necessary to merge the live-config-dist pull request linked above.
## Mandatory Checklist
- [x] Legal agreements accepted. By contributing to this organisation, you acknowledge you have read, understood, and agree to be bound by these these agreements:
[Terms of Service](https://www.kicksecure.com/wiki/Terms_of_Service), [Privacy Policy](https://www.kicksecure.com/wiki/Privacy_Policy), [Cookie Policy](https://www.kicksecure.com/wiki/Cookie_Policy), [E-Sign Consent](https://www.kicksecure.com/wiki/E-Sign_Consent), [DMCA](https://www.kicksecure.com/wiki/DMCA), [Imprint](https://www.kicksecure.com/wiki/Imprint)
## Optional Checklist
The following items are optional but might be requested in certain cases.
- [x] I have tested it locally
- [x] I have reviewed and updated any documentation if relevant
- [x] I am providing new code and test(s) for it
Kicksecure:master ← ArrayBolt3:master
opened 01:15AM - 24 Jul 24 UTC
This pull request improves several aspects of the installation process for Kicks… ecure 17, most notably localization and full disk encryption.
## Changes
* `debian/changelog`:
* Bump version number.
* `debian/copyright`:
* Updated copyright and licensing information.
* `debian/live-config-dist.displace`:
* Add a divert for bootloader-config, which is now overridden to include a `set -x` line.
* `etc/calamares/branding/Kicksecure/*`:
* Updated capitalization of style fields - this is necessary for Calamares 3.3.8 to parse them properly, failing to do so results in a solid black left sidebar.
* Fixed the absence of a Kicksecure logo in the upper-left corner of the installer. This is generally where distros put their logos and it seemed appropriate to me. The logo component was taken from the larger, complete Kicksecure logo in the same directory.
* Renamed logo.png to icon.png to fit with the terminology used by Calamares. This made room for a new logo.png to be created, which contains the logo which now appears in the upper-left corner of the installer.
* `etc/calamares/modules/partition.conf`:
* Removed some obsolete fields that already have replacements integrated into the config file.
* Disabled swap file.
* `etc/calamares/settings.conf.dist`:
* Moved some fields down to the bottom of the file for readability. Not strictly necessary, but made working on the project easier.
* Added the `locale` and `keyboard` modules to the `show` component of the `sequence` section. This allows the user to customize their localization, timezone, and keyboard layout information at installation time.
* Added several modules to the `exec` component of the `sequence` section:
* `locale` - allows setting locale to work. The absence of this module results in language settings not carrying over into the installed system.
* `keyboard` - allows setting the keyboard layout to work. The absence of this module results in keyboard layout settings not carrying over into the installed system.
* `localecfg` - not entirely sure if this is needed, but it appeared important and so I added it. This was when I was first trying to get localization working right. This might be able to be dropped.
* `shellprocess@fixconkeys_part1` and `shellprocess@fixconkeys_part2` - Vital for disk encryption, explained later.
* Moved the `grubcfg` and `bootloader-config` modules to later in the installation process to avoid installation errors.
* Added two shellprocesses to the `instances` section. These are vital for disk encryption and are explained below.
* `etc/calamares/modules/shellprocess_fixconkeys_part1.conf` and `etc/calamares/modules/shellprocess_fixconkeys_part2.conf`:
* Vital for disk encryption, explained below.
* `usr/sbin/bootloader-config.dist`:
* Copied from `calamares-settings-debian`.
* Added a `set -x` line for debugging.
* Try to install `grub-efi-amd64-bin` rather than `grub-efi` to avoid installation failure.
## Disk Encryption Fixes
In order for FDE to work ideally on Kicksecure, a newer version of Calamares than the one present in Bookworm is needed. I locally compiled Calamares 3.3.8 from Trixie for Bookworm and installed it into the live session for testing. This version of Calamares properly processes the `noEncrypt` parameter in `partitions.conf` and thus the `/boot` partition is excluded from encryption.
However, **this did not entirely solve disk encryption issues** - when installing Kicksecure using a language with a keyboard layout different from `us` (I used German in my testing), the keyboard layout used by cryptsetup for decrypting the disk is different than the one used by Calamares for setting the encryption passphrase. This is a situation that I previously dealt with in Lubuntu, and is a result of the console keymap not being set correctly within the system's initramfs.
Solving this issue requires changing the console keyboard layout within the initramfs at install time to match the keyboard layout chosen by the user. This is non-trivial and requires a pair of scripts (embedded into the `shellprocess_fixconkeys_part*.conf` configuration files) to accomplish.
* The first script runs within the live system itself, NOT in the installed system chroot that Calamares creates. This script determines the keyboard layout in use by the user using `setxkbmap -query`, processes the output so as to extract the two-character keyboard layout code, and saves it to `/dev/shm/fixconkeys-layout`. (The reason for choosing `/dev/shm` is because it is a tmpfs that can be shared between the live and installed systems at installation time.) After doing this, the script bind-mounts `/dev/shm` from the live system into the installed system so that the second script can access the `fixconkeys-layout` file from within the installed system chroot.
* The second script operates within the installed system via a chroot. It loads the keyboard layout from the `fixconkeys-layout` into the current console session, then saves the loaded settings into a system-wide location using `setupcon`. With this complete, it then regenerates all initramfs'es on the installed system using `dracut`, ensuring this configuration is installed into the initramfs. This ensures that when `cryptsetup` runs from within the initramfs to unlock the disk, the console keyboard layout is set properly, thus allowing the user to decrypt the disk using the same keyboard layout they used to encrypt it.
This solution works well in my testing, however Kicksecure is currently missing critical packages necessary for this to work. The following packages will have to be installed into the Kicksecure ISO at ISO build time for this solution to work properly (edit: these are no longer missing):
* `console-common`
* `console-data`
* `console-setup-linux`
* `console-setup`
* `kbd`
I used workarounds to locally install these packages into the live environment and into the installed system for testing purposes, and can confirm that these five packages are sufficient to allow the keyboard layout fix described above to function properly.
Last but not least, the `calamares` and `calamares-settings-debian` packages from Trixie will need to be published in Debian's `bookworm-backports` repository before they are available for general use within Kicksecure. I filed a bug report for this in Debian to bring this to the `calamares` package maintainer's attention (and emailed him directly a day before), but have not heard back from him yet. Therefore I intend to attempt creating and maintaining the backport myself. The bug report is here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1076740 (edit: `calamares` has gotten into bookworm-backports, `calamares-settings-debian` may take significantly longer and I suggest we go with a "build it ourselves" approach in derivative-maker for now.)
## Mandatory Checklist
- [x] Legal agreements accepted. By contributing to this organisation, you acknowledge you have read, understood, and agree to be bound by these these agreements:
[Terms of Service](https://www.kicksecure.com/wiki/Terms_of_Service), [Privacy Policy](https://www.kicksecure.com/wiki/Privacy_Policy), [Cookie Policy](https://www.kicksecure.com/wiki/Cookie_Policy), [E-Sign Consent](https://www.kicksecure.com/wiki/E-Sign_Consent), [DMCA](https://www.kicksecure.com/wiki/DMCA), [Imprint](https://www.kicksecure.com/wiki/Imprint)
## Optional Checklist
The following items are optional but might be requested in certain cases.
- [x] I have tested it locally
- [x] I have reviewed and updated any documentation if relevant
- [x] I am providing new code and test(s) for it
* Technically there aren't tests for this code other than manual checking, so while I am providing new code, I am not providing tests for it.
committed 08:02AM - 28 Aug 24 UTC
Kicksecure fork of calamares-settings-debian backport from Sid
Next is review, merge, build, testing.
Patrick
November 14, 2024, 8:57pm
9
Patrick
January 14, 2025, 7:30am
10
Kicksecure 18 and above (based on Debian 13 / trixie) will be even better.
Calamares installer can run as root without Xwayland, yet has a functional graphical user interface (GUI).
(According to @arraybolt3 who tested that.)
As for tickets about calamares running without root (rootless), i.e. splitting the frontend graphical user interface (GUI from the backend command line interface (CLI):
If calamares is started without root rights, it shows:
> the installer is not running with administrative rights
Quote Jan 4, 2018 https://calamares.io/calamares-3.2-plan-revised/
> Rootless Calamares (e.g. not running as root) has not been...
→
This is, admittedly, a non-obvious place for it.
Dear C++ specialists,
As I have read, you are using Qt5.9. Please would you have some time to analyse yours source code and other program parts if you have set all stuff so resulting GUI of this installer will be accessible?
Many visually impaired...
1 Like