[gentoo-catalyst] Using catalyst to build encrypted livecd's

[Nelson Batalha]

Hi,

Chris Gianelloni, can't thank enough.

Everyone: in the last days, since I couldn't find anyone that has built 
encrypted cd's with catalyst, I researched and studied lots -> theoretically 
I think everything is worked out. (Unless you know of one, then please stop 
reading and post your experiences :).

I was hoping to discuss here the best way to do encrypted livecd's seamless 
with catalyst, with a minimal catalyst patch! (as it stands I don't think 
it's possible to make one)

I chose Luks, since seems genkernel is supporting it (no docs though), 
however this will force us to use two loops, (performance issues?). An 
alternative is loop-aes -> one loop only.

What I came up with would require just a trivial patch to Catalyst: to add 
the livecd-stage2 specs an argument, like livecd/fsscript: but would run a 
script in the real cd root, just before the iso creation. Why? These are the 
steps:

On gk arguments we would add initramfs a cryptsetup binary with 
--initramfs-overlay; we would also add a custom initrc that would put our 
encrypted squashfs file in a loop, and cryptsetup would unencrypt it in a 
different loop - and call it our root.

The patch to catalyst would allow us to write a script to convert the 
squashfs in a encrypted one. First we knew the final squashfs size, so it 
would just create a file with dd with that size from /dev/zero. Then it 
would mount this file in a loop, cryptsetup would use it and open it in a 
different loop, and then we would mksquashfs the contents in it.

Any problems, comments or alternatives? Would you accept this patch? My bash 
is ok now, gonna take some time to write the python stuff.

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

-- 
gentoo-catalyst@g.o mailing list