Donate to CanuteTheGreat/horcrux

• github.com/sponsors/CanuteTheGreat

---

See the documentation for more details on donation links.

security: passphrase only for the disk + no display-manager autologin + chrony/backup in the Surface set + confirmed host names #12

Closed

CanuteTheGreat wants to merge 18 commits from fix/password-separation into main

pull from: fix/password-separation

merge into: CanuteTheGreat:main

CanuteTheGreat:main

CanuteTheGreat:mutation-baseline

CanuteTheGreat:fix/s3-start-detached

CanuteTheGreat:feat/vm-cluster-fixes

CanuteTheGreat:docs/feature-tests

CanuteTheGreat:fix/qemu-free-hostfwd-ports-20261107

CanuteTheGreat:ci/dedupe-horcrux

CanuteTheGreat:fix/pqa-tree-hash-20261105

CanuteTheGreat:fix/test-machine-cfg-protect

CanuteTheGreat:fix/be-boot-space

CanuteTheGreat:feat/gentoo-default-lxc-template

CanuteTheGreat:fix/pqa-zfsswap-import-20261105

CanuteTheGreat:fix/test-machine-gringotts-xfce

CanuteTheGreat:feat/test-machine-no-personal-apps

CanuteTheGreat:feat/autoinstall-after-reboot

CanuteTheGreat:fix/pqa-overlay-sync-20261104

CanuteTheGreat:feat/hogsmeade-private-image-v3-wip

CanuteTheGreat:feat/gringotts-ready-6

CanuteTheGreat:feat/hogsmeade-private-image-v2

CanuteTheGreat:feat/surface-xfce2

CanuteTheGreat:darkmode-horcrux-ui

CanuteTheGreat:darkmode-follow-system

CanuteTheGreat:fix/hogshead-first-boot

CanuteTheGreat:feat/surface-xfce

CanuteTheGreat:feat/hogshead-packaging

CanuteTheGreat:feat/hogsmeade-private-image

CanuteTheGreat:feat/t2-desktop-zfs

CanuteTheGreat:fix/vms-fetch-hardcoded-localhost

Conversation 0 Commits 18 Files changed 37 +1412 -106

CanuteTheGreat commented 2026-11-03 11:50:47 -08:00

Owner

• Copy link
• Copy Markdown

Security + owner bug (2026-11-03).

1. Disk passphrase is only for the disk (secretcheck, shadow_reuse_gate, Surface/gringotts/legacy installers, Surface USB-unplug fixes) - c0759f5.
2. NO display-manager autologin by default (LightDM/GDM/SDDM/agetty): installer scrubs stale files, opt-in only with a warning; new QEMU gates no_autologin_config_gate + greeter_no_session_gate (Surface XFCE, zfs-enc --desktop, gringotts).
3. Surface package set gets chrony + horcrux-chrony-nm + horcrux-backup (horcrux-surface-desktop-1-r1); chronyd in the profile services.
4. Per-machine host name is asked and confirmed (prefilled from PRIV_DIR/hostname, required by the private build); generic names (surface-pro...) refused.
   common/TREE.sha256 changed: Patronus must sync-common. QEMU gate evidence is posted in the PR comments before merge.

Security + owner bug (2026-11-03). 1. Disk passphrase is only for the disk (secretcheck, shadow_reuse_gate, Surface/gringotts/legacy installers, Surface USB-unplug fixes) - c0759f5. 2. NO display-manager autologin by default (LightDM/GDM/SDDM/agetty): installer scrubs stale files, opt-in only with a warning; new QEMU gates `no_autologin_config_gate` + `greeter_no_session_gate` (Surface XFCE, zfs-enc --desktop, gringotts). 3. Surface package set gets chrony + horcrux-chrony-nm + horcrux-backup (horcrux-surface-desktop-1-r1); chronyd in the profile services. 4. Per-machine host name is asked and confirmed (prefilled from PRIV_DIR/hostname, required by the private build); generic names (surface-pro...) refused. common/TREE.sha256 changed: Patronus must sync-common. QEMU gate evidence is posted in the PR comments before merge.

CanuteTheGreat added 2 commits 2026-11-03 11:50:47 -08:00

security: the disk passphrase is only for the disk (user/root never derived from it); Surface restart no longer needs the USB stick ... c0759f5ccd

- secretcheck.py: in-memory comparison (plain + crypt hash via libcrypt) of every account password against the disk passphrase; root vs user
- validate_config + Installer.go refuse reuse before the disk is touched; guided stages (root/user/disk) reject it; root optional/locked on user machines
- horcrux-surface-auto: asks the login password separately (refuses == passphrase), root locked; target checked closed before the prompt; restart via sysrq (no stick access)
- gringotts-install: no 'Enter = same as passphrase'; sysrq restart
- legacy horcrux-installer.sh: no root:horcrux default (one-time expired password), live horcrux account locked, root != user
- gates: qt.shadow_reuse_gate (shadow hashes vs the test passphrase) in zfs-enc-test + surface xfce test; Surface hot-unplug (device_del) at the prompt; gringotts refusal steps
- tests: common/tests/test_secret_separation.py

security: NO display-manager autologin by default (opt-in with warning, stale files scrubbed), QEMU gates for greeter/no-session/configs, Surface chrony+backup in the package set, per-machine host name asked and confirmed (no generic surface-pro) 2820e5e71a

CanuteTheGreat added 12 commits 2026-11-03 20:09:00 -08:00

surface: kernel pin 6.18.59 -> 6.18.60 (Gentoo removed .59 from the tree, the variant could not build) f23038309e

surface-kernel: pick the installed kernel from /usr/src/linux, not the highest /lib/modules dir (stock bin kernel had the same version) 03d393afee

surface: xfce-base/xfce-extra need USE=X (REQUIRED_USE any-of X wayland under the global -X) a6a3efc7be

gates: tolerate the missing autologin group (getent rc); surface: xfce4-terminal USE=X b368bea678

common: TREE.sha256 f1c90870ea

surface: package.use for today tree (pipewire dbus, */* X, xmlto text, wpa_supplicant dbus, thunar udisks, gcr gtk): the XFCE set resolves again 324562cee1

gringotts gate: expired-password flow types the account login password (not the disk passphrase); hostname prompt regex d6c20b89b7

surface gate: host name prompt regex (ANSI bold) 3eeab3dd11

surface auto-installer: serial markers for the host-name prompt/refusal (the prompt is on tty1, the gate reads the serial console) 4a2f6cf40d

t2: kernel pin 7.2.13 -> 7.2.15 (Gentoo dropped 7.2.13 from the tree; same drift as the Surface pin) f488d40675

common: TREE.sha256 b0de1156cc

t2 preflight announces the detection (the refusal gate reads it; it only logged after the refusal point) 5fdfc7a38e

CanuteTheGreat added 1 commit 2026-11-03 20:11:34 -08:00

gringotts gate: live-helpers regex accepts an image without PRIV keys (and says so); fake restic backup fixture generator (no owner data) for the restore steps cb05fff9fc

CanuteTheGreat added 1 commit 2026-11-03 22:56:16 -08:00

gringotts gate: log out before the restore (gringotts-restore refuses a running graphical session), start the restored profiles after the first login b6ba4c2342

CanuteTheGreat added 1 commit 2026-11-03 23:45:04 -08:00

t2 variant: zfs/zfs-kmod from source, their build deps from the binhost (cmake from source failed to configure in the kernel layer); dump the build log on failure 1a8e64ec35

CanuteTheGreat added 1 commit 2026-11-04 01:12:34 -08:00

t2 variant: put back the headers the gnome-light strip removed (libudev, pam, curl...) before zfs is compiled; found by building zfs in the stripped image 1b35967a0e

CanuteTheGreat closed this pull request 2026-11-04 20:52:47 -08:00

All checks were successful

Hide checks

CI / Web UI theme (light/dark) (pull_request) Successful in 3s

Details

CI / Mobile theme (light/dark) (pull_request) Successful in 4s

Details

CI / Check (pull_request) Successful in 1m21s

Details

CI / Security Audit (pull_request) Successful in 2m45s

Details

CI / Build Web UI (pull_request) Successful in 2m13s

Details

CI / UI E2E (browser) (pull_request) Successful in 8m34s

Details

CI / USE-flag feature builds (pull_request) Successful in 9m54s

Details

CI / Test (pull_request) Successful in 37m28s

Details

CI / Build-1 (pull_request) Successful in 4m10s

Details

CI / Build (pull_request) Successful in 8m51s

Details

CI / Gentoo Docker Build (pull_request) Successful in 48m49s

Details

CI / Gentoo USE-flag matrix (ebuild install) (pull_request) Successful in 1h5m26s

Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

CanuteTheGreat/horcrux!12

No description provided.