Partition</th>	Size</th>	Type</th>	Code</th>	Filesystem</th></tr></thead>
/dev/sda1</td>	2 MiB</td>	Bios Boot Partition</em></td>	ef02</td>	None</td></tr>
/dev/sda2</td>	1024 MiB</td>	EFI</em></td>	ef00</td>	vfat</td></tr>
/dev/sda3</td>	119 GiB</td>	Linux LVM</em></td>	8e00</td>	xfs</td></tr> </tbody></table> If you have never used gdisk</strong> before, fear not! Just run `gdisk /dev/sda</code> and answer the questions as outlined in the next section. If you know what you are doing, you can skip the next section.</p>` Creating Partitions With gdisk</h2> $</span> gdisk /dev/sda</span></span> </span> GPT</span> fdisk</span> (gdisk) version 1.0.1</span></span> </span> Partition</span> table scan:</span></span> MBR:</span> not present</span></span> BSD:</span> not present</span></span> APM:</span> not present</span></span> GPT:</span> not present</span></span> </span> Creating</span> new GPT entries.</span></span> </span> Command</span> (?</span> for help</span>): n</span></span> Partition</span> number</span> (1-128,</span> default</span> 1</span>): 1</span></span> First</span> sector</span> (34-251658206,</span> default =</span> 2048</span>) or {</span>+-}size</span>{KMGTP}</span>:</span></span> Last</span> sector</span> (2048-251658206,</span> default =</span> 251658206</span>) or {</span>+-}size</span>{KMGTP}</span>:</span> +2M</span></span> Current</span> type is 'Linux filesystem'</span></span> Hex</span> code or GUID</span> (L</span> to show codes, Enter =</span> 8300</span>): ef02</span></span> Changed</span> type of partition to 'BIOS boot partition'</span></span> </span> Command</span> (?</span> for help</span>): n</span></span> Partition</span> number</span> (2-128,</span> default</span> 2</span>):</span></span> First</span> sector</span> (34-251658206,</span> default =</span> 6144</span>) or {</span>+-}size</span>{KMGTP}</span>:</span></span> Last</span> sector</span> (6144-251658206,</span> default =</span> 251658206</span>) or {</span>+-}size</span>{KMGTP}</span>:</span> +1G</span></span> Current</span> type is 'Linux filesystem'</span></span> Hex</span> code or GUID</span> (L</span> to show codes, Enter =</span> 8300</span>): ef00</span></span> Changed</span> type of partition to 'EFI System'</span></span> </span> Command</span> (?</span> for help</span>): n</span></span> Partition</span> number</span> (3-128,</span> default</span> 3</span>):</span></span> First</span> sector</span> (34-251658206,</span> default =</span> 2103296</span>) or {</span>+-}size</span>{KMGTP}</span>:</span></span> Last</span> sector</span> (2103296-251658206,</span> default =</span> 251658206</span>) or {</span>+-}size</span>{KMGTP}</span>:</span></span> Current</span> type is 'Linux filesystem'</span></span> Hex</span> code or GUID</span> (L</span> to show codes, Enter =</span> 8300</span>): 8e00</span></span> Changed</span> type of partition to 'Linux LVM'</span></span> </span> Command</span> (?</span> for help</span>): w</span></span> </span> Final</span> checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING</span></span> PARTITIONS!!</span></span> </span> Do</span> you want to proceed?</span> (Y/N): y</span></span> OK</span>;</span> writing</span> new GUID partition table</span> (GPT) to /dev/sda.</span></span> The</span> operation has completed successfully.</span></span></code></pre> In the above, we begin creating our first new partition by using the command n</strong> when asked the question Command (? for help):</code>.</p> The first question we are asked is what number we would like to give, it's our first partition so 1</strong>, this will create a partition called /dev/sda1</strong> on /dev/sda</strong>.</p> Next, we are asked what sector to start on and what sector to end on. The starting sector can be left empty - this means start at next unused sector, which in this case is the start of the disk. As for which sector to end on, here we answer +2M</strong> which will means move 2 Mebibytes ^{1</a></sup> (MiB</strong>) forward from the starting sector</em>, giving us a partition size of 2 Mebibytes.</p>} Finally, we are asked if we want to change the type of the partition. Our first partition should have the type ef02</strong>, more on why later.</p> That's the first partition created, it should be clear now how the next two are created.</p> Notes On The Partitions</h2> Done? Good, to get a look at the disk layout run gdisk -l /dev/sda</code>, this should print out the following:</p> $</span> gdisk</span> -l</span> /dev/sda</span></span> </span> GPT</span> fdisk</span> (gdisk) version 1.0.1</span></span> </span> Partition</span> table scan:</span></span> MBR:</span> protective</span></span> BSD:</span> not present</span></span> APM:</span> not present</span></span> GPT:</span> present</span></span> </span> Found</span> valid GPT with protective MBR</span>;</span> using</span> GPT.</span></span> Disk</span> /dev/sda:</span> 251658240</span> sectors,</span> 120.0</span> GiB</span></span> Logical</span> sector size:</span> 512</span> bytes</span></span> Disk</span> identifier</span> (GUID): 031652EE-C219-4EFB-84AB-9E310B14357E</span></span> Partition</span> table holds up to</span> 128</span> entries</span></span> First</span> usable sector is 34, last usable sector is</span> 251658206</span></span> Partitions</span> will be aligned on 2048-sector boundaries</span></span> Total</span> free space is</span> 2014</span> sectors</span> (1007.0</span> KiB</span>)</span></span> </span> Number</span> Start</span> (sector) End (</span>sector</span>) Size Code Name</span></span> 1</span> 2048 6143 2.0</span> MiB EF02 BIOS boot partition</span></span> 2</span> 6144 2103295 1024.0</span> MiB EF00 EFI System</span></span> 3</span> 2103296 251658206 119.0</span> GiB 8E00 Linux LVM</span></span></code></pre>Grub Compatibility: /dev/sda1</h3> This is used by grub</strong> 2</a></sup> at boot-time when booting off a GPT disk.</p> EFI Partition: /dev/sda2</h3> UEFI will load files stored in this partition when booting.</p> Main Data Partition: /dev/sda3</h3> This is used for creating the logical volumes swap</strong> (4GB), /</strong> (20GB), /home</strong> (20GB) and /opt</strong> (20GB) in this post, it's size should reflect the sum of the sizes of all logical volumes you wish to create. Note that any free space left of the disk can be used later, and those logical volumes can be increased (or decreased) in size.</p> Linux Unified Key Setup (LUKS)</h1> Now that the partitions are setup, it's time to encrypt the main partition, /dev/sda3</strong>. This is optional and there are a few ways to do it, this post uses LUKS</a>.</p> The cryptsetup</a></em> tool is used to create LUKS</strong> volumes. To search nix packages the command nix-env -qaP packageName</code> 3</a></sup> can be used:</p> $</span> nix-env</span> -qaP</span> cryptsetup</span></span> </span> nixos.cryptsetup</span> cryptsetup-1.7.0</span></span></code></pre> Now that we know cryptsetup</strong> is in the package list, we can install it with nix-env</code>:</p> $</span> nix-env</span> -i</span> cryptsetup</span></span> </span> installing</span> 'cryptsetup-1.7.0'</span></span> building</span> path</span>(</span>s</span>)</span> '/nix/store/86mqcs95fb3gkkb74481fbf90zh5w98l-user-environment'</span></span> created</span> 44</span> symlinks in user environment</span></span></code></pre>Encrypting /dev/sda3</h2> I won't go into detail about LUKS</strong> or cryptsetup</strong> here, we will also just use the defaults for both. Simply run the following cryptsetup</strong> command and enter a passphrase:</p> $</span> cryptsetup</span> -y -v</span> luksFormat /dev/sda3</span></span> </span> WARNING!</span></span> ========</span></span> This</span> will overwrite data on /dev/sda3 irrevocably.</span></span> </span> Are</span> you sure?</span> (Type</span> uppercase yes</span>): YES</span></span> Enter</span> passphrase:</span></span> Verify</span> passphrase:</span></span> Command</span> successful.</span></span> </span></code></pre> /dev/sda3</strong> is now encrypted! 4</a></sup> The options passed to cryptsetup</em> have the following meaning:</p> -y</strong> : prompt for passphrase twice.</li> -v</strong> : verbose mode.</li> luksFormat</strong> : initializes a LUKS partition and sets the initial passphrase (for key-slot 0) 5</a></sup>.</li> </ul> Great, we now have an encrypted disk, but how is it used? Let's jump back to cryptsetup</strong>, it has a command cryptsetup luksOpen LUKS_DEVICE NAME</code> which, when it verifies the passphrase (in our case), will open the LUKS</strong> device and create a mapping to it (on the path /dev/mapper/NAME</strong>)from the given name.</p> $</span> cryptsetup luksOpen /dev/sda3 enc-data</span></span> </span> Enter</span> passphrase for /dev/sda3:</span></span> </span> $</span> ls</span> -la</span> /dev/mapper/</span></span> total</span> 0</span></span> drwxr-xr-x</span> 2</span> root root</span> 80</span> Jul</span> 9</span> 18:43 .</span></span> drwxr-xr-x</span> 18</span> root root</span> 3320</span> Jul</span> 9</span> 18:43 ..</span></span> lrwxrwxrwx</span> 1</span> root root</span> 7</span> Jul</span> 9</span> 18:43 enc-data</span> -</span>></span> ../dm-0</span></span> </span></code></pre> Sweet! We now have an encrypted partition and know how to access it. All we have left to do is setup logical volumes on the partition.</p> LVM Setup</h1> Make sure our data partition - /dev/sda3</strong> - is open and mapped to the path /dev/mapper/enc-data</strong> with luksOpen</strong>, as mentioned above.</p> There are three steps to setting up logical volumes</em>, creating a physical volume</em> (PV), a volume group</em> (VG) and a logical volume</em> (LV). If you are unfamiliar with Logical Volume Management (LVM) the Arch Linux Wiki entry</a> is a good resource.</p> As a quick description, a physical disk can be divided into one or more physical volumes, a volume group is made up of one or mode physical volumes and logical volumes are created within volume groups.</p> Physical Volume</h2> pvcreate</code> is the command used to create physical volumes. Let's use this to create a physical volume on /dev/mapper/enc-data</strong>:</p> $</span> pvcreate /dev/mapper/enc-data</span></span> </span> Physical</span> volume "/dev/mapper/enc-data" successfully created</span></span></code></pre> pvdisplay</code> is used to display information on physical volumes on the system.</p> $</span> pvdisplay</span></span> </span> "/dev/mapper/enc-data"</span> is a new physical volume of "119.00 GiB"</span></span> ---</span> NEW Physical volume</span> ---</span></span> PV</span> Name /dev/mapper/enc-data</span></span> VG</span> Name</span></span> PV</span> Size</span> 119.00</span> GiB</span></span> Allocatable</span> NO</span></span> PE</span> Size</span> 0</span></span> Total</span> PE</span> 0</span></span> Free</span> PE</span> 0</span></span> Allocated</span> PE</span> 0</span></span> PV</span> UUID H3bhmD-KR9n-XaHb-03L6-TpN2-pYB5-DtUG7x</span></span></code></pre>Volume Group</h2> vgcreate</code> is used to create a volume group. Lets create a volume group called vg</strong>.</p> $</span> vgcreate vg /dev/mapper/enc-data</span></span> </span> Volume</span> group "vg" successfully created</span></span> </span></code></pre> vgdisplay</code> displays info on the systems volume groups.</p> $</span> vgdisplay</span></span> </span> ---</span> Volume group</span> ---</span></span> VG</span> Name vg</span></span> System</span> ID</span></span> Format</span> lvm2</span></span> Metadata</span> Areas</span> 1</span></span> Metadata</span> Sequence No</span> 1</span></span> VG</span> Access read/write</span></span> VG</span> Status resizable</span></span> MAX</span> LV</span> 0</span></span> Cur</span> LV</span> 0</span></span> Open</span> LV</span> 0</span></span> Max</span> PV</span> 0</span></span> Cur</span> PV</span> 1</span></span> Act</span> PV</span> 1</span></span> VG</span> Size</span> 118.99</span> GiB</span></span> PE</span> Size</span> 4.00</span> MiB</span></span> Total</span> PE</span> 30462</span></span> Alloc</span> PE / Size</span> 0</span> /</span> 0</span></span> Free</span> PE / Size</span> 30462</span> /</span> 118.99</span> GiB</span></span> VG</span> UUID O9EIaS-kX9Y-EXjo-I3zU-mPXY-9SVB-br2fEy</span></span></code></pre>Logical Volume</h2> lvcreate</code> is used to create a logical volume. In this case, we want to create four logical volumes from our volume group vg</strong>.</p> lvcreate</span> -n</span> swap</span> --size</span> 8G vg</span></span> lvcreate</span> -n</span> root</span> --size</span> 20G vg</span></span> lvcreate</span> -n</span> home</span> --size</span> 20G vg</span></span> lvcreate</span> -n</span> opt</span> --size</span> 20G vg</span></span></code></pre> Running the above four lvcreate commands will give us our logical volumes swap</strong>, root</strong>, home</strong> and opt</strong>. Use lvdisplay</code> to get more info on them:</p> $</span> lvdisplay</span></span> </span> ---</span> Logical volume</span> ---</span></span> LV</span> Path /dev/vg/swap</span></span> LV</span> Name swap</span></span> VG</span> Name vg</span></span> LV</span> UUID F5DbgU-ymix-24Bh-JMTy-q2kL-ayvN-UpNUFB</span></span> LV</span> Write Access read/write</span></span> LV</span> Creation host, time nixos, 2016-07-09 19:11:46 +0000</span></span> LV</span> Status available</span></span> # open 0</span></span> LV</span> Size</span> 8.00</span> GiB</span></span> Current</span> LE</span> 2048</span></span> Segments</span> 1</span></span> Allocation</span> inherit</span></span> Read</span> ahead sectors auto</span></span> -</span> currently set to</span> 256</span></span> Block</span> device 254:1</span></span> </span> ---</span> Logical volume</span> ---</span></span> LV</span> Path /dev/vg/root</span></span> LV</span> Name root</span></span> VG</span> Name vg</span></span> LV</span> UUID FNLEbI-z05h-J7br-OMst-Ui0t-yq3r-BMNVjA</span></span> LV</span> Write Access read/write</span></span> LV</span> Creation host, time nixos, 2016-07-09 19:11:46 +0000</span></span> LV</span> Status available</span></span> # open 0</span></span> LV</span> Size</span> 20.00</span> GiB</span></span> Current</span> LE</span> 5120</span></span> Segments</span> 1</span></span> Allocation</span> inherit</span></span> Read</span> ahead sectors auto</span></span> -</span> currently set to</span> 256</span></span> Block</span> device 254:2</span></span> </span> ---</span> Logical volume</span> ---</span></span> LV</span> Path /dev/vg/home</span></span> LV</span> Name home</span></span> VG</span> Name vg</span></span> LV</span> UUID zBLqKD-S6n7-BcTh-1oAF-TLvV-26Oc-dQ3wQR</span></span> LV</span> Write Access read/write</span></span> LV</span> Creation host, time nixos, 2016-07-09 19:11:46 +0000</span></span> LV</span> Status available</span></span> # open 0</span></span> LV</span> Size</span> 20.00</span> GiB</span></span> Current</span> LE</span> 5120</span></span> Segments</span> 1</span></span> Allocation</span> inherit</span></span> Read</span> ahead sectors auto</span></span> -</span> currently set to</span> 256</span></span> Block</span> device 254:3</span></span> </span> ---</span> Logical volume</span> ---</span></span> LV</span> Path /dev/vg/opt</span></span> LV</span> Name opt</span></span> VG</span> Name vg</span></span> LV</span> UUID hr3GRw-d0P4-hDIw-HRIo-hqKK-Lql9-gD58a7</span></span> LV</span> Write Access read/write</span></span> LV</span> Creation host, time nixos, 2016-07-09 19:11:47 +0000</span></span> LV</span> Status available</span></span> # open 0</span></span> LV</span> Size</span> 20.00</span> GiB</span></span> Current</span> LE</span> 5120</span></span> Segments</span> 1</span></span> Allocation</span> inherit</span></span> Read</span> ahead sectors auto</span></span> -</span> currently set to</span> 256</span></span> Block</span> device 254:4</span></span></code></pre> Ok! That's our disk setup ~90% complete.</p> #Final Disk Setup All we have left to do now is format the boot partition and our logical volumes and we ca start preparing NixOs for install. The formatting can be done with a short script:</p> mkfs.vfat</span> -n</span> BOOT /dev/sda2</span></span> mkswap</span> -L</span> swap /dev/vg/swap</span></span> for</span> lv</span> in</span> root home opt</span>;</span> do</span></span> mkfs.xfs</span> -L</span> $lv</span> /dev/vg/</span>$lv</span></span> done</span></span></code></pre> This formats /dev/sda2</strong> with vfat and labels it BOOT</strong>, sets up a swap area on our LV /dev/vg/swap</strong> and finally formats our LV's /dev/vg/root</strong>, /dev/vg/home</strong> and /dev/vg/opt</strong> with xfs</strong>.</p> Awesome! Disk setup is now 100% complete!</p> Install NixOS</h1> Now that our disk is ready we can prepare to install NixOs, this is pretty short, and sweet.</p> First, we need to create the directories /mnt/boot</strong>, /mnt/home</strong> and /mnt/opt</strong>. Then, we need to mount our LV's - that we created in the previous section - and our boot partition:</p> mkdir</span> /mnt/{boot,home,opt}</span></span> mount</span> /dev/vg/root /mnt</span></span> mount</span> /dev/vg/home /mnt/home</span></span> mount</span> /dev/vg/opt /mnt/opt</span></span> mount</span> /dev/sda2 /mnt/boot</span></span></code></pre> Before we install NixOs, we have to run nixos-generate-config --root /mnt/</code> ^{6</a></sup>:</p>} $</span> nixos-generate-config</span> --root</span> /mnt/</span></span> </span> writing</span> /mnt/etc/nixos/hardware-configuration.nix...</span></span> writing</span> /mnt/etc/nixos/configuration.nix...</span></span> </span></code></pre> /mnt/etc/nixos/hardware-configuration.nix</strong> contains NixOs configuration options based on current hardware config.</li> /mnt/etc/nixos/configuration.nix</strong> is the main NixOs system configuration module.</li> </ul> We need to add some extra information to /mnt/etc/nixos/configuration.nix</strong> to tell NixOs what our boot device is, and the fact that it is also a LUKS device:</p> boot</span>.</span>loader</span>.</span>grub</span>.</span>device </span>=</span> "/dev/sda"</span>;</span></span> </span> boot</span>.</span>initrd</span>.</span>luks</span>.</span>devices </span>=</span> [{</span></span> name</span> =</span> "root"</span>;</span></span> device </span>=</span> "/dev/sda3"</span>;</span></span> preLVM </span>=</span> true;</span></span> }];</span></span> </span></code></pre> This can be added anywhere in the file, however there should already be a section for boot.loader.grub.device</strong> which is commented out. If so, uncomment it and add the config for LUKS (boot.initrd.luks.devices</strong>) right after it.</p> Now we can install! Just run:</p> nixos-install</span></span></code></pre> This can take some time, you should see information on what packages are being downloaded and installed while the installation is running. You will be prompted to enter the root</strong> password during the installationi, once you do that the installation has completed and you can boot up your new NixOs install! 7</a></sup></p> Conclusion</h1> The aim of this post was just to get NixOs installed, using the steps I used on my own system. I plan on doing some more posts on Nix and NixOs once I get some time to dive deeper into them.</p> ^{1</sup> 1 MiB = 2^{20</sup> bytes = 1024 kibibytes = 1048576 bytes.</p> </div>}}^2</sup>See Arch Linux - Grub GPT</a></p> </div> ^3</sup>Short for nix-env --query --available --attr-path packageName</code>. This searches all available packages for the packageName, and will also print out its attribute path (see Install By Attribute Path</a>).</p> </div> ^{4</sup> Running cryptsetup -y -v luksFormat /dev/sda3</code> will use the default LUKS settings, which can be found by running cryptsetup --help</code>. In my case (v1.7.0 of cryptsetup</strong>) they are LUKS1: aes-xts-plain64, Key: 256 bits, LUKS header hashing: sha256, RNG: /dev/urandom</em>.</p> </div>}^5</sup>See Arch Linux - Luks KeyMangement</a> for more information.</p> </div> ^6</sup>For more info on nixos-generate-config</code> see Section 10 of the Nix Install Manual</a>.</p> </div> ^{7</sup> When the system boots you will be asked for a password before</em> the login prompt, this is the password you used to create the LUKS volume.</p> </div>}

💾 Software Pie

GPG, Yubikey, and Pass

Unknown — Sat, 30 Apr 2022 00:00:00 +0000

Recently I've wanted to move back to using pass</a> as a password manager. In the past, I used pass</code> with my GPG key on a yubikey and it worked out well. I do still have the key I used, but I can't remember how I set pass/GPG up to use the yubikey. So, I thought I'd do it from scratch, write about it, and maybe learn something.

Initial setup</h1>
The gpg</code> and scdaemon</code> packages need to be installed. Once the yubikey is inserted it should be used immediately by GPG. GPG runs a daemon called gpg-agent</code> which talks through scdaemon</code> to communicate with the yubikey.</p>

Generate a key</h1>
To start, we need to generate some keys! Run gpg --expert --full-gen-key</code> and choose 1</code>, "RSA and RSA", as the key type. The other options should be self-explanatory.</p>

❯ gpg --expert --full-gen-key</span></span>
gpg (GnuPG) 2.2.20; Copyright (C) 2020 Free Software Foundation, Inc.</span></span>
This is free software: you are free to change and redistribute it.</span></span>
There is NO WARRANTY, to the extent permitted by law.</span></span>
</span>
Please select what kind of key you want:</span></span>
   (1) RSA and RSA (default)</span></span>
   (2) DSA and Elgamal</span></span>
   (3) DSA (sign only)</span></span>
   (4) RSA (sign only)</span></span>
   (7) DSA (set your own capabilities)</span></span>
   (8) RSA (set your own capabilities)</span></span>
   (9) ECC and ECC</span></span>
  (10) ECC (sign only)</span></span>
  (11) ECC (set your own capabilities)</span></span>
  (13) Existing key</span></span>
  (14) Existing key from card</span></span>
Your selection? 1</span></span>
RSA keys may be between 1024 and 4096 bits long.</span></span>
What keysize do you want? (3072) 4096</span></span>
Requested keysize is 4096 bits</span></span>
RSA keys may be between 1024 and 4096 bits long.</span></span>
What keysize do you want for the subkey? (3072) 4096</span></span>
Requested keysize is 4096 bits</span></span>
Please specify how long the key should be valid.</span></span>
         0 = key does not expire</span></span>
      <n>  = key expires in n days</span></span>
      <n>w = key expires in n weeks</span></span>
      <n>m = key expires in n months</span></span>
      <n>y = key expires in n years</span></span>
Key is valid for? (0) 2y</span></span>
Key expires at Mon 29 Apr 2024 17:17:40 IST</span></span>
Is this correct? (y/N) y</span></span>
</span>
GnuPG needs to construct a user ID to identify your key.</span></span>
</span>
Real name: Stephen OBrien</span></span>
Email address: wayofthepie@protonmail.com</span></span>
Comment:</span></span>
You selected this USER-ID:</span></span>
    "Stephen OBrien <wayofthepie@protonmail.com>"</span></span>
</span>
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? o</span></span>
We need to generate a lot of random bytes. It is a good idea to perform</span></span>
some other action (type on the keyboard, move the mouse, utilize the</span></span>
disks) during the prime generation; this gives the random number</span></span>
generator a better chance to gain enough entropy.</span></span>
We need to generate a lot of random bytes. It is a good idea to perform</span></span>
some other action (type on the keyboard, move the mouse, utilize the</span></span>
disks) during the prime generation; this gives the random number</span></span>
generator a better chance to gain enough entropy.</span></span>
gpg: key 01ED8E917ECF4036 marked as ultimately trusted</span></span>
gpg: revocation certificate stored as '/home/chaospie/.gnupg/openpgp-revocs.d/985DB4AF50F89C5B9ED41803817494BAD88093CB.rev'</span></span>
public and secret key created and signed.</span></span>
</span>
pub   rsa4096 2022-04-30 [SC] [expires: 2024-04-29]</span></span>
      985DB4AF50F89C5B9ED41803817494BAD88093CB</span></span>
uid                      Stephen OBrien <wayofthepie@protonmail.com></span></span>
sub   rsa4096 2022-04-30 [E] [expires: 2024-04-29]</span></span></code></pre>
You can run gpg --list-secret-keys</code> to get a list of the secret keys generated:</p>
❯ gpg --list-secret-keys</span></span>
/home/chaospie/.gnupg/pubring.kbx</span></span>
---------------------------------</span></span>
sec   rsa4096 2022-04-30 [SC] [expires: 2024-04-29]</span></span>
      985DB4AF50F89C5B9ED41803817494BAD88093CB</span></span>
uid           [ultimate] Stephen OBrien <wayofthepie@protonmail.com></span></span>
ssb   rsa4096 2022-04-30 [E] [expires: 2024-04-29]</span></span></code></pre>
To see the public keys:</p>
❯ gpg --list-keys</span></span>
/home/chaospie/.gnupg/pubring.kbx</span></span>
---------------------------------</span></span>
pub   rsa4096 2022-04-30 [SC] [expires: 2024-04-29]</span></span>
      985DB4AF50F89C5B9ED41803817494BAD88093CB</span></span>
uid           [ultimate] Stephen OBrien <wayofthepie@protonmail.com></span></span>
sub   rsa4096 2022-04-30 [E] [expires: 2024-04-29]</span></span></code></pre>GPG Terminology</h2>
Another thing I always forget when using GPG after some time is what all the jargon means!</p>
sec   rsa4096 2022-04-30 [SC] [expires: 2024-04-29]</span></span>
      985DB4AF50F89C5B9ED41803817494BAD88093CB</span></span>
uid           [ultimate] Stephen OBrien <wayofthepie@protonmail.com></span></span>
ssb   rsa4096 2022-04-30 [E] [expires: 2024-04-29]</span></span></code></pre>
Let's start from the first line sec   rsa4096 2022-04-30 [SC] [expires: 2024-04-29]</code>.</p>

sec</code> means this is a secret key.</li>
rsa4096</code> is the algorithm and key size.</li>
[SC]</code> is the capability</em> of the key, in this case SC</code>. S</code> is Sign</code>, C</code> is Certify</code>, A</code> is Authenticate</code>, and E</code> is Encrypt</code>. You can create subkeys (more on this later) that have specific capabilities.</li>
[expires: 2024-04-29]</code> this just says when the key expires</li>
</ul>
The second line, 985DB4AF50F89C5B9ED41803817494BAD88093CB</code>, is just the key id. The last line, ssb   rsa4096 2022-04-30 [E] [expires: 2024-04-29]</code>:</p>

ssb</code> says this key is a subkey</em>. The key denoted sec</code> is the primary key, and all ssb</code> keys are subkeys of this.</li>
The rest is similar to the first line.</li>
</ul>
Move keys to the yubikey</h1>
Moving the keys to the yubikey is pretty simple. First, you should back up the secret key before</em> you move it to the yubikey, you won't have access to this after moving. I have a second yubikey that I import all keys to, and I also move the secret key to a USB stick with a LUKS volume</a>. Not the best practice security-wise, but it's a USB stick I never use. You can also print them so they never live anywhere except on paper. To export the secret key:</p>
gpg --export-secret-key --armor $SECRET_KEY_ID > secret.key</span></span></code></pre>
secret.key</code> will contain the key. Store this somewhere safe! Time to move the keys to the yubikey. Insert it, and run:</p>
❯ gpg --card-status</span></span>
Reader ...........: 1050:0407:X:0</span></span>
Application ID ...: D2760001240103040006120418440000</span></span>
Application type .: OpenPGP</span></span>
Version ..........: 3.4</span></span>
Manufacturer .....: Yubico</span></span>
...</span></span></code></pre>
If it displays the card info, GPG can see it. To import we need the id of the secret key, you can get this by running:</p>
❯ gpg --list-secret-keys</span></span>
/home/chaospie/.gnupg/pubring.kbx</span></span>
---------------------------------</span></span>
sec   rsa4096 2022-04-30 [SC] [expires: 2024-04-29]</span></span>
      985DB4AF50F89C5B9ED41803817494BAD88093CB</span></span>
uid           [ultimate] Stephen OBrien <wayofthepie@protonmail.com></span></span>
ssb   rsa4096 2022-04-30 [E] [expires: 2024-04-29]</span></span></code></pre>
The id in this case is 985DB4AF50F89C5B9ED41803817494BAD88093CB</code>. To move the keys to the yubikey run gpg --edit-key $SECRET_KEY_ID</code>:</p>
❯ gpg --edit-key 985DB4AF50F89C5B9ED41803817494BAD88093CB</span></span>
gpg (GnuPG) 2.2.20; Copyright (C) 2020 Free Software Foundation, Inc.</span></span>
This is free software: you are free to change and redistribute it.</span></span>
There is NO WARRANTY, to the extent permitted by law.</span></span>
</span>
Secret key is available.</span></span>
</span>
sec  rsa4096/817494BAD88093CB</span></span>
     created: 2022-04-30  expires: 2024-04-29  usage: SC</span></span>
     trust: unknown       validity: unknown</span></span>
ssb  rsa4096/5DCD3D0ABD15FA6F</span></span>
     created: 2022-04-30  expires: 2024-04-29  usage: E</span></span>
[ unknown] (1). Stephen OBrien <wayofthepie@protonmail.com></span></span>
</span>
gpg></span></span></code></pre>
In the prompt type keytocard</code> - remember, moving the key to the card means you can never read this key directly again, so make sure you back it up!</p>
gpg> keytocard</span></span>
Really move the primary key? (y/N) y</span></span>
Please select where to store the key:</span></span>
   (1) Signature key</span></span>
   (3) Authentication key</span></span>
Your selection? 1</span></span>
</span>
sec  rsa4096/817494BAD88093CB</span></span>
     created: 2022-04-30  expires: 2024-04-29  usage: SC</span></span>
     trust: unknown       validity: unknown</span></span>
ssb  rsa4096/5DCD3D0ABD15FA6F</span></span>
     created: 2022-04-30  expires: 2024-04-29  usage: E</span></span>
ssb  rsa4096/F35B9D17C107C8AC</span></span>
     created: 2022-04-30  expires: 2024-04-29  usage: A</span></span>
[ unknown] (1). Stephen OBrien <wayofthepie@protonmail.com></span></span></code></pre>
We select the Signature Key</code> slot in the yubikey as the place to store this primary key. It should prompt for the keys passphrase. Once done, select the subkey with key 1</code>:</p>
gpg> key 1</span></span>
</span>
sec  rsa4096/817494BAD88093CB</span></span>
     created: 2022-04-30  expires: 2024-04-29  usage: SC</span></span>
     trust: unknown       validity: unknown</span></span>
ssb* rsa4096/5DCD3D0ABD15FA6F</span></span>
     created: 2022-04-30  expires: 2024-04-29  usage: E</span></span>
[ unknown] (1). Stephen OBrien <wayofthepie@protonmail.com></span></span></code></pre>
Note the asterisk (*</code>) after ssb</code>, this means this subkey is selected.</p>
gpg> keytocard</span></span>
Please select where to store the key:</span></span>
   (2) Encryption key</span></span>
Your selection? 2</span></span>
</span>
sec  rsa4096/817494BAD88093CB</span></span>
     created: 2022-04-30  expires: 2024-04-29  usage: SC</span></span>
     trust: unknown       validity: unknown</span></span>
ssb* rsa4096/5DCD3D0ABD15FA6F</span></span>
     created: 2022-04-30  expires: 2024-04-29  usage: E</span></span>
[ unknown] (1). Stephen OBrien <wayofthepie@protonmail.com></span></span></code></pre>
This time we select the Encryption Key</code> slot in the yubikey. Once complete, type quit</code> and make sure to say y</code> when prompted to save.</p>
gpg> q</span></span>
Save changes? (y/N) y</span></span></code></pre>
Now, when we list the secret keys, both the primary key and the subkey should be postfixed with a ></code>, this denotes that GPG only has a reference to the keys, they are not stored directly in its keyring.</p>
❯ gpg --list-secret-keys</span></span>
/home/chaospie/.gnupg/pubring.kbx</span></span>
---------------------------------</span></span>
sec>  rsa4096 2022-04-30 [SC] [expires: 2024-04-29]</span></span>
      985DB4AF50F89C5B9ED41803817494BAD88093CB</span></span>
      Card serial no. = 0006 12041844</span></span>
uid           [ unknown] Stephen OBrien <wayofthepie@protonmail.com></span></span>
ssb>  rsa4096 2022-04-30 [E] [expires: 2024-04-29]</span></span></code></pre>Export and store the public key</h1>
It's important to export and store the public key somewhere publicly accessible. To export:</p>
gpg --output public.key --armor --export $SECRET_KEY_ID</span></span></code></pre>
public.key</code> will contain the key. Once you've stored the public key somewhere, edit the card again with gpg --edit-card</code>. This time enable admin commands with the admin</code> command, and then enter the URL to access the public key with url</code>.</p>
❯ gpg --edit-card</span></span>
</span>
Reader ...........: 1050:0407:X:0</span></span>
Application ID ...: D2760001240103040006120418440000</span></span>
Application type .: OpenPGP</span></span>
...</span></span>
</span>
gpg/card> admin</span></span>
Admin commands are allowed</span></span>
</span>
gpg/card> url</span></span>
URL to retrieve public key: https://raw.githubusercontent.com/wayofthepie/public-keys/main/proton.key</span></span></code></pre>
I stored mine in a github repo, you can also upload it to a keyserver and reference from there.</p>
Set up pass</h1>
Install pass, with sudo apt install pass</code> or however else you want to install it. Initialize the password store with the email you used to set up your key (you can also use the full key id instead of the email):</p>
❯ pass init wayofthepie@protonmail.com</span></span>
mkdir: created directory '/home/chaospie/.password-store/'</span></span>
Password store initialized for wayofthepie@protonmail.com</span></span></code></pre>
Enable git support:</p>
❯ pass git init</span></span>
Initialized empty Git repository in /home/chaospie/.password-store/.git/</span></span>
[main (root-commit) ac03bd2] Add current contents of password store.</span></span>
 1 file changed, 1 insertion(+)</span></span>
 create mode 100644 .gpg-id</span></span>
[main 894baaa] Configure git repository for gpg file diff.</span></span>
 1 file changed, 1 insertion(+)</span></span>
 create mode 100644 .gitattributes</span></span></code></pre>
Configure the gpg-agent</code> to open any prompts on the terminal by editing/creating ~/.gnupg/gpg-agent.conf</code> and adding:</p>
pinentry-program /usr/bin/pinentry-curses</span></span></code></pre>
Either pinentry-curses</code> or pinentry-tty</code> can be used here, if neither is installed you should be able to install it directly through the package manager. Kill the agent to force it to reload its config:</p>
❯ gpgconf --kill gpg-agent</span></span></code></pre>
It will restart automatically. Let's do a quick test, insert a key test</code> with the value test</code>:</p>
❯ pass insert test -e</span></span>
Enter password for test: test</span></span></code></pre>
The -e</code> flag just means echo back the value I type, without it the value is hidden. Now, test retrieval, run pass test</code> and it should prompt you for your PIN:</p>
┌──────────────────────────────────────────────┐</span></span>
│ Please unlock the card                       │</span></span>
│                                              │</span></span>
│ Number: 0006 33333333                        │</span></span>
│ Holder:                                      │</span></span>
│                                              │</span></span>
│ PIN ________________________________________ │</span></span>
│                                              │</span></span>
│      <OK>                        <Cancel>    │</span></span>
└──────────────────────────────────────────────┘</span></span></code></pre>
The default PIN is 123456, you should change that if it's still that value. Once entered, pass should print the value of test</code>. This means it's working!</p>
We need to test that the key is only accessible on the yubikey also. Pull out the yubikey and try to retrieve the value for test</code> again, it should show a prompt like the following:</p>
┌────────────────────────────────────────────┐</span></span>
│ Please insert the card with serial number: │</span></span>
│                                            │</span></span>
│ 0006 33333333                              │</span></span>
│                                            │</span></span>
│      <OK>                      <Cancel>    │</span></span>
└────────────────────────────────────────────┘</span></span></code></pre>
Now pop it back in and run pass test</code>, it should ask for the PIN again.</p>
Set up on another computer</h1>
This is the bit that always drives me mad when I haven't used GPG for a while. Initially, on a new computer, you'll have no public or secret keys:</p>
❯ gpg --list-keys</span></span>
gpg: checking the trustdb</span></span>
gpg: no ultimately trusted keys found</span></span>
</span>
❯ gpg --list-secret-keys</span></span></code></pre>
If you try to use pass</code> to get a secret in the store, you will get the following error:</p>
❯ pass test</span></span>
gpg: decryption failed: No secret key</span></span></code></pre>
Let's fix it!</p>
Fetch the public key</h2>
To get a reference to the keys on the yubikey, plug it in and run:</p>
❯ gpg --card-edit</span></span>
</span>
Reader ...........: 1050:0407:X:0</span></span>
Application ID ...: D2760001240103040006120418440000</span></span>
Application type .: OpenPGP</span></span>
...</span></span>
</span>
gpg/card></span></span></code></pre>
In the prompt type fetch</code>:</p>
gpg/card> fetch</span></span>
gpg: requesting key from 'https://raw.githubusercontent.com/wayofthepie/public-keys/main/proton.key'</span></span>
gpg: key 01ED8E917ECF4036: public key "Stephen OBrien <wayofthepie@protonmail.com>" imported</span></span>
gpg: Total number processed: 1</span></span>
gpg:               imported: 1</span></span></code></pre>
That's it! Now, GPG should have a reference to the keys, and pass test</code> should prompt you for your pin and read the value of our test secret test</code> correctly.</p>
❯ gpg --list-keys</span></span>
/home/chaospie/.gnupg/pubring.kbx</span></span>
---------------------------------</span></span>
pub   rsa4096 2022-04-30 [SC] [expires: 2024-04-29]</span></span>
      985DB4AF50F89C5B9ED41803817494BAD88093CB</span></span>
uid           [ unknown] Stephen OBrien <wayofthepie@protonmail.com></span></span>
sub   rsa4096 2022-04-30 [E] [expires: 2024-04-29]</span></span>
</span>
❯ gpg --list-secret-keys</span></span>
/home/chaospie/.gnupg/pubring.kbx</span></span>
---------------------------------</span></span>
sec>  rsa4096 2022-04-30 [SC] [expires: 2024-04-29]</span></span>
      985DB4AF50F89C5B9ED41803817494BAD88093CB</span></span>
      Card serial no. = 0006 12041844</span></span>
uid           [ unknown] Stephen OBrien <wayofthepie@protonmail.com></span></span>
ssb>  rsa4096 2022-04-30 [E] [expires: 2024-04-29]</span></span>
</span>
❯ pass test</span></span>
test</span></span></code></pre>Phew...</h1>
This is the third time I have had to go re-learn how GPG works. It's a bit of a nightmare usability-wise. Hopefully, this serves as a good reference for future me at the very least!</p>

Processes, Threads and the Clone Syscall Unknown — Sun, 28 Feb 2021 00:00:00 +0000 I want to explore how threads and processes work on Linux, under the hood, as in-depth as I can. It's been a while since I dove into the kernel. In this series of posts, I'll be writing some potentially insane C code to dive into this.Binary Search Tree Trim Unknown — Thu, 11 Feb 2021 00:00:00 +0000 This post came from a Leetcode problem in February's daily challenges which I solved. It contains a few things that were issues for me when initially learning Rust, namely, how to properly use Rc</a> and RefCell</a>. Now that I understand them a lot more, I thought I'd write about them. Decode A Certificate Unknown — Mon, 22 Jun 2020 00:00:00 +0000 From this post on I will leave a note at the end of some sections linking to the latest code up to that point. It will look like this: wayofthepie/cert-decoder@a9d761e</a> </div> That link points to the latest code from the last post. Morning silence and broken drivers Unknown — Sun, 14 Jun 2020 00:00:00 +0000 I woke up this morning and booted my desktop. No sound! Some digging around and I noticed dmesg</code> spitting out an error. I don't have that message saved but here are the details from the kernel logs. Rust and GitHub Actions Unknown — Sun, 07 Jun 2020 00:00:00 +0000 Before we continue implementing our CLI, let's take time to set up some GitHub Actions</a> to build and test our commits. We'll use the actions defined in the actions-rs GitHub Organization</a>. A Rust cli for decoding certs Unknown — Tue, 02 Jun 2020 00:00:00 +0000 In this series of posts, we'll start to build a simple cli in Rust</a> for decoding X.509 certificates. I'll try to keep it as beginner-friendly as possible, by explaining things as best I can when they may be unclear. Some basic Rust knowledge should hopefully be all you need. Feel free to ask any questions in the comments below! Structure of an SSL (X.509) certificate Unknown — Fri, 22 May 2020 00:00:00 +0000 I've been working on some tooling for pulling certificate information out of the certificate transparency logs</a> on and off for a while. I started looking at this again after a few weeks away from it and I've forgotten quite a lot! I've even forgotten some of the basics of what makes a certificate. In this post I want to dive into the structure of a certificate, what it is made of at a high level. I won't talk much about how certificates are used in protocols (e.g. Transport Layer Security (TLS)). This post started as a reference for myself but other folks may find it interesting or useful. It has a lot of external references to RFC's which are stored in footnotes. Containerizing The JVM: Basic Memory Overview Unknown — Sun, 18 Feb 2018 00:00:00 +0000 For the past few years where I work has been running JVM applications on Cloud Foundry</a>. We have come across many issues in relation to memory when running JVM's within memory bounded containers. Terraform, Google Cloud And Kubernetes Unknown — Sat, 15 Jul 2017 00:00:00 +0000 I've been hacking about with automated infrastructure setup a lot lately. The two tools I've focused on the most are NixOps and Terraform. This post is about the use of terraform on Google Cloud Platform</a> (GCP) to create and manage a Kubernetes Container Cluster. Building an Assembler in Haskell: Implementation Unknown — Thu, 30 Mar 2017 00:00:00 +0000 In the previous post</a> we wrote a grammar for a simple assembly language, wrote the outline of our parser, derived some properties from the grammar for a simple parser byte</code> and implemented byte</code>. We also saw that there are a few deficiencies in our grammar. In this post we'll implement bytes</code>, menmonic</code>, label</code> and labelAssign</code>. For each parser I'll start with some QuickCheck properties then use those as the spec to implement the parser. Let's get to it! Building an Assembler in Haskell Unknown — Fri, 03 Mar 2017 00:00:00 +0000 Recently I started building an emulator for the MosTech 6502 Cpu, this post is about the initial stages of building an assembler for a simple assembly language that compiles to runnable 6502 machine code. I've created a repo and updated it as I wrote this post, so at the end of most sections that introduce new code I'll link to a commit which has the code up to that point. Some JS and Haskell stuff Unknown — Sun, 22 Jan 2017 00:00:00 +0000 Vulgr UI - React</h1> Vulgr is a project I've been working on, on and off, for a while. The goal is to build a dependency analysis platform - analyze your gradle</code>/node</code>/whatever</code> dependencies to see whether they contain known vulnerabilities or bugs, reading from whatever data sources (CVE database, github issues, etc...) that make sense. This week, I did some work on how this information could be displayed to users on a web interface, e.g.: This is built with react</a> and material-ui</a>. The code for the card is located at AnalysisSummaryCard.js</a>. Following is the code for the status icon's in the card, nice, flexible re-usable component! 'use strict'; import React, {PropTypes} from 'react'; import ReactTooltip from 'react-tooltip'; let statusIcon = (iconType, attributes, style) => { return ( style={style}> {iconType} ); }; let tooltippableStatusIcon = (iconType, tooltipInfo, style) => { let tooltip = function () { if (tooltipInfo) { return ( <ReactTooltip place='top' id={tooltipInfo.id} type={tooltipInfo.type} effect='solid'> {tooltipInfo.message} </ReactTooltip> ); } else { return null; } }; let tooltippedAttributes = () => { return tooltipInfo ? {'data-tip': '', 'data-for': tooltipInfo.id} : []; }; return ( <div> { tooltip() } { statusIcon(iconType, tooltippedAttributes(), style) } </div> ); }; export const StatusIcon = ({iconType, tooltipInfo, style}) => { return tooltippableStatusIcon(iconType, tooltipInfo, style); }; StatusIcon.propTypes = { iconType: PropTypes.string.isRequired, tooltipInfo: PropTypes.shape({ id: PropTypes.string.isRequired, type: PropTypes.string.isRequired, message: PropTypes.string.isRequired }), style: PropTypes.object }; export default StatusIcon;</code></pre> Here is an example of its use to render the error icon, first a function to wrap up the JSX: let createStatusIcon = (iconType, tooltipInfo, style) => { return ( <StatusIcon iconType={iconType} tooltipInfo={tooltipInfo} style={style} /> ); };</code></pre> Concrete usage: let errorIcon = () => { let icon = 'error'; let marginLeft = 10; let tooltipInfo = buildTooltipInfo('analysis-card-error-tooltip', 'error', 'Error!', {marginLeft}); let style = {color: 'red', float: 'left', marginLeft}; return createStatusIcon(icon, tooltipInfo, style); };</code></pre> Pretty flexible! The color and style can easily be changed so the icon can fit in without much hassle in components with complex styles, or can be greyed out, etc... I use Angular and bootstrap at work, so far react and material have been a dream in comparison. Haskell Criu RPC Client</h1> I've been toying about with criu</a> for the last few weeks. I decided to write some bindings to it in haskell. Criu's RPC API 1</a> uses protobuf</a>. I used the proto-lens</a> library to generate lenses and data types. This gives a pretty nice foundation to build upon - the project for generation is on github, haskell-criu-rpc-types</a> 2</a>. With that foundation, I threw together a quick client: {-# LANGUAGE OverloadedStrings #-} {-# LANGUAGE ScopedTypeVariables #-} module Criu ( module Proto.Criu.Rpc , module Lens.Family2 , callCriu , callCriu' ) where import Control.Exception.Base (IOException, bracket, try) import Lens.Family2 ((.~)) import Data.ProtoLens (decodeMessage, encodeMessage) import Proto.Criu.Rpc import Network.Socket (Family(AF_UNIX), SocketType(SeqPacket), SockAddr(SockAddrUnix), close, connect, socket) import Network.Socket.ByteString (recv, send) -- | Send request to criu socket. Can throw exceptions. callCriu :: FilePath -> Criu_req -> IO (Either String Criu_resp) callCriu fp req = do resp <- withSocket $ \sock -> do connect sock (SockAddrUnix fp) send sock (encodeMessage req) recv sock 1024 pure (decodeMessage resp :: Either String Criu_resp) where withSocket f = bracket (socket AF_UNIX SeqPacket 0) (close) (\sock -> f sock) -- | Send a request to criu, but wrap up IOExceptions in Either. callCriu' :: FilePath -> Criu_req -> IO (Either String Criu_resp) callCriu' fp req = do eitherResp <- try (callCriu fp req) case eitherResp of Right resp -> pure resp Left (e :: IOException) -> pure . Left . show $ e</code></pre> Both callCriu</code> and callCriu'</code> expect the path to the criu</code> socket and a Criu_req</code> type. To build the actual Criu_req</code> expected by the calls is is pretty straightforward. In ghci</code>: > build (type' .~ CHECK) :: Criu_req Criu_req { _Criu_req'type' = CHECK , _Criu_req'opts = Nothing , _Criu_req'notifySuccess = Nothing , _Criu_req'keepOpen = Nothing , _Criu_req'features = Nothing }</code></pre> build (type' .~ CHECK) :: Criu_req</code> builds a request for a criu</code> check. So, an actual call looks as follows: > callCriu' "criu_service.socket" (build (type' .~ CHECK) :: Criu_req) Right ( Criu_resp { _Criu_resp'type' = CHECK , _Criu_resp'success = True , _Criu_resp'dump = Nothing , _Criu_resp'restore = Nothing , _Criu_resp'notify = Nothing , _Criu_resp'ps = Nothing , _Criu_resp'crErrno = Nothing , _Criu_resp'features = Nothing , _Criu_resp'crErrmsg = Nothing } )</code></pre> From the service logs: $ criu service Warn (cr-service.c:1023): Binding to local dir address! Warn (cr-check.c:827): Skipping cgroup namespaces check Looks good.</code></pre> Success! Lots to improve, but a good start. I'll do a more in-depth post on this once it matures. ^1See https://criu.org/RPC</a> for more information. </div> ^2It's also on hackage, https://hackage.haskell.org/package/criu-rpc-types-0.0.0.1</a>, however I'm not sure what the standard is for libraries that generate their code. </div> Installing NixOs Unknown — Sun, 10 Jul 2016 00:00:00 +0000 Introduction</h1> I've recently started diving into Nix</a> and NixOS</a>. Nix is a package manager for Linux/Unix systems, a quick description from its own site: Nix's purely functional approach ensures that installing or upgrading one package cannot break other packages. This is because it won't overwrite dependencies with newer versions that might cause breakage elsewhere. It allows you to roll back to previous versions, and ensures that no package is in an inconsistent state during an upgrade. </blockquote> NixOs is an operating system which takes a declarative approach to configuration and package management and uses Nix as its package manager. Following is an example of creating a user on a NixOS system: ... users.extraUsers.alice = { isNormalUser = true; home = "/home/alice"; extraGroups = [ "wheel" ]; }; security.sudo.enable = true; ...</code></pre> An example of a fully configured NixOS system can be found at https://github.com/wayofthepie/sky</a>, this is the configuration I'm currently using for my desktop. In this post I'm going to run through how I installed NixOs, with the aim of helping anyone new to NixOs through the installation process. Throughout the post I will be assuming the following: The NixOS install CD or USB installer - see https://nixos.org/nixos/manual/index.html#sec-installation</a>.</li> An empty disk.</li> Boot with UEFI.</li> </ul> These are not requirements, but will make the post easier to follow. Partition</h1> Let's start! First boot into NixOs, whether from USB or the CD installer, and find the disk you wish to install onto. I will use /dev/sda in this post, you can replace this with whatever disk you are going to use. The system will boot with UEFI so gdisk should be used to create the partitions. This will create a GPT (GUID Partition Table) formatted disk. With gdisk create the following partitions: Partition</th> Size</th> Type</th> Code</th> Filesystem</th></tr></thead> /dev/sda1</td> 2 MiB</td> Bios Boot Partition</td> ef02</td> None</td></tr> /dev/sda2</td> 1024 MiB</td> EFI</td> ef00</td> vfat</td></tr> /dev/sda3</td> 119 GiB</td> Linux LVM</td> 8e00</td> xfs</td></tr> </tbody></table> If you have never used gdisk before, fear not! Just run gdisk /dev/sda</code> and answer the questions as outlined in the next section. If you know what you are doing, you can skip the next section. Creating Partitions With gdisk</h2> $ gdisk /dev/sda GPT fdisk (gdisk) version 1.0.1 Partition table scan: MBR: not present BSD: not present APM: not present GPT: not present Creating new GPT entries. Command (? for help): n Partition number (1-128, default 1): 1 First sector (34-251658206, default = 2048) or {+-}size{KMGTP}: Last sector (2048-251658206, default = 251658206) or {+-}size{KMGTP}: +2M Current type is 'Linux filesystem' Hex code or GUID (L to show codes, Enter = 8300): ef02 Changed type of partition to 'BIOS boot partition' Command (? for help): n Partition number (2-128, default 2): First sector (34-251658206, default = 6144) or {+-}size{KMGTP}: Last sector (6144-251658206, default = 251658206) or {+-}size{KMGTP}: +1G Current type is 'Linux filesystem' Hex code or GUID (L to show codes, Enter = 8300): ef00 Changed type of partition to 'EFI System' Command (? for help): n Partition number (3-128, default 3): First sector (34-251658206, default = 2103296) or {+-}size{KMGTP}: Last sector (2103296-251658206, default = 251658206) or {+-}size{KMGTP}: Current type is 'Linux filesystem' Hex code or GUID (L to show codes, Enter = 8300): 8e00 Changed type of partition to 'Linux LVM' Command (? for help): w Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING PARTITIONS!! Do you want to proceed? (Y/N): y OK; writing new GUID partition table (GPT) to /dev/sda. The operation has completed successfully.</code></pre> In the above, we begin creating our first new partition by using the command n when asked the question Command (? for help):</code>. The first question we are asked is what number we would like to give, it's our first partition so 1, this will create a partition called /dev/sda1 on /dev/sda. Next, we are asked what sector to start on and what sector to end on. The starting sector can be left empty - this means start at next unused sector, which in this case is the start of the disk. As for which sector to end on, here we answer +2M which will means move 2 Mebibytes ^{1</a> (MiB) forward from the starting sector, giving us a partition size of 2 Mebibytes.} Finally, we are asked if we want to change the type of the partition. Our first partition should have the type ef02, more on why later. That's the first partition created, it should be clear now how the next two are created. Notes On The Partitions</h2> Done? Good, to get a look at the disk layout run gdisk -l /dev/sda</code>, this should print out the following: $ gdisk -l /dev/sda GPT fdisk (gdisk) version 1.0.1 Partition table scan: MBR: protective BSD: not present APM: not present GPT: present Found valid GPT with protective MBR; using GPT. Disk /dev/sda: 251658240 sectors, 120.0 GiB Logical sector size: 512 bytes Disk identifier (GUID): 031652EE-C219-4EFB-84AB-9E310B14357E Partition table holds up to 128 entries First usable sector is 34, last usable sector is 251658206 Partitions will be aligned on 2048-sector boundaries Total free space is 2014 sectors (1007.0 KiB) Number Start (sector) End (sector) Size Code Name 1 2048 6143 2.0 MiB EF02 BIOS boot partition 2 6144 2103295 1024.0 MiB EF00 EFI System 3 2103296 251658206 119.0 GiB 8E00 Linux LVM</code></pre>Grub Compatibility: /dev/sda1</h3> This is used by grub 2</a> at boot-time when booting off a GPT disk. EFI Partition: /dev/sda2</h3> UEFI will load files stored in this partition when booting. Main Data Partition: /dev/sda3</h3> This is used for creating the logical volumes swap (4GB), / (20GB), /home (20GB) and /opt (20GB) in this post, it's size should reflect the sum of the sizes of all logical volumes you wish to create. Note that any free space left of the disk can be used later, and those logical volumes can be increased (or decreased) in size. Linux Unified Key Setup (LUKS)</h1> Now that the partitions are setup, it's time to encrypt the main partition, /dev/sda3. This is optional and there are a few ways to do it, this post uses LUKS</a>. The cryptsetup</a> tool is used to create LUKS volumes. To search nix packages the command nix-env -qaP packageName</code> 3</a> can be used: $ nix-env -qaP cryptsetup nixos.cryptsetup cryptsetup-1.7.0</code></pre> Now that we know cryptsetup is in the package list, we can install it with nix-env</code>: $ nix-env -i cryptsetup installing 'cryptsetup-1.7.0' building path(s) '/nix/store/86mqcs95fb3gkkb74481fbf90zh5w98l-user-environment' created 44 symlinks in user environment</code></pre>Encrypting /dev/sda3</h2> I won't go into detail about LUKS or cryptsetup here, we will also just use the defaults for both. Simply run the following cryptsetup command and enter a passphrase: $ cryptsetup -y -v luksFormat /dev/sda3 WARNING! ======== This will overwrite data on /dev/sda3 irrevocably. Are you sure? (Type uppercase yes): YES Enter passphrase: Verify passphrase: Command successful. </code></pre> /dev/sda3 is now encrypted! 4</a> The options passed to cryptsetup have the following meaning: -y : prompt for passphrase twice.</li> -v : verbose mode.</li> luksFormat : initializes a LUKS partition and sets the initial passphrase (for key-slot 0) 5</a>.</li> </ul> Great, we now have an encrypted disk, but how is it used? Let's jump back to cryptsetup, it has a command cryptsetup luksOpen LUKS_DEVICE NAME</code> which, when it verifies the passphrase (in our case), will open the LUKS device and create a mapping to it (on the path /dev/mapper/NAME)from the given name. $ cryptsetup luksOpen /dev/sda3 enc-data Enter passphrase for /dev/sda3: $ ls -la /dev/mapper/ total 0 drwxr-xr-x 2 root root 80 Jul 9 18:43 . drwxr-xr-x 18 root root 3320 Jul 9 18:43 .. lrwxrwxrwx 1 root root 7 Jul 9 18:43 enc-data -> ../dm-0 </code></pre> Sweet! We now have an encrypted partition and know how to access it. All we have left to do is setup logical volumes on the partition. LVM Setup</h1> Make sure our data partition - /dev/sda3 - is open and mapped to the path /dev/mapper/enc-data with luksOpen, as mentioned above. There are three steps to setting up logical volumes, creating a physical volume (PV), a volume group (VG) and a logical volume (LV). If you are unfamiliar with Logical Volume Management (LVM) the Arch Linux Wiki entry</a> is a good resource. As a quick description, a physical disk can be divided into one or more physical volumes, a volume group is made up of one or mode physical volumes and logical volumes are created within volume groups. Physical Volume</h2> pvcreate</code> is the command used to create physical volumes. Let's use this to create a physical volume on /dev/mapper/enc-data: $ pvcreate /dev/mapper/enc-data Physical volume "/dev/mapper/enc-data" successfully created</code></pre> pvdisplay</code> is used to display information on physical volumes on the system. $ pvdisplay "/dev/mapper/enc-data" is a new physical volume of "119.00 GiB" --- NEW Physical volume --- PV Name /dev/mapper/enc-data VG Name PV Size 119.00 GiB Allocatable NO PE Size 0 Total PE 0 Free PE 0 Allocated PE 0 PV UUID H3bhmD-KR9n-XaHb-03L6-TpN2-pYB5-DtUG7x</code></pre>Volume Group</h2> vgcreate</code> is used to create a volume group. Lets create a volume group called vg. $ vgcreate vg /dev/mapper/enc-data Volume group "vg" successfully created </code></pre> vgdisplay</code> displays info on the systems volume groups. $ vgdisplay --- Volume group --- VG Name vg System ID Format lvm2 Metadata Areas 1 Metadata Sequence No 1 VG Access read/write VG Status resizable MAX LV 0 Cur LV 0 Open LV 0 Max PV 0 Cur PV 1 Act PV 1 VG Size 118.99 GiB PE Size 4.00 MiB Total PE 30462 Alloc PE / Size 0 / 0 Free PE / Size 30462 / 118.99 GiB VG UUID O9EIaS-kX9Y-EXjo-I3zU-mPXY-9SVB-br2fEy</code></pre>Logical Volume</h2> lvcreate</code> is used to create a logical volume. In this case, we want to create four logical volumes from our volume group vg. lvcreate -n swap --size 8G vg lvcreate -n root --size 20G vg lvcreate -n home --size 20G vg lvcreate -n opt --size 20G vg</code></pre> Running the above four lvcreate commands will give us our logical volumes swap, root, home and opt. Use lvdisplay</code> to get more info on them: $ lvdisplay --- Logical volume --- LV Path /dev/vg/swap LV Name swap VG Name vg LV UUID F5DbgU-ymix-24Bh-JMTy-q2kL-ayvN-UpNUFB LV Write Access read/write LV Creation host, time nixos, 2016-07-09 19:11:46 +0000 LV Status available # open 0 LV Size 8.00 GiB Current LE 2048 Segments 1 Allocation inherit Read ahead sectors auto - currently set to 256 Block device 254:1 --- Logical volume --- LV Path /dev/vg/root LV Name root VG Name vg LV UUID FNLEbI-z05h-J7br-OMst-Ui0t-yq3r-BMNVjA LV Write Access read/write LV Creation host, time nixos, 2016-07-09 19:11:46 +0000 LV Status available # open 0 LV Size 20.00 GiB Current LE 5120 Segments 1 Allocation inherit Read ahead sectors auto - currently set to 256 Block device 254:2 --- Logical volume --- LV Path /dev/vg/home LV Name home VG Name vg LV UUID zBLqKD-S6n7-BcTh-1oAF-TLvV-26Oc-dQ3wQR LV Write Access read/write LV Creation host, time nixos, 2016-07-09 19:11:46 +0000 LV Status available # open 0 LV Size 20.00 GiB Current LE 5120 Segments 1 Allocation inherit Read ahead sectors auto - currently set to 256 Block device 254:3 --- Logical volume --- LV Path /dev/vg/opt LV Name opt VG Name vg LV UUID hr3GRw-d0P4-hDIw-HRIo-hqKK-Lql9-gD58a7 LV Write Access read/write LV Creation host, time nixos, 2016-07-09 19:11:47 +0000 LV Status available # open 0 LV Size 20.00 GiB Current LE 5120 Segments 1 Allocation inherit Read ahead sectors auto - currently set to 256 Block device 254:4</code></pre> Ok! That's our disk setup ~90% complete. #Final Disk Setup All we have left to do now is format the boot partition and our logical volumes and we ca start preparing NixOs for install. The formatting can be done with a short script: mkfs.vfat -n BOOT /dev/sda2 mkswap -L swap /dev/vg/swap for lv in root home opt; do mkfs.xfs -L $lv /dev/vg/$lv done</code></pre> This formats /dev/sda2 with vfat and labels it BOOT, sets up a swap area on our LV /dev/vg/swap and finally formats our LV's /dev/vg/root, /dev/vg/home and /dev/vg/opt with xfs. Awesome! Disk setup is now 100% complete! Install NixOS</h1> Now that our disk is ready we can prepare to install NixOs, this is pretty short, and sweet. First, we need to create the directories /mnt/boot, /mnt/home and /mnt/opt. Then, we need to mount our LV's - that we created in the previous section - and our boot partition: mkdir /mnt/{boot,home,opt} mount /dev/vg/root /mnt mount /dev/vg/home /mnt/home mount /dev/vg/opt /mnt/opt mount /dev/sda2 /mnt/boot</code></pre> Before we install NixOs, we have to run nixos-generate-config --root /mnt/</code> ^{6</a>:} $ nixos-generate-config --root /mnt/ writing /mnt/etc/nixos/hardware-configuration.nix... writing /mnt/etc/nixos/configuration.nix... </code></pre> /mnt/etc/nixos/hardware-configuration.nix contains NixOs configuration options based on current hardware config.</li> /mnt/etc/nixos/configuration.nix is the main NixOs system configuration module.</li> </ul> We need to add some extra information to /mnt/etc/nixos/configuration.nix to tell NixOs what our boot device is, and the fact that it is also a LUKS device: boot.loader.grub.device = "/dev/sda"; boot.initrd.luks.devices = [{ name = "root"; device = "/dev/sda3"; preLVM = true; }]; </code></pre> This can be added anywhere in the file, however there should already be a section for boot.loader.grub.device which is commented out. If so, uncomment it and add the config for LUKS (boot.initrd.luks.devices) right after it. Now we can install! Just run: nixos-install</code></pre> This can take some time, you should see information on what packages are being downloaded and installed while the installation is running. You will be prompted to enter the root password during the installationi, once you do that the installation has completed and you can boot up your new NixOs install! 7</a> Conclusion</h1> The aim of this post was just to get NixOs installed, using the steps I used on my own system. I plan on doing some more posts on Nix and NixOs once I get some time to dive deeper into them. ^{1 1 MiB = 2^{20 bytes = 1024 kibibytes = 1048576 bytes. </div>}}^2See Arch Linux - Grub GPT</a> </div> ^3Short for nix-env --query --available --attr-path packageName</code>. This searches all available packages for the packageName, and will also print out its attribute path (see Install By Attribute Path</a>). </div> ^{4 Running cryptsetup -y -v luksFormat /dev/sda3</code> will use the default LUKS settings, which can be found by running cryptsetup --help</code>. In my case (v1.7.0 of cryptsetup) they are LUKS1: aes-xts-plain64, Key: 256 bits, LUKS header hashing: sha256, RNG: /dev/urandom. </div>}^5See Arch Linux - Luks KeyMangement</a> for more information. </div> ^6For more info on nixos-generate-config</code> see Section 10 of the Nix Install Manual</a>. </div> ^{7 When the system boots you will be asked for a password before the login prompt, this is the password you used to create the LUKS volume. </div>}

💾 Software Pie

GPG, Yubikey, and Pass

GPG Terminology</h2> Another thing I always forget when using GPG after some time is what all the jargon means!</p>

Phew...</h1> This is the third time I have had to go re-learn how GPG works. It's a bit of a nightmare usability-wise. Hopefully, this serves as a good reference for future me at the very least!</p>

Processes, Threads and the Clone Syscall

Binary Search Tree Trim

Decode A Certificate

Morning silence and broken drivers

Rust and GitHub Actions

A Rust cli for decoding certs

Structure of an SSL (X.509) certificate

Containerizing The JVM: Basic Memory Overview

Terraform, Google Cloud And Kubernetes

Building an Assembler in Haskell: Implementation

Building an Assembler in Haskell

Some JS and Haskell stuff

Installing NixOs

LVM Setup</h1> Make sure our data partition - /dev/sda3</strong> - is open and mapped to the path /dev/mapper/enc-data</strong> with luksOpen</strong>, as mentioned above.</p>

Phew...</h1>
This is the third time I have had to go re-learn how GPG works. It's a bit of a nightmare usability-wise. Hopefully, this serves as a good reference for future me at the very least!</p>