Loop's Tech Tips

Secureboot on Fedora

Sat, 19 Dec 2015 01:43:52 -0800

The following describes a setup for Secureboot when using the fedora_shim, and grub2
boot loader. This combination requires that each kernel be signed with a certificate.
There are alternatives like the Linux Foundation PreLoader which doesn’t require
kernels to be signed, instead it just needs to be given a hash for each authorized
boot kernel. There are other setups where grub2 wouldn’t be needed either, such as
when using the rEFInd boot manager.

To sign kernels that can be booted under UEFI Secureboot you first need a certificate.
This certificate is registered with the UEFI, and is also used by the pesign utility
to bless each kernel image.

First create this certificate:

# efikeygen \
    --self-sign \
    --nickname="Loops Local Certificate" \
    --common-name="CN=Loops of Eztux certificate for local signing" \
    --url="http://eztux.com/about"

The certificate is placed in the /etc/pki/pesign datastore. This means that
the above (and following) commands need to be run as root. You can then
extract this certificate into a separate file used when registering it with UEFI.

# cd ~
# certutil -d /etc/pki/pesign/ -L -n "Loops Local Certificate" -r > ./loops.cer

Make sure to back this “loops.cer” certificate since it will be used for all
locally authorized kernels (including those from other distros if you want to
boot them).

Now register this certificate with UEFI:

# mokutil --import ./loops.cer

You will have to assign a password which will be used next time you reboot the computer
to authorize this certificate being imported into UEFI. Once this has been done,
any kernel that you boot with the fedora_shim will work in secure mode, as long as it
has been signed with this certificate:

# pesign -c 'Loops Local Certificate' -i bzImage -o vmlinuz.signed --sign

Note that the external loops.cer file is no longer needed and should be removed from
the filesystem. The copy held in the pki store will be used by the pesign utility.

Move the vmlinuz.signed output file into /boot to be accessed by grub on startup.

Changing the Default Theme Colors

Mon, 30 Nov 2015 17:11:15 -0800

So it turns out that there are some minor color artifacts for the current version of
the octopress-genesis-theme.

I could not find a good way to override the settings without copying way too much of the
theme into the content repo. Really this is cross-poluting the content repo, with
the theme repo’s… but what can you do.

Copy the current theme settings

$ octopress ink copy theme

_plugins/theme directory after 'ink copy theme' command

config.yml
stylesheets
stylesheets/core
includes
layouts
templates

So then to keep the polution to a minimum, I deleted everything but the stylesheets/core¹
directory after which _colors.scss and _sizes.scss could be customized. Once everything
is working locally, commit the changes to git, and deploy to github.

Actually I had to restore config.yml from git since the “ink copy” overwrote it ↩

Deploy World

Mon, 30 Nov 2015 14:11:28 -0800

To host the statically generated content on github, you’ll need to first create a
Github repository named <yourname>.github.io. Then create an octopress _deploy.yml
file.

_deploy.yml

method: git
site_dir: _site
git_url: git@github.com:loops/loops.github.io
git_branch: master

You’ll have to have your ssh keys setup properly to allow pushing so that the
following command can generate and deploy content to your Github page:

Deploy

$ octopress deploy

This will create the static content in a .deploy directory before uploading it
for free hosting on Github. You’ll want to add this .deploy directory to your
.gitignore file.

You should be able to see your blog site working on http://loops.github.io now.
Check out the /feed/index.xml that I added to the repo so that RSS subscriptions
work.

Hello World

Mon, 30 Nov 2015 12:11:54 -0800

So I’m going to use these github pages as a place to stash random programming and
configuration tips. It’s probably too ambitious to think it will turn
out to be useful for myself, let alone anyone else. Having said that, might as well
document setting up this blog since many of the google results for using Octopress on
Github are outdated. Although, there’s lots of good information on their website
http://jekyllrb.com/docs/home/.

Initial Setup

$ mkdir ~/blog
$ cd ~/blog
$ vi Gemfile

Gemfile

source 'https://rubygems.org'
 
gem 'jekyll'
 
group :jekyll_plugins do
    gem 'octopress', '~> 3.0.11'
    gem 'octopress-image-tag'
    gem 'octopress-video-tag'
    gem 'octopress-quote-tag'
    gem 'octopress-codefence'
    gem 'octopress-gist'
    gem 'octopress-genesis-theme'
    gem 'octopress-solarized'
end

Installing ruby and the gem bundle program

$ sudo dnf install rubygem-bundler
$ bundle install
$ octopress init .
$ vi _config.yml
$ vi .gitignore
$ mkdir -p _plugins/theme/
$ vi _plugins/theme/_config.yml

An idea of what to put into the _config.yml¹ and .gitignore²
files can be seen below. The main thing of note at this point is that very little is
needed in your ~/blog directory. Almost everything, including the default theme will
be held in gems not checked into our blog source directory. That’s why you have to
create a separate _plugins/theme/_config.yml³ file to override the title
which is set in the theme gem.

Create your first post

$ octopress new post "Hello World" -D octopress
New post: _posts/octopress/2015-11-30-hello-world.md
$ vi _posts/octopress/2015-11-30-hello-world.md

After entering some content in Markdown format, you check out your results by running
a jekyll server instance and then going to http://localhost:4000 with your web browser

Running a local instance of your blog

$ jekyll serve -w
Configuration file: /home/sean/blog/_config.yml
            Source: /home/sean/blog
       Destination: /home/sean/blog/_site
      Generating...
                    done.
 Auto-regeneration: enabled for '/home/sean/blog'
Configuration file: /home/sean/blog/_config.yml
    Server address: http://127.0.0.1:4000/
  Server running... press ctrl-c to stop.

Committing to Git

Once you’re happy with this initial blog entry it’s time to commit all your source files
to Git and push them to Github. This repository will only store the source files, not
the generated content. First create a repository named “blog” on Github, and then:

Commit to Git

$ git init
$ git add .
$ git commit -m "Initial Checkin"
$ git remote add origin git@github.com:loops/blog.git
$ git push -u origin master

Example Files

_config.yml

title: Loop's Tech Tips
email: sean@eztux.com
description: >
  You're not likely to find much of any practical value for yourself
  here on this site.  It's meant mostly as a dumping ground for
  random programming and configuration items.  If anything you read
  here breaks something for you, you get to keep both halves.  Cheers!
url: "http://loops.github.io"
twitter_username: linux_or_bust
github_username:  loops
 
# Don't include these files when we build our site
exclude: ['Gemfile.lock', 'Gemfile']
 
# Select our desired Markdown processing engine
markdown: kramdown
 
# Configure the Kramdown engine to enable its Github features
kramdown:
  input: GFM
 
# You could use the popular Redcarpet markdown engine instead
# It has a few extensions to do things like convert plain URL's to links
redcarpet:
  extensions: ["tables", "autolink", "strikethrough", "space_after_headers", "with_toc_data", "fenced_code_blocks"]
 
# Octopress settings
post_ext: md
page_ext: html
post_layout: theme:post
page_layout: theme:page
 
# Make sure these gems are loaded, when we produce our static site
gems:
  - octopress-genesis-theme
  - octopress-solarized
  - octopress-image-tag
  - octopress-video-tag
  - octopress-quote-tag
  - octopress-codefence
  - octopress-gist

.gitignore

_site
*.swp
.ink-cache
.sass-cache
.code-highlighter-cache

_plugins/theme/_config.yml to override options set by the theme gem

title: Loop's Tech Tips
subtitle: It's a big world

example _config.yml below ↩
example .gitignore below ↩
_plugins/theme/_config.yml exmple below ↩