Trusted (Secure Boot) PoC

[smira]

Implement a PoC of Trusted Boot using QEMU + Secure Boot UEFI firmware. We can cut corners, the idea is to discover the path towards the solution.

See https://0pointer.de/blog/brave-new-trusted-boot-world.html

Time box: 1 week

Tasks

Beta Give feedback

1. Encrypting STATE/EPHEMERAL with TPM2 and signed PCR values #7266
   +0
   
2. move ukify to talos tree #7470
   +0
   
3. move UKI generation to imager
4. implement a resource to describe security state of Talos #7514
   +0
   
5. Multiple boot options #7258
   Stale +1
6. More stricter IMA policies #7256
   Stale +1
7. System extensions as signed sysext #7257
   Stale +1
8. Kernel modules signed by MoK #7259
   Stale +1
9. UKI Kexec #7260
   Stale +1
10. Secureboot: Rollback protection #7274
    Stale +1
11. Set EFIvars after talos install #7276
    Stale +1
12. Building UEFI ISO for UKI #7261
    +0
13. UKI creation using code in hack #7267
    +0
14. Upgrades with SecureBoot #7272
    +0
15. SecureBoot: Failed upgrade rollback #7273
    +0
16. go-swtpm library #7275
    +0
17. QEMU support for SecureBoot #7324
    +0
18. research replacing sbsign & ovmfctl with native go library #7373
    +0
    
19. UEFI db certs not loaded into platform keyring #7383
    +0
20. move gen-certs to talosctl #7412
    +0
    
21. talosctl gen secureboot support DER output format #7742
    +0
    

[smira]

Bonus point: TPM-based disk encryption

[uhthomas]

Bonus point: TPM-based disk encryption

I'm sure you're already aware of this, but systemd-cryptenroll is typically the way this is done on desktops. Not sure if it applies here, but I hope the reference is helpful at least.

[frezbo]

Bonus point: TPM-based disk encryption

I'm sure you're already aware of this, but systemd-cryptenroll is typically the way this is done on desktops. Not sure if it applies here, but I hope the reference is helpful at least.

This has been implemented similar to systemd-cryptenroll, jut in talos itself (we didn't want to bring in another binary and related toolchain)