mixer-tools/verified-boot

Implementing dm-verity for a non-rootfs data partition in Clear Linux

- Use mixer to create a CLR linux image with the following:
  - Enable support for dm-verity in the CLR linux image.
    - Set “CONFIG_DM_VERITY=y” in the kernel config file and build the linux kernel package.
  - Add the "cryptsetup" package in the build.
    - Add the bundle “os-core-dev” that contains the "cryptsetup" package.
  - Use the sample "release-image-config.json" file provided in this folder.

- Run the "dm-verity-impl-1.py" program with input as the path to the .img file.
  E.g. "sudo python3 dm-verity-impl-1.py release.img"

- Flash the .img file to a USB stick
  E.g "sudo dd if=release.img of=/dev/sdd bs=4M status=progress"

- Boot the target system from the USB stick. On login, the non-rootfs partition is activated with dm-verity.
  "dmsetup table" shows the details of the dm-verity hash table.
  "lsblk -f" shows the data and hash partitions

- Mount /dev/mapper/root to a mount folder and access the contents of the partition.
  E.g. "mount /dev/mapper/root /mnt/datadev/"
       "sh /mnt/datadev/file1.sh"