h3artbl33d/hardenedbsd-web
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add install.md

Browse source
This commit is contained in:
h3artbl33d 2025-03-08 18:33:14 +01:00
parent 51142c7514
commit 4dc82b56ba
1 changed files with 33 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

33
src/install.md Normal file
View file

@ -0,0 +1,33 @@
#### HardenedBSD installers
**15-CURRENT**
git:
<pre>
git clone --single-branch --branch hardened/current/master https://git.hardenedbsd.org/hardenedbsd/HardenedBSD.git hardenedbsd-current
</pre>
installers: [https://installers.hardenedbsd.org/pub/current/](https://installers.hardenedbsd.org/pub/current/)
#### Verifying Build Artifacts
The HardenedBSD build artifacts are signed with an SSH key. SSH keys are used so that artifacts can be validated using only tools included in the base operating system.
First, download the SSH public key:
<pre>
$ fetch https://installers.hardenedbsd.org/pub/keys/ssh.pub.txt
</pre>
Then download the build artifact. For purposes of this documentation, the compressed memstick installation image for HardenedBSD 14-STABLE will be used.
<pre>$ fetch https://installers.hardenedbsd.org/pub/14-stable/amd64/amd64/installer/LATEST/memstick.img.xz
$ fetch https://installers.hardenedbsd.org/pub/14-stable/amd64/amd64/installer/LATEST/memstick.img.xz.sig</pre>
Next, generate an `allowed_signers` file which contains the SSH public key:
<pre>$ echo "hbsd-os-build-01 $(cat ssh.pub.txt)" > allowed_signers</pre>
Now the signature file can be verified:
<pre>$ ssh-keygen -Y verify -f allowed_signers -I hbsd-os-build-01 -n file -s memstick.img.xz.sig < memstick.img.xz</pre>