Project Talk:Hardened musl/Bluedragon

From Gentoo Wiki
Jump to: navigation, search

Step 1. Instead of:

root #wget http://[mirror]/pub/linux/gentoo/releases/amd64/current-iso/install-amd64-minimal-[date].iso

Should be:

root #wget http://[mirror]/pub/linux/gentoo/releases/amd64/autobuilds/current-install-amd64-minimal/install-amd64-minimal-[date].iso

Step 3.5. Before downloading and extracting the tarball image, it may be necessary to set the date and time.

Step 4. The instructions refer to a bz2 compressed archive, but it is actually xz:

root #cd /mnt/gentoo
root #wget http://releases.freeharbor.net/desktop-amd64-musl-hardened-[date].tar.xz

It's a good idea to verify the signature of the DIGESTS file, then use the DIGESTS file to verify the integrity of the tarball:

root #wget http://releases.freeharbor.net/desktop-amd64-musl-hardened-[date].tar.xz.asc
root #wget http://releases.freeharbor.net/desktop-amd64-musl-hardened-[date].tar.xz.DIGESTS
root #gpg --verify desktop-amd64-musl-hardened-[date].tar.xz.asc desktop-amd64-musl-hardened-[date].tar.xz.DIGESTS
root #sha512sum -c desktop-amd64-musl-hardened-[date].tar.xz.DIGESTS

Finally, it may be important to preserve the permissions of the extracted tarball contents:

root #tar --xattrs -xvJpf desktop-amd64-musl-hardened-[date].tar.xz

Step 4.5. Before mounting and chrooting, it may be necessary to configure Portage.

The make.conf included in the tarball doesn't set CFLAGS="-march=native", and has MAKEOPTS="-j17" or something. Is it just me or is this a crazy default?

It might also be a good idea to select a mirror and copy DNS info.

Step 5. The handbook instructs us to use --rbind instead of --bind, to use -t proc when mounting /proc, and doesn't mention mounting /dev/pts. Would it be better to update these instructions or just ignore the handbook?

Step 5.5. Install a recent Portage snapshot and update the @world set:

root #emerge-webrsync
root #emerge -auDN @world

At this point, Portage will complain that there are unmerged config files, so you will need to do that:

root #dispatch-conf

Also, some USE flag changes are neccessary. If you manage to figure out what to do here, please update this article accordingly.

Hi Astronome , this is just a friendly reminder to sign your contributions to talk pages. :) --Maffblaster (talk) 19:36, 22 May 2016 (UTC)
You bet. --Astronome (talk) 01:36, 25 May 2016 (UTC)