New install on new computer

Gloom_Scythe · n00b Joined: 01 Sep 2014 Posts: 19

Hello Everyone,
It has been a while since I have had the pleasure of installing Gentoo. Getting ready to finish building my new computer after 15 years:

AMD R9 7900
64 gb of ddr5
2tb nvme
Older amd gpu.

I was looking up guides on secure boot. I saw 3 of them. Is there one that is better than the other two? I plan on generating my own keys and not use the microsoft provided ones. I do not plan on dual booting this time. I am pretty much done with Windows other than what is on my laptop. I have been reading up on zram and tmpfs. I would like to use my 64 gb of ram to hold most of portage and temp files if possible to avoid lots of read/writes on the NVME. Is there any advice on using tmpfs and what you guys suggest on the -j makeopts variable. The cpu is a 12 core 24 thread. I additionally want to install steam. I have a steam deck and I am blown away how far proton/wine/steam has come. Would a flatpak be cleaner than just compiling through portage? I plan on getting a nvidia gpu if the prices drop (hopefully) when the 50 series cards come out. What is the state of the nvidia drivers for gentoo? It has been close to 10 years since I have installed and used Gentoo. I see quite a bit has changed. I am super excited to see what compile times the 12 core processor will provide!

CooSee · Veteran Joined: 20 Nov 2004 Posts: 1476 Location: Earth

Welcome back

pingtoo · Posted: Thu Dec 12, 2024 2:38 pm Post subject:

Gloom_Scythe,

tmpfs vs zram.

I use zram for my gentoo build process it for same reason I wan to reduce I/O on my SD card.

Gloom_Scythe · n00b Joined: 01 Sep 2014 Posts: 19

@CooSee,
This is the guide I was looking at regarding secureboot:
https://wiki.gentoo.org/wiki/Secure_Boot
I saw there was 2 other ones… looked to be older. One from I think Sakura (misspelled?)

The last time I installed there was still stage 1 and 2 hehe. Tried one other time after that, probably 10-15 years ago and my ssd at the time died… never had time to do the install till now. I might VM windows in linux if i need to use it for work. I will do the gentoo route regarding steam. Debating on whether to select the multiprofile or not during install.

So you two recommend zram instead of putting the whole portage tmp folder in ram? Just waiting on my power supply and the.mn I can get started. I have an Amd fury that I will probably use until I find a reasonable gpu. I still would prefer nvidia. I like the rtx stuff… even though it is a bit gimmicky. Did kde and gnome go full on wayland yet? Still catching myself up on all the changes! Gentoo has come a long way!

pingtoo · Posted: Thu Dec 12, 2024 6:15 pm Post subject:

zen_desu · n00b Joined: 25 Oct 2024 Posts: 50

I wrote most of the "secure boot" article. A fair portion of the info came from existing pages, but the guide is hopefully more clear, to the point, and up to date. I tried to include all references on the page. The older guides aren't going to explain anything about portage integration because that is rather new. https://wiki.gentoo.org/wiki/Secure_Boot#USE_flags
_________________
µgRD dev
Wiki writer

Gloom_Scythe · n00b Joined: 01 Sep 2014 Posts: 19

Zen_desu I will give a go in about a week and let you know if I run into problems. I was going to generate my own keys after reading about bootkitty abusing the microsoft keys in ubuntu. It looks straight forward. My PSU is on backorder. I am going to have to read up on systemd. I usually use openrc but it looks like not much is supporting openrc any longer.

zen_desu · n00b Joined: 25 Oct 2024 Posts: 50

https://wiki.gentoo.org/wiki/Secure_Boot#Symmetrically_protected_keyfile_creation
https://wiki.gentoo.org/wiki/Secure_Boot#Batch_creation
https://wiki.gentoo.org/wiki/Secure_Boot#Signing_the_Signature_Lists

These steps are more or less the whole process to create the keys.

First, you create the keys, then you create a signature list, then you sign that using each "layer" of keys.

Once signed, these keys can be installed, with the PK installed last as it disabled setup mode.

The process isn't that complex as much as it must be done carefully. The main concern is signing things in the right order.

The final step is signing files using the DB key:

https://wiki.gentoo.org/wiki/Secure_Boot#Signing

Signatures can be verified before rebooting:

https://wiki.gentoo.org/wiki/Secure_Boot#Verifying_Signatures
_________________
µgRD dev
Wiki writer

Gloom_Scythe · n00b Joined: 01 Sep 2014 Posts: 19

I do have one question. Should I do the secureboot steps after installing gentoo or do it in the liveguid image during install? I was going to do it in the liveusb environment. I re-read the guide and realized I need to install the crypt and sig tools.

zen_desu · n00b Joined: 25 Oct 2024 Posts: 50

You can kinda do it at any time, I'd do it when you're prepared to reboot a fair bit.

When you're in the chroot, you can get the tools for this and do it there. This isn't that different from just doing it once rebooted, but it could save you a reboot if you're trying to keep this process streamlined.

You'll need to reboot once to clear keys/put it in setup mode, and then again to re-enable and test it.

If you're replacing a kernel with a signed one, there is very little to adjust from the system PoV. I mean it may be booting a file from the same path so bootloaders don't need to be adjusted.
_________________
µgRD dev
Wiki writer