Manual disk configuration of PureOS 10 with encrypted boot

Software PureOS
1

Hello.

Since this is my first post here I think it’s good to write just a few words about me. I’m a software engineer, I mainly work as a Java specialist, but my duties also include a good bunch of system setup. I’ve been evaluating Pure OS since a few months, at the moment on general hardware (mostly old Apple laptops) and virtual machines. I mainly work with macOS (even though it’s not unlikely that I will move out sooner or later). I also work with other Linux distributions (Ubuntu, Elementary OS, RHEL), but for my own computers I’m evaluating Pure OS to be my standard distro. After the evaluation is finished I’ll consider buying a Purism laptop. End of the introduction.

Since a few days I’m playing with Pure OS 10. I’m very happy that it allowed me to install it on a 2011 MacBook Pro with EFI BIOS (I couldn’t with Pure OS 9) up to the point I can run the Ansible playbook that sets up everything I need.

Now I’m working with a second round in which I’m redoing everything:

  1. using a simple script to set up partitioning (I need to have everything automated as much as possible).
  2. using LVM + LUKS + BTRFS.

Thanks to the tip published here I was able to work around the Calamares bug with LVM+LUKS, so I have /, /home and swap as logical volumes of an encrypted physical volume.

Basically at the moment I’m only missing the encryption of /boot with grub support. I know some documentation that describes how to do that (e.g. this), but there are a few variants and I’d like to reproduce the way the Pure OS installer works.

Is there any documentation about it?
Thanks.

2

When/if you plan on buying a Purism laptop do you plan on getting a librem key and running Pureboot? If so, you will need an unencrypted /boot so maybe you won’t need to worry about it :slight_smile:

1 Like
3

Shot in the dark, but maybe this helps?

https://cryptsetup-team.pages.debian.net/cryptsetup/encrypted-boot.html

4

Well, this is a useful piece of information. Yes, I suppose I’ll buy the key together with the laptop. I didn’t know it impact the status of the boot partition. I’m going to have a read about it. Thanks.