Thursday, 4 July 2024
Wednesday, 3 July 2024
如何在ventoy里运行fydeOS？
下载fydeOS提供的压缩包，直接将压缩包里的img镜像拖出来，这个img文件有6.8G，我用Etcher-Portable-1.7.7将它烧录到一个16G的U盘上，刻录过程中镜像文件会自动占满整块U盘，这样就等于在U盘中实现了文件系统的扩容，下一步只需要将U盘打包到一个新的ISO镜像中即可。
启动manjaro，将U盘插入USB口。进入一个较大的目录（可用空间必须大于16G），打开终端，输入：
1 | sudo fdisk -l |
返回：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 | Disk /dev/nvme0n1：476.94 GiB，512110190592 字节，1000215216 个扇区磁盘型号：INTEL HBRPEKNX0202AL 单元：扇区 / 1 * 512 = 512 字节扇区大小(逻辑/物理)：512 字节 / 512 字节I/O 大小(最小/最佳)：512 字节 / 512 字节磁盘标签类型：gpt磁盘标识符：31BBDF65-A9A3-4FDF-81A8-D518363C6258设备 起点 末尾 扇区 大小 类型/dev/nvme0n1p1 2048 209719295 209717248 100G Microsoft 基本数据/dev/nvme0n1p2 209719296 629153791 419434496 200G Microsoft 基本数据/dev/nvme0n1p3 629153792 1000210638 371056847 176.9G Microsoft 基本数据Disk /dev/nvme1n1：27.25 GiB，29260513280 字节，57149440 个扇区磁盘型号：INTEL HBRPEKNX0202ALO 单元：扇区 / 1 * 512 = 512 字节扇区大小(逻辑/物理)：512 字节 / 512 字节I/O 大小(最小/最佳)：512 字节 / 512 字节磁盘标签类型：gpt磁盘标识符：CD0AB2F1-8EAC-41C4-B565-1C0B4875DC4E设备 起点 末尾 扇区 大小 类型/dev/nvme1n1p1 2048 57083863 57081816 27.2G Microsoft 基本数据/dev/nvme1n1p2 57083864 57149399 65536 32M Microsoft 基本数据GPT PMBR 大小不符（67108863 != 67108864），将用写入予以更正。The backup GPT table is not on the end of the device.Disk /dev/mapper/ventoy：32 GiB，34359738880 字节，67108865 个扇区单元：扇区 / 1 * 512 = 512 字节扇区大小(逻辑/物理)：512 字节 / 512 字节I/O 大小(最小/最佳)：512 字节 / 512 字节磁盘标签类型：gpt磁盘标识符：E998B290-B8BB-0D46-854A-4268811D814F设备 起点 末尾 扇区 大小 类型/dev/mapper/ventoy1 4096 618495 614400 300M EFI 系统/dev/mapper/ventoy2 618496 67103504 66485009 31.7G Linux 文件系统Disk /dev/mapper/ventoy1：300 MiB，314572800 字节，614400 个扇区单元：扇区 / 1 * 512 = 512 字节扇区大小(逻辑/物理)：512 字节 / 512 字节I/O 大小(最小/最佳)：512 字节 / 512 字节磁盘标签类型：dos磁盘标识符：0x00000000Disk /dev/mapper/ventoy2：31.7 GiB，34040324608 字节，66485009 个扇区单元：扇区 / 1 * 512 = 512 字节扇区大小(逻辑/物理)：512 字节 / 512 字节I/O 大小(最小/最佳)：512 字节 / 512 字节GPT PMBR 大小不符（14287004 != 30719999），将用写入予以更正。Disk /dev/sdc：14.65 GiB，15728640000 字节，30720000 个扇区磁盘型号：ProductCode 单元：扇区 / 1 * 512 = 512 字节扇区大小(逻辑/物理)：512 字节 / 512 字节I/O 大小(最小/最佳)：512 字节 / 512 字节磁盘标签类型：gpt磁盘标识符：1DF41F80-84D3-6B4E-B82A-D1B86AC5EEAA设备 起点 末尾 扇区 大小 类型/dev/sdc1 5898240 30709759 24811520 11.8G Linux 文件系统/dev/sdc2 20480 53247 32768 16M ChromeOS 内核/dev/sdc3 319488 5898239 5578752 2.7G ChromeOS 根文件系统/dev/sdc4 53248 86015 32768 16M ChromeOS 内核/dev/sdc5 315392 319487 4096 2M ChromeOS 根文件系统/dev/sdc6 16448 16448 1 512B ChromeOS 内核/dev/sdc7 16449 16449 1 512B ChromeOS 根文件系统/dev/sdc8 86016 118783 32768 16M Linux 文件系统/dev/sdc9 16450 16450 1 512B ChromeOS 保留/dev/sdc10 16451 16451 1 512B ChromeOS 保留/dev/sdc11 64 16447 16384 8M 未知/dev/sdc12 249856 315391 65536 32M EFI 系统分区表记录没有按磁盘顺序。 |
这一步也可以用命令
1 | lsblk -p |
来做。
可以看到U盘被识别为/dev/sdc，大小为14.65G。输入以下命令将整个U盘复制到一个新建的ISO镜像文件：
sudo dd if=/dev/sdc of=fydeOS-New-16G.img bs=1M count=16000
1 | sudo cp /dev/sdc fydeOS_new_16G.iso |
等大约10分钟，ISO文件制作完成。这里要注意的是，这个ISO是不能自启动的，我们只需要简单地将其后缀名改为img即可，也就是将fydeOS_new_16G.iso改名为fydeOS_new_16G.img
这样镜像文件fydeOS-New-16G.img就制作做好了。将它拷贝出来放到ventoy目录下就可以直接运行，文档系统扩容后也可以适当安装一些安卓APK了。实测扩容后，STATE分区可用空间从1.3G变成10.1G，这样在fydeOS里装个微信什么的就很方便了。这种通过ventoy来直接运行img的方法比在U盘里运行速度快多了，毕竟SSD的速度不是U盘的速度能比的，即便是固态U盘也被暴打呀。我这篇博客就是在ventoy里的fydeOS镜像中完成的。如果觉得16G仍不够用，你也可以找个128G或者更大容量的U盘按照上述步骤操作一番即可。
Using network bound disk encryption with Stratis
In an environment with many encrypted disks, unlocking them all is a difficult task. Network bound disk encryption (NBDE) helps automate the process of unlocking Stratis volumes. This is a critical requirement in large environments. Stratis version 2.1 added support for encryption, which was introduced in the article “Getting started with Stratis encryption.” Stratis version 2.3 recently introduced support for Network Bound Disk Encryption (NBDE) when using encrypted Stratis pools, which is the topic of this article.
The Stratis website describes Stratis as an “easy to use local storage management for Linux.” The short video “Managing Storage With Stratis” gives a quick demonstration of the basics. The video was recorded on a Red Hat Enterprise Linux 8 system, however, the concepts shown in the video also apply to Stratis in Fedora Linux.
Prerequisites
This article assumes you are familiar with Stratis, and also Stratis pool encryption. If you aren’t familiar with these topics, refer to this article and the Stratis overview video previously mentioned.
NBDE requires Stratis 2.3 or later. The examples in this article use a pre-release version of Fedora Linux 34. The Fedora Linux 34 final release will include Stratis 2.3.
Overview of network bound disk encryption (NBDE)
One of the main challenges of encrypting storage is having a secure method to unlock the storage again after a system reboot. In large environments, typing in the encryption passphrase manually doesn’t scale well. NBDE addresses this and allows for encrypted storage to be unlocked in an automated manner.
At a high level, NBDE requires a Tang server in the environment. Client systems (using Clevis Pin) can automatically decrypt storage as long as they can establish a network connection to the Tang server. If there is no network connectivity to the Tang server, the storage would have to be decrypted manually.
The idea behind this is that the Tang server would only be available on an internal network, thus if the encrypted device is lost or stolen, it would no longer have access to the internal network to connect to the Tang server, therefore would not be automatically decrypted.
For more information on Tang and Clevis, see the man pages (man tang, man clevis) , the Tang GitHub page, and the Clevis GitHub page.
Setting up the Tang server
This example uses another Fedora Linux system as the Tang server with a hostname of tang-server. Start by installing the tang package:
dnf install tang
Then enable and start the tangd.socket with systemctl:
systemctl enable tangd.socket --now
Tang uses TCP port 80, so you also need to open that in the firewall:
firewall-cmd --add-port=80/tcp --permanent
firewall-cmd --add-port=80/tcp
Finally, run tang-show-keys to display the output signing key thumbprint. You’ll need this later.
# tang-show-keys l3fZGUCmnvKQF_OA6VZF9jf8z2s
Creating the encrypted Stratis Pool
The previous article on Stratis encryption goes over how to setup an encrypted Stratis pool in detail, so this article won’t cover that in depth.
The first step is capturing a key that will be used to decrypt the Stratis pool. Even when using NBDE, you need to set this, as it can be used to manually unlock the pool in the event that the NBDE server is unreachable. Capture the pool1 key with the following command:
# stratis key set --capture-key pool1key Enter key data followed by the return key:
Then I’ll create an encrypted Stratis pool (using the pool1key just created) named pool1 using the /dev/vdb device:
# stratis pool create --key-desc pool1key pool1 /dev/vdb
Next, create a filesystem in this Stratis pool named filesystem1, create a mount point, mount the filesystem, and create a testfile in it:
# stratis filesystem create pool1 filesystem1 # mkdir /filesystem1 # mount /dev/stratis/pool1/filesystem1 /filesystem1 # cd /filesystem1 # echo "this is a test file" > testfile
Binding the Stratis pool to the Tang server
At this point, we have the encrypted Stratis pool created, and also have a filesystem created in the pool. The next step is to bind your Stratis pool to the Tang server that you just setup. Do this with the stratis pool bind nbde command.
When you make the Tang binding, you need to pass several parameters to the command:
- the pool name (in this example, pool1)
- the key descriptor name (in this example, pool1key)
- the Tang server name (in this example, http://tang-server)
Recall that on the Tang server, you previously ran tang-show-keys which showed the Tang output signing key thumbprint is l3fZGUCmnvKQF_OA6VZF9jf8z2s. In addition to the previous parameters, you either need to pass this thumbprint with the parameter –thumbprint l3fZGUCmnvKQF_OA6VZF9jf8z2s, or skip the verification of the thumbprint with the –trust-url parameter.
It is more secure to use the –thumbprint parameter. For example:
# stratis pool bind nbde pool1 pool1key http://tang-server --thumbprint l3fZGUCmnvKQF_OA6VZF9jf8z2s
Unlocking the Stratis Pool with NBDE
Next reboot the host, and validate that you can unlock the Stratis pool with NBDE, without requiring the use of the key passphrase. After rebooting the host, the pool is no longer available:
# stratis pool list
Name Total Physical Properties
To unlock the pool using NBDE, run the following command:
# stratis pool unlock clevis
Note that you did not need to use the key passphrase. This command could be automated to run during the system boot up.
At this point, the pool is now available:
# stratis pool list Name Total Physical Properties pool1 4.98 GiB / 583.65 MiB / 4.41 GiB ~Ca, Cr
You can mount the filesystem and access the file that was previously created:
# mount /dev/stratis/pool1/filesystem1 /filesystem1/ # cat /filesystem1/testfile this is a test file
Rotating Tang server keys
Best practices recommend that you periodically rotate the Tang server keys and update the Stratis client servers to use the new Tang keys.
To generate new Tang keys, start by logging in to your Tang server and look at the current status of the /var/db/tang directory. Then, run the tang-show-keys command:
# ls -al /var/db/tang total 8 drwx------. 1 tang tang 124 Mar 15 15:51 . drwxr-xr-x. 1 root root 16 Mar 15 15:48 .. -rw-r--r--. 1 tang tang 361 Mar 15 15:51 hbjJEDXy8G8wynMPqiq8F47nJwo.jwk -rw-r--r--. 1 tang tang 367 Mar 15 15:51 l3fZGUCmnvKQF_OA6VZF9jf8z2s.jwk # tang-show-keys l3fZGUCmnvKQF_OA6VZF9jf8z2s
To generate new keys, run tangd-keygen and point it to the /var/db/tang directory:
# /usr/libexec/tangd-keygen /var/db/tang
If you look at the /var/db/tang directory again, you will see two new files:
# ls -al /var/db/tang total 16 drwx------. 1 tang tang 248 Mar 22 10:41 . drwxr-xr-x. 1 root root 16 Mar 15 15:48 .. -rw-r--r--. 1 tang tang 361 Mar 15 15:51 hbjJEDXy8G8wynMPqiq8F47nJwo.jwk -rw-r--r--. 1 root root 354 Mar 22 10:41 iyG5HcF01zaPjaGY6L_3WaslJ_E.jwk -rw-r--r--. 1 root root 349 Mar 22 10:41 jHxerkqARY1Ww_H_8YjQVZ5OHao.jwk -rw-r--r--. 1 tang tang 367 Mar 15 15:51 l3fZGUCmnvKQF_OA6VZF9jf8z2s.jwk
And if you run tang-show-keys, it will show the keys being advertised by Tang:
# tang-show-keys
l3fZGUCmnvKQF_OA6VZF9jf8z2s
iyG5HcF01zaPjaGY6L_3WaslJ_E
You can prevent the old key (starting with l3fZ) from being advertised by renaming the two original files to be hidden files, starting with a period. With this method, the old key will no longer be advertised, however it will still be usable by any existing clients that haven’t been updated to use the new key. Once all clients have been updated to use the new key, these old key files can be deleted.
# cd /var/db/tang # mv hbjJEDXy8G8wynMPqiq8F47nJwo.jwk .hbjJEDXy8G8wynMPqiq8F47nJwo.jwk # mv l3fZGUCmnvKQF_OA6VZF9jf8z2s.jwk .l3fZGUCmnvKQF_OA6VZF9jf8z2s.jwk
At this point, if you run tang-show-keys again, only the new key is being advertised by Tang:
# tang-show-keys iyG5HcF01zaPjaGY6L_3WaslJ_E
Next, switch over to your Stratis system and update it to use the new Tang key. Stratis supports doing this while the filesystem(s) are online.
First, unbind the pool:
# stratis pool unbind pool1
Next, set the key with the original passphrase used when the encrypted pool was created:
# stratis key set --capture-key pool1key
Enter key data followed by the return key:
Finally, bind the pool to the Tang server with the updated key thumbprint:
# stratis pool bind nbde pool1 pool1key http://tang-server --thumbprint iyG5HcF01zaPjaGY6L_3WaslJ_E
The Stratis system is now configured to use the updated Tang key. Once any other client systems using the old Tang key have been updated, the two original key files that were renamed to hidden files in the /var/db/tang directory on the Tang server can be backed up and deleted.
What if the Tang server is unavailable?
Next, shutdown the Tang server to simulate it being unavailable, then reboot the Stratis system.
Again, after the reboot, the Stratis pool is not available:
# stratis pool list Name Total Physical Properties
If you try to unlock it with NBDE, this fails because the Tang server is unavailable:
# stratis pool unlock clevis Execution failed: An iterative command generated one or more errors: The operation 'unlock' on a resource of type pool failed. The following errors occurred: Partial action "unlock" failed for pool with UUID 4d62f840f2bb4ec9ab53a44b49da3f48: Cryptsetup error: Failed with error: Error: Command failed: cmd: "clevis" "luks" "unlock" "-d" "/dev/vdb" "-n" "stratis-1-private-42142fedcb4c47cea2e2b873c08fcf63-crypt", exit reason: 1 stdout: stderr: /dev/vdb could not be opened.
At this point, without the Tang server being reachable, the only option to unlock the pool is to use the original key passphrase:
# stratis key set --capture-key pool1key
Enter key data followed by the return key:
You can then unlock the pool using the key:
# stratis pool unlock keyring
Next, verify the pool was successfully unlocked:
# stratis pool list Name Total Physical Properties pool1 4.98 GiB / 583.65 MiB / 4.41 GiB ~Ca, Cr
from https://fedoramagazine.org/network-bound-disk-encryption-with-stratis/
(中文翻译：http://www.linuxrtm.com/c/7101.html）
dmv驾照路考不通过的十大关键原因
https://www.youtube.com/watch?v=zbZ2x60nhq4
https://www.youtube.com/watch?v=BRNnuWsYxkA （美国十字路口紅綠燈轉彎規則）
https://www.youtube.com/watch?v=XwHp22vkwfg （Pomona DMV Mock Driving test）
https://www.youtube.com/watch?v=XP53jr5LkUI （Pomona DMV Mock Driving test）
https://www.youtube.com/watch?v=Ed2mPaqHf3w
https://www.youtube.com/watch?v=sY3NH23JeDA (中間左轉車道)
Monday, 1 July 2024
基于 Android的 开源系统，让你的老电脑再次焕发生机：BlissOS
之前给大家分享过好几个基于安卓 Android x86 的 PC 操作系统，例如：Phoenix OS、FydeOS，适合一些老旧低配置电脑日常轻度使用，不过这些系统很多都不维护更新了。
今天分享这个「BlissOS」系统最新版本（ 16.x ）基于 Android 13 可以保证大多数应用兼容支持使用，同时提供了 with GApps / FOSS 版本。
GApps 版本：包含 Google 的核心应用和服务，例如 Google Play 商店、Gmail、Google 地图等。
FOSS 版本：不包含任何 Google 的应用或服务，完全基于开源替代方案。
系统介绍
系统支持 x86/x86_64 的设备上安装、支持 BIOS/CSM 和 UEFI 启动。兼容 MacBook 和 Chromebook、不过虚拟机体验只支持 KVM / QEMU，对于主流的 VMWare 和 VirtualBox 支持不太好。
安装也很简单，通过 UltraISO 或者 Rufus 工具来制作 U 盘启动，然后 U 盘镜像插入电脑，进入 BIOS 设置 U 盘优先启动即可。
功能方面「BlissOS」最大的特点之一是它的定制性和灵活性。用户可以根据自己的喜好调整和定制系统，包括更改主题、安装第三方应用商店等。
显卡方面内核基于 Linux 所以支持大部分显卡加速，不过因为驱动原因仅支持极少的 Nvidia 显卡。
功能特色
Root：使用 KernelSU 预 root，无需安装 Magisk 或写入系统分区
更多兼容性：借助最新的 XtMapper 键盘映射器，您将能够使用键盘和鼠标轻松控制您的应用程序。
桌面或平板电脑模式：允许用户根据所使用的启动器在桌面或平板电脑 UI 之间进行选择
简洁界面：没有任何臃肿的广告、极简风格桌面
自定义设置：提供许多可定制的选项、集成了许多优化和功能
官方网站：
https://blissos.org
ScreenCapture - 开源轻量级的截图工具
虽然目前截图工具很多了，但是如果你需要一款能截图标注并且免费轻量级的话可以试试这款「ScreenCapture」软件，占用内存非常低，同时还支持剪切板内的图片钉在桌面上的功能。
它利用 Direct2D 技术实现快速的图像旋转、翻转、灰阶和反相处理，并具备无损优化功能以减少文件体积。还可以使用画笔/橡皮擦工具进行细节编辑，并无限次撤销重做，轻松调整图像尺寸以满足不同的应用需求。
功能介绍
跨屏幕截图、高分屏支持、窗口区域高亮。
取景框，支持快捷键复制 RGB 颜色 （Ctrl+R）和 HEX 颜色（Ctrl+H）。
绘制填充、非填充的椭圆、正圆（Shift按下）、矩形、正方形（Shift按下）、箭头、排序标号（拖拽调整箭头方向和大小，滚轮调整大小）。
画曲线、直线（Shift按下）、半透明直线、马赛克、橡皮擦、文本（滚轮调整文字大小）。
可以随时修改已绘制的元素（鼠标移到元素上等待 1.6 秒）。
上一步（Ctrl+Z）、下一步（Ctrl+Y）。
在新窗口中钉住截图区域（Ctrl+P）,鼠标滚轮改变钉图窗口大小。
保存成文件（Ctrl+S）、保存到剪切板（Ctrl+C）。
多语言支持（ScreenCapture.exe --lang:en_us）。
直接把剪切板内的图片钉在桌面上（ScreenCapture.exe --pin:clipboard）。
设置默认保存目录（ScreenCapture.exe --dir:"D:\doc\测试目录"）。
非常快、低内存消耗、低 CPU 使用率。
非常小、仅一个可执行文件（3.8M），无需安装，不依赖任何动态链接库。
可以非常容易的集成到其他应用中。
基于Skia。
项目地址：
https://github.com/xland/ScreenCapture
下载地址：https://github.com/xland/ScreenCapture/releases/download/2.1.9/ScreenCapture.exe
Subscribe to:
Posts (Atom)